Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-59661

Update Java version bundled found in the installer to a version >= 1.8u71

XMLWordPrintable

      Update the bundled version of java to a version >= 1.8u71 (1.8 update 71), which fixes many security issues (http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixJAVA).
      Included in the security fixes is a fix for CVE-2016-0483 "An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions".

            [JRASERVER-59661] Update Java version bundled found in the installer to a version >= 1.8u71

            Julia Simon (Inactive) added a comment -

            Artifacts to test are here: https://jira-bamboo.internal.atlassian.com/browse/J71SPT-QA0-1/artifact

            Julia Simon (Inactive) added a comment - Artifacts to test are here: https://jira-bamboo.internal.atlassian.com/browse/J71SPT-QA0-1/artifact

            David Black added a comment - - edited

            Using the cvss score for CVE-2016-0483.

            CVSS score: 6.8 => High severity

            Exploitability Metrics

            AccessVector Network
            AccessComplexity Medium
            Authentication None

            Impact Metrics

            ConfImpact Partial
            IntegImpact Partial
            AvailImpact Partial

            See https://extranet.atlassian.com/display/SECURITY/How+to+evaluate+vulnerability+severity+under+CVSS for details and http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 for score calculator.

            David Black added a comment - - edited Using the cvss score for CVE-2016-0483. CVSS score: 6.8 => High severity Exploitability Metrics AccessVector Network AccessComplexity Medium Authentication None Impact Metrics ConfImpact Partial IntegImpact Partial AvailImpact Partial See https://extranet.atlassian.com/display/SECURITY/How+to+evaluate+vulnerability+severity+under+CVSS for details and http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 for score calculator.

              ohernandez@atlassian.com Oswaldo Hernandez (Inactive)
              dblack David Black
              Affected customers:
              0 This affects my team
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: