Low Summary
JIRA 7.8 apache-httpclient 4.5.4, which is affected by HTTPCLIENT-1888. This has been fixed in 4.5.5 and it is released and available.
Environment
This will only affect instances that use an outbound proxy.
Steps to Reproduce
- Configure Jira with an outbound proxy with authentication.
- There are multiple ways to repro - accessing the dashboard or the support tools section are the easiest.
Expected Results
Gadgets display and the end of life healthcheck does not fail.
Actual Results
The below stack trace is present and the client cannot establish a connection as the exception is thrown.
Caused by: java.lang.NullPointerException at org.apache.http.impl.client.SystemDefaultCredentialsProvider.getCredentials(SystemDefaultCredentialsProvider.java:114) at org.apache.http.impl.client.AuthenticationStrategyImpl.select(AuthenticationStrategyImpl.java:198) at org.apache.http.impl.client.ProxyAuthenticationStrategy.select(ProxyAuthenticationStrategy.java:44) at org.apache.http.impl.auth.HttpAuthenticator.handleAuthChallenge(HttpAuthenticator.java:154) at org.apache.http.impl.execchain.MainClientExec.createTunnelToTarget(MainClientExec.java:484) at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:237) at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:185) at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89) at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:111) at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
Or the gadgets are broken as per the screenshot.
Fix
Upgrade the apache-httpclient to 4.5.5 as per HTTPCLIENT-1888
