• Type: Bug
• Resolution: Fixed
• Priority: High (View bug fix roadmap)
• Fix Version/s: 8.2.3
• Affects Version/s: 7.13.0, 7.6.12, 8.0.2
• Component/s: Tomcat
• Labels:

  • pse-request

[JRASERVER-69145] Upgrade Tomcat to the version 8.5.38 and later

Collapse comment: Brad Taplin added a comment - 17/Jul/2019 1:43 PM

Brad Taplin added a comment - 17/Jul/2019 1:43 PM

Andrew, this has not been addressed in Jira 7.13.5, the latest shipping version of 7.x. We are upgrading to that now to address a critical vulnerability, but I see that it still has Tomcat 8.5.35.

Also, the workaround suggested earlier breaks the support model, stating clearly up top that
"The information in this page relates to customisations in JIRA. Consequently, Atlassian Support cannot guarantee to provide any support for the steps described on this page as customisations are not covered under Atlassian Support Offerings. Please be aware that this material is provided for your information only and that you use it at your own risk."

Please reopen and escalate this request to address some of the vulnerabilities noted in https://www.cvedetails.com/vulnerability-list/vendor_id-45/product_id-887/version_id-282038/Apache-Tomcat-8.5.35.html. I am relieved to see that the worst of those exploits, CVE-2019-0232, is limited to Windows, because my own instances run on Linux, but that won't make Information Security folks any less concerned about running obsolete middleware.

Expand comment: Brad Taplin added a comment - 17/Jul/2019 1:43 PM

Brad Taplin added a comment - 17/Jul/2019 1:43 PM Andrew, this has not been addressed in Jira 7.13.5, the latest shipping version of 7.x. We are upgrading to that now to address a critical vulnerability, but I see that it still has Tomcat 8.5.35. Also, the workaround suggested earlier breaks the support model, stating clearly up top that "The information in this page relates to customisations in JIRA. Consequently, Atlassian Support  cannot guarantee to provide any support for the steps described on this page  as customisations are not covered under  Atlassian Support Offerings . Please be aware that this material is provided for your information only and that you use it at your own risk." Please reopen and escalate this request to address some of the vulnerabilities noted in  https://www.cvedetails.com/vulnerability-list/vendor_id-45/product_id-887/version_id-282038/Apache-Tomcat-8.5.35.html . I am relieved to see that the worst of those exploits,  CVE-2019-0232 , is limited to Windows, because my own instances run on Linux, but that won't make Information Security folks any less concerned about running obsolete middleware.

Collapse comment: Andy Heinzer added a comment - 12/Jul/2019 7:40 PM

Andy Heinzer added a comment - 12/Jul/2019 7:40 PM

Jira 8.2.3 has shipped with Tomcat 8.5.40.

Closing this issue as a result.

Expand comment: Andy Heinzer added a comment - 12/Jul/2019 7:40 PM

Andy Heinzer added a comment - 12/Jul/2019 7:40 PM Jira 8.2.3 has shipped with Tomcat 8.5.40. Closing this issue as a result.

Collapse comment: Brad Taplin added a comment - 11/Apr/2019 2:08 PM

Brad Taplin added a comment - 11/Apr/2019 2:08 PM

Hello. As one of the Jira and Confluence admins for Wells Fargo, yes - we would like this updated to 8.5.38 (really 8.5.39) or later, for both Server and Data Center version of both products. Thanks.

Expand comment: Brad Taplin added a comment - 11/Apr/2019 2:08 PM

Brad Taplin added a comment - 11/Apr/2019 2:08 PM Hello. As one of the Jira and Confluence admins for Wells Fargo, yes - we would like this updated to 8.5.38 (really 8.5.39) or later, for both Server and Data Center version of both products. Thanks.