We couldn't load all Actvitity tabs. Refresh the page to try again.
If the problem persists, contact your Jira admin.
IMPORTANT: JAC is a Public system and anyone on the internet will be able to view the data in the created JAC tickets. Please don’t include Customer or Sensitive data in the JAC ticket.
Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-70944

Make use of Secure Introspector in Velocity Templates - CVE-2019-20409

    • 8.03
    • Severity 2 - Major
    • Hide
      Atlassian Update – 05 October 2020

      Hi everyone,

      thank you for all your comments and questions.

      We would like to inform you that we have been investigating the possibility of backporting the requested functionality to Jira LTS versions 7.13x and 8.5.x. Unfortunately this improvement causes problems with non-Atlassian plugins preventing them from working correctly. Due to its technical complexity we cannot provide any means of disabling it without manipulation with Jira files.
      We treat this issue as a security improvement, not a security vulnerability that can be exploited. We have made it harder for an attacker to exploit potential server-side template injection vulnerabilities in the future Jira releases.

      In the light of the above, we have decided not to backport the requested functionality to both Jira 8.5.x and 7.13.x LTS releases.

      We understand that this decision may be disappointing, however we want to assure you that we will keep treating all server-side template injection vulnerabilities as high or critical severity issues if they affect our LTS releases.

      For those customers who are currently using our LTS versions, we have prepared a workaround (please see the description field of this issue). After applying the workaround all native Jira functionality should work as before, however some 3rd party and your own internal apps may stop working or cause problems with other Jira functionality. You can use this workaround at your own discretion.

      The security improvement will be available in our upcoming 8.13 LTS release. If you have any questions or feedback about the workaround, please leave us a comment.

      Kind regards,
      Paweł Przytarski
      Jira Server Bugfix Team

      Show
      Atlassian Update – 05 October 2020 Hi everyone, thank you for all your comments and questions. We would like to inform you that we have been investigating the possibility of backporting the requested functionality to Jira LTS versions 7.13x and 8.5.x. Unfortunately this improvement causes problems with non-Atlassian plugins preventing them from working correctly. Due to its technical complexity we cannot provide any means of disabling it without manipulation with Jira files. We treat this issue as a security improvement, not a security vulnerability that can be exploited. We have made it harder for an attacker to exploit potential server-side template injection vulnerabilities in the future Jira releases. In the light of the above, we have decided not to backport the requested functionality to both Jira 8.5.x and 7.13.x LTS releases. We understand that this decision may be disappointing, however we want to assure you that we will keep treating all server-side template injection vulnerabilities as high or critical severity issues if they affect our LTS releases. For those customers who are currently using our LTS versions, we have prepared a workaround (please see the description field of this issue). After applying the workaround all native Jira functionality should work as before, however some 3rd party and your own internal apps may stop working or cause problems with other Jira functionality. You can use this workaround at your own discretion. The security improvement will be available in our upcoming 8.13 LTS release. If you have any questions or feedback about the workaround, please leave us a comment. Kind regards, Paweł Przytarski Jira Server Bugfix Team

      This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented.

      The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.

      Affected versions:

      • version < 8.8.0

      Fixed versions:

      • 8.8.0

      Workaround for previous versions:
      You use this workaround at your own discretion.

      1. Download Jira 8.12 as zip and extract it’s content
      2. Localize your Jira instance installation directory
      3. Shutdown your Jira instance
      4. Go to the <jira_installation_dir>/atlassian-jira/WEB-INF/lib/ directory
      5. Remove files: velocity-htmlsafe-3.0.0.jar and velocity-1.6.4-atlassian-7.jar
      6. Copy files velocity-htmlsafe-3.1.1.jar and velocity-1.6.4-atlassian-21.jar from downloaded Jira 8.12 to current directory. They are found in the <Jira_8_12_dir>/atlassian-jira/WEB-INF/lib/ directory
      7. Go to the <jira_installation_dir>/atlassian-jira/WEB-INF/classes directory
      8. Replace the velocity.properties and velocity-static.properties files with their counterparts from the downloaded Jira 8.12
      9. Start your Jira instance again

            Loading...
            IMPORTANT: JAC is a Public system and anyone on the internet will be able to view the data in the created JAC tickets. Please don’t include Customer or Sensitive data in the JAC ticket.
            Uploaded image for project: 'Jira Data Center'
            1. Jira Data Center
            2. JRASERVER-70944

            Make use of Secure Introspector in Velocity Templates - CVE-2019-20409

              • 8.03
              • Severity 2 - Major
              • Hide
                Atlassian Update – 05 October 2020

                Hi everyone,

                thank you for all your comments and questions.

                We would like to inform you that we have been investigating the possibility of backporting the requested functionality to Jira LTS versions 7.13x and 8.5.x. Unfortunately this improvement causes problems with non-Atlassian plugins preventing them from working correctly. Due to its technical complexity we cannot provide any means of disabling it without manipulation with Jira files.
                We treat this issue as a security improvement, not a security vulnerability that can be exploited. We have made it harder for an attacker to exploit potential server-side template injection vulnerabilities in the future Jira releases.

                In the light of the above, we have decided not to backport the requested functionality to both Jira 8.5.x and 7.13.x LTS releases.

                We understand that this decision may be disappointing, however we want to assure you that we will keep treating all server-side template injection vulnerabilities as high or critical severity issues if they affect our LTS releases.

                For those customers who are currently using our LTS versions, we have prepared a workaround (please see the description field of this issue). After applying the workaround all native Jira functionality should work as before, however some 3rd party and your own internal apps may stop working or cause problems with other Jira functionality. You can use this workaround at your own discretion.

                The security improvement will be available in our upcoming 8.13 LTS release. If you have any questions or feedback about the workaround, please leave us a comment.

                Kind regards,
                Paweł Przytarski
                Jira Server Bugfix Team

                Show
                Atlassian Update – 05 October 2020 Hi everyone, thank you for all your comments and questions. We would like to inform you that we have been investigating the possibility of backporting the requested functionality to Jira LTS versions 7.13x and 8.5.x. Unfortunately this improvement causes problems with non-Atlassian plugins preventing them from working correctly. Due to its technical complexity we cannot provide any means of disabling it without manipulation with Jira files. We treat this issue as a security improvement, not a security vulnerability that can be exploited. We have made it harder for an attacker to exploit potential server-side template injection vulnerabilities in the future Jira releases. In the light of the above, we have decided not to backport the requested functionality to both Jira 8.5.x and 7.13.x LTS releases. We understand that this decision may be disappointing, however we want to assure you that we will keep treating all server-side template injection vulnerabilities as high or critical severity issues if they affect our LTS releases. For those customers who are currently using our LTS versions, we have prepared a workaround (please see the description field of this issue). After applying the workaround all native Jira functionality should work as before, however some 3rd party and your own internal apps may stop working or cause problems with other Jira functionality. You can use this workaround at your own discretion. The security improvement will be available in our upcoming 8.13 LTS release. If you have any questions or feedback about the workaround, please leave us a comment. Kind regards, Paweł Przytarski Jira Server Bugfix Team

                This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented.

                The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.

                Affected versions:

                • version < 8.8.0

                Fixed versions:

                • 8.8.0

                Workaround for previous versions:
                You use this workaround at your own discretion.

                1. Download Jira 8.12 as zip and extract it’s content
                2. Localize your Jira instance installation directory
                3. Shutdown your Jira instance
                4. Go to the <jira_installation_dir>/atlassian-jira/WEB-INF/lib/ directory
                5. Remove files: velocity-htmlsafe-3.0.0.jar and velocity-1.6.4-atlassian-7.jar
                6. Copy files velocity-htmlsafe-3.1.1.jar and velocity-1.6.4-atlassian-21.jar from downloaded Jira 8.12 to current directory. They are found in the <Jira_8_12_dir>/atlassian-jira/WEB-INF/lib/ directory
                7. Go to the <jira_installation_dir>/atlassian-jira/WEB-INF/classes directory
                8. Replace the velocity.properties and velocity-static.properties files with their counterparts from the downloaded Jira 8.12
                9. Start your Jira instance again

                        Unassigned Unassigned
                        security-metrics-bot Security Metrics Bot
                        Votes:
                        0 Vote for this issue
                        Watchers:
                        42 Start watching this issue

                          Created:
                          Updated:
                          Resolved:

                            Unassigned Unassigned
                            security-metrics-bot Security Metrics Bot
                            Affected customers:
                            0 This affects my team
                            Watchers:
                            42 Start watching this issue

                              Created:
                              Updated:
                              Resolved: