• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low (View bug fix roadmap)
• Fix Version/s: 8.13.13, 8.20.1
• Affects Version/s: 8.13.12, 8.20.0
• Component/s: None
• Labels:

  • CVE-2021-42574
  • advisory
  • advisory-released
  • dont-import
  • security

[JRASERVER-72978] Unicode characters allow malicious code to be hidden from a human reviewer (Jira Server) - CVE-2021-42574

Maggie O. made changes - 08/Sep/2023 4:56 PM

Remote Link

New: This issue links to "Page (Confluence)" [ 809241 ]

Charlie Marriott made changes - 03/Aug/2022 4:33 AM

Remote Link

New: This issue links to "Page (Confluence)" [ 668557 ]

Security Metrics Bot made changes - 07/Nov/2021 8:28 PM

CVE ID

New: CVE-2021-42574

Yasmine made changes - 01/Nov/2021 10:28 PM

Labels

Original: CVE-2021-42574 advisory advisory-to-release dont-import security

New: CVE-2021-42574 advisory advisory-released dont-import security

Yasmine made changes - 01/Nov/2021 10:27 PM

Description

Original: Researchers at the University of Cambridge reported a vulnerability affecting Jira Server / DC where special characters, known as Unicode bidirectional override characters, are not rendered or displayed in the affected applications. These special characters are typically not displayed by the browser or code editors but can affect the meaning of the source code when it is processed by a compiler or an interpreter. The issue is now fixed. *Affected versions:*  * All versions before 8.13.13  * All versions between 8.14.0 and 8.19.1 (inclusive)  * All 8.20.x LTS versions before 8.20.1 *Fixed versions:*  * 8.13.13  * 8.20.1  * 8.21.0

New: Researchers at the University of Cambridge reported a vulnerability affecting Jira Server / DC where special characters, known as Unicode bidirectional override characters, are not rendered or displayed in the affected applications. These special characters are typically not displayed by the browser or code editors but can affect the meaning of the source code when it is processed by a compiler or an interpreter. The issue is now fixed. *Affected versions:*  * All versions before 8.13.13  * All versions between 8.14.0 and 8.19.1 (inclusive)  * All 8.20.x LTS versions before 8.20.1 *Fixed versions:*  * 8.13.13  * 8.20.1

Yasmine made changes - 01/Nov/2021 10:25 PM

Resolution		New: Fixed [ 1 ]
Status	Original: Draft [ 12872 ]	New: Published [ 12873 ]

Yasmine made changes - 01/Nov/2021 10:25 PM

Security

Original: Atlassian Staff [ 10750 ]

Yasmine made changes - 01/Nov/2021 10:25 PM

Labels

Original: advisory advisory-to-release dont-import security

New: CVE-2021-42574 advisory advisory-to-release dont-import security

Yasmine made changes - 01/Nov/2021 10:24 PM

Summary

Original: Unicode characters allow malicious code to be hidden from a human reviewer (Jira Server)

New: Unicode characters allow malicious code to be hidden from a human reviewer (Jira Server) - CVE-2021-42574

Yasmine made changes - 01/Nov/2021 10:24 PM

Fix Version/s		New: 8.13.13 [ 97809 ]
Fix Version/s	Original: 8.21.0 [ 97591 ]

Load more older history items