Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-73578

Upgrade PostgresSQL JDBC driver to 42.2.25+ version

XMLWordPrintable

    • 1
    • We collect Jira feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

      Problem Definition

      Jira 8.22.0 and lower versions have PostgresSQL driver version 42.2.23. This version has a vulnerability as described in: https://nvd.nist.gov/vuln/detail/CVE-2022-21724

      Suggested Solution

      Upgrade bundled PostgresSQL JDBC driver to 42.2.25+ version

      Workaround

      Upgrade driver manually , for example to 42.2.25

            [JRASERVER-73578] Upgrade PostgresSQL JDBC driver to 42.2.25+ version

            Karol Skwierawski added a comment -

            8.13.25
            8.20.12
            8.22.2

            Karol Skwierawski added a comment - 8.13.25 8.20.12 8.22.2

            Andriy Yakovlev [Atlassian] added a comment -

            Hey 41708b72801b

            We didn't test this new version yet, so we don't know for sure. Assuming it works fine, then replacing postgresql-42.2.23.jar file with 42.2.25 version is enough

            Hope this helps.

            Best regards,
            Andriy | SET

            Andriy Yakovlev [Atlassian] added a comment - Hey 41708b72801b We didn't test this new version yet, so we don't know for sure. Assuming it works fine, then replacing postgresql-42.2.23.jar file with 42.2.25 version is enough Hope this helps. Best regards, Andriy | SET

            Austin added a comment -

            How would one manually update this driver? I see that it's located at /jira-install/lib/postgresql-42.2.23.jar , but would replacing that file with 42.2.25 "just work"? Is there a reference that loads the postgresql-*.jar somewhere that also needs to be updated to point to the new version if you swap the files?

            Austin added a comment - How would one manually update this driver? I see that it's located at /jira-install/lib/postgresql-42.2.23.jar , but would replacing that file with 42.2.25 "just work"? Is there a reference that loads the postgresql-*.jar somewhere that also needs to be updated to point to the new version if you swap the files?

              4e432536cf93 Karol Skwierawski
              emarghidan Eduard M
              Votes:
              4 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: