Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-74776

Jira Server/DC impacted by CVE-2022-22970 & CVE-2022-22971 via vulnerable version of Spring framework

XMLWordPrintable

    • 6.5
    • Medium
    • CVE-2022-22970

      Jira is not impacted (no action is required) as the vulnerability cannot be exploited.

      All Jira versions below 9.6 uses an affected version of Spring Framework, reason why the JRASERVER-74776 was published, however Jira does not use the affected methods from the Spring, hence is not impacted:

      • CVE-2022-22970 Spring Framework handling file uploads Denial of Service: Spring is not used for file handling, we use commons-fileupload v1.3.3.
      • CVE-2022-22971 Spring Framework using STOMP over WebSockets Denial of Service: Jira has no usages of WebSockets

      No action is required at the moment to mitigate the vulnerabilities as Jira is not impacted.

      ----------------------------------------------

      Affected versions of Atlassian Jira Server/DC is impacted by CVE-2022-22970 & CVE-2022-22971 owing to use of spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions.

      Affected versions:

      • version < 9.6.0

      Fixed versions:

      • 9.6.0

            [JRASERVER-74776] Jira Server/DC impacted by CVE-2022-22970 & CVE-2022-22971 via vulnerable version of Spring framework

            Nalini Kumar added a comment -

            Is this fixed in >=8.20.22? The fixed versions field in this Bug report says so.

            Nalini Kumar added a comment - Is this fixed in >=8.20.22? The fixed versions field in this Bug report says so.

            SyedAhmedKabeer added a comment -

            Hello Team,

            After Jira 9.4.14 update my plugin is not started.

            Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type

            Could you please support?

            SyedAhmedKabeer added a comment - Hello Team, After Jira 9.4.14 update my plugin is not started. Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type Could you please support?
            Jack Probst made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 817780 ]
            Cathy S made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 764985 ]
            Mathias Richter made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 752746 ]

            Andrzej Kotas added a comment -

            As Jira is not impacted and the vulnerability cannot be exploited we we're not planning on back-porting. Though we understand the compliance aspect of the issue and revised the decision. The LTS will be updated accordingly. ** 

            Best regards

            Andrzej Kotas

            Product Manager - Jira DC

            Andrzej Kotas added a comment - As Jira is not impacted and the vulnerability  cannot be exploited we we're not planning on back-porting. Though we understand the compliance aspect of the issue and revised the decision. The LTS will be updated accordingly. **  Best regards Andrzej Kotas Product Manager - Jira DC
            Karol Skwierawski made changes -
            Assignee New: Karol Skwierawski [ 4e432536cf93 ]
            Karol Skwierawski made changes -
            Fix Version/s New: 9.4.6 [ 104661 ]
            Fix Version/s New: 8.20.22 [ 104907 ]
            Leonardo Souto made changes -
            Description Original: Affected versions of Atlassian Jira Server/DC is impacted by CVE-2022-22970 & CVE-2022-22971 owing to use of spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions.

            *Affected versions:*
             * version < 9.6.0

            *Fixed versions:*
             * 9.6.0             		New: *Jira is not impacted* (no action is required) as the vulnerability {+}*cannot be exploited*{+}.

            All Jira versions below *9.6* uses an affected version of Spring Framework, reason why the JRASERVER-74776 was published, however Jira {+}*does not use the affected methods from the Spring*{+}, hence {+}*is not impacted*{+}:
             * *CVE-2022-22970* Spring Framework handling file uploads Denial of Service: Spring is not used for file handling, {*}we use commons-fileupload v1.3.3{*}.
             * *CVE-2022-22971* Spring Framework using STOMP over WebSockets Denial of Service: *Jira has no usages of WebSockets*

            No action is required at the moment to mitigate the vulnerabilities as Jira is not impacted.

            ----------------------------------------------

            Affected versions of Atlassian Jira Server/DC is impacted by CVE-2022-22970 & CVE-2022-22971 owing to use of spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions.

            *Affected versions:*
             * version < 9.6.0

            *Fixed versions:*
             * 9.6.0

            James Kawalek added a comment -

            If this will not be backported to the 9.4.X LTS, will a new LTS branch be announced for something > 9.6 ?

            James Kawalek added a comment - If this will not be backported to the 9.4.X LTS, will a new LTS branch be announced for something > 9.6 ?

              4e432536cf93 Karol Skwierawski
              security-metrics-bot Security Metrics Bot
              Votes:
              0 Vote for this issue
              Watchers:
              24 Start watching this issue

                Created:
                Updated:
                Resolved: