Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-76699

Upgrade Tomcat to fix CVE-2023-46589

XMLWordPrintable

      Issue Summary

      Apache Tomcat should be upgraded to 8.5.96 and later or 9.0.83 or a newer version to fix CVE-2023-46589

      • Jira 9.0.x to 9.12 currently come bundled with a version of Tomcat which is vulnerable.
      • Jira 8.x.x currently come bundled with a version of Tomcat which is vulnerable.

      Tomcat versions bundles with Jira can be found in our Bundled Tomcat and Java versions article

      This is reproducible on Data Center: 

      Steps to Reproduce

      • Check the Apache Tomcat version 

      Expected Results

      • LTS and new versions of Jira include Apache Tomcat version 9.0.83 and later

      Actual Results

      • Apache Tomcat version 9.0.82 and earlier

      Workaround

      To mitigate the issue, it is possible to manually upgrade Apache Tomcat by following the process described in the KB article below but please note that this will place the application in an unsupported state:

      WARNING: Unless still reproducible on official releases, Atlassian Support may refuse support requests for Jira running over unofficial Tomcat versions.

          Form Name

            [JRASERVER-76699] Upgrade Tomcat to fix CVE-2023-46589

            Steve Watson added a comment - - edited

            Hello 54794a758297 , thanks for getting in touch. This ticket was created manually, hence the discrepancy.

            An official Jira ticket for this vulnerability does exist, but there has been a delay in publishing it. In the meantime, we shall update this ticket to match that one.

            Also, when the official ticket is published it will be included in the next Security Bulletin.

            Steve Watson added a comment - - edited Hello 54794a758297 , thanks for getting in touch. This ticket was created manually, hence the discrepancy. An official Jira ticket for this vulnerability does exist, but there has been a delay in publishing it. In the meantime, we shall update this ticket to match that one. Also, when the official ticket is published it will be included in the next Security Bulletin.

            Alex Kulichkov added a comment -

            I see that documentation has been updated to v.9.0.84, 

             

            Thanks!

            Alex Kulichkov added a comment - I see that documentation has been updated to v.9.0.84,    Thanks!

            Alex Kulichkov added a comment -

            Hello, so does Jira v.9.12.2 and JSM v.5.12.2 have bundled Tomcat v.9.0.83 or above? We have request from CISO to remediate this since December.

             

            In documentation it still says Tomcat v.9.0.82

            Alex Kulichkov added a comment - Hello, so does Jira v.9.12.2 and JSM v.5.12.2 have bundled Tomcat v.9.0.83 or above? We have request from CISO to remediate this since December.   In documentation it still says Tomcat v.9.0.82

            Ilkka Kiiskinen added a comment -

            Bitbucket, Crowd and Bamboo have related vulnerability issue as priority high and CVSS score 7.5/High.
            Refs:
            https://jira.atlassian.com/browse/BSERV-19097
            https://jira.atlassian.com/browse/CWD-6191
            https://jira.atlassian.com/browse/BAM-25606

            This issue is not listed in January 2024 Security Bulletin https://confluence.atlassian.com/security/security-bulletin-january-16-2024-1333335615.html
            where as the three others are.

            This issue does not have CVSS & CVE fields.
            Is the vulnerability in Jira less critical compared to other Atlassian products?

            Ilkka Kiiskinen added a comment - Bitbucket, Crowd and Bamboo have related vulnerability issue as priority high and CVSS score 7.5/High. Refs: https://jira.atlassian.com/browse/BSERV-19097 https://jira.atlassian.com/browse/CWD-6191 https://jira.atlassian.com/browse/BAM-25606 This issue is not listed in January 2024 Security Bulletin https://confluence.atlassian.com/security/security-bulletin-january-16-2024-1333335615.html where as the three others are. This issue does not have CVSS & CVE fields. Is the vulnerability in Jira less critical compared to other Atlassian products?

              abd1e7998ab2 Steve Watson
              c52cfc079f65 Allan O'Rourke
              Affected customers:
              2 This affects my team
              Watchers:
              19 Start watching this issue

                Created:
                Updated:
                Resolved: