-
Bug
-
Resolution: Fixed
-
Highest
-
4.19.0, 4.20.0, 4.19.1, 4.19.2, 4.20.1
-
None
-
19
-
Severity 2 - Major
-
723
-
-
Atlassian Update – 15 Dec 2021
Hi everyone,
A fix for this bug has been shipped for Jira Service Management Server in version 4.21.0 and 4.20.3.
Jira Administrator's are now able to either Uninstall or Disable the Insight - Asset Management Marketplace Application through Apps > Manage appsUninstalling your asset management app means that you won’t be able to use the app anymore. However, it does remove the assets field from your issues. Your linked assets will continue to be displayed.
You must be a Jira administrator to disable or uninstall your asset management app.
Note: After choosing to Uninstall Insight Asset Management, future upgrades will, by default, re-install the application under "Apps > Manage Apps". To prevent this you must Disable the Insight Asset Management marketplace app; not uninstall.
- This is because Insight Asset Management is still a required component of new and upgraded instances of Jira Service Management Server versions 4.16 and above.
We hope that you appreciate our candid and transparent communication. If you or your team continue to have any trouble with the issues outlined in this bug please do not hesitate to contact our support team.
Kind regards,
Alex
Jira Service Management, Server & Data Center
Uninstalling Insight Asset Management in 4.20 and above- After choosing to Uninstall Insight Asset Management, future upgrades will, by default, re-install the application under "Apps > Manage Apps". To prevent this you must Disable the Insight Asset Management marketplace app; not uninstall.
- This is because Insight Asset Management is still a required component of new and upgraded instances of Jira Service Management Server versions 4.16 and above.
Atlassian Update – 15 Dec 2021 Hi everyone, A fix for this bug has been shipped for Jira Service Management Server in version 4.21.0 and 4.20.3. Jira Administrator's are now able to either Uninstall or Disable the Insight - Asset Management Marketplace Application through Apps > Manage apps Uninstalling your asset management app means that you won’t be able to use the app anymore. However, it does remove the assets field from your issues. Your linked assets will continue to be displayed. You must be a Jira administrator to disable or uninstall your asset management app. Note: After choosing to Uninstall Insight Asset Management, future upgrades will, by default, re-install the application under "Apps > Manage Apps". To prevent this you must Disable the Insight Asset Management marketplace app; not uninstall. This is because Insight Asset Management is still a required component of new and upgraded instances of Jira Service Management Server versions 4.16 and above . We hope that you appreciate our candid and transparent communication. If you or your team continue to have any trouble with the issues outlined in this bug please do not hesitate to contact our support team. Kind regards, Alex Jira Service Management, Server & Data Center Uninstalling Insight Asset Management in 4.20 and above After choosing to Uninstall Insight Asset Management, future upgrades will, by default, re-install the application under "Apps > Manage Apps". To prevent this you must Disable the Insight Asset Management marketplace app; not uninstall. This is because Insight Asset Management is still a required component of new and upgraded instances of Jira Service Management Server versions 4.16 and above .
Issue Summary
- Customers on Jira Service Management Server instance, 4.19 and higher, have the Insight plugin listed under the "user Installed" under the "Manage Apps" and the options to "Disable" "Uninstall" are available. When disabling or uninstalling the plugin, it does disable the JSM modules and the Customer Portal goes missing. We need this to be highlighted in the release notes for the JSM 4.19 and higher as:
DO NOT PERFORM Insight "Disable" "Uninstall" ON JSM 4.19.x and 4.20.0, 4.20.1 and 4.20.2
Disabling Insight on these version will break and disable all JSM dependencies
On versions 4.20.3 and above you can disable/uninstall it.
- Details on How to install, uninstall, enable or disable Insight .
Workaround:
- If you disabled the Insight plugin and experiencing issues such as: JSM is missing, showing uninstalled, all the JSM plugins showing disabled and could not be enabled, try the following:
1. Stop Jira
2. Run the following SQL
delete from dbo.pluginstate;
- This will re-enable all plugins.
3. Delete the following hidden folders before trying to start Jira back up -
Navigate to $JIRA-HOME/plugins;
Find and completely delete the following folders (they are hidden by default):
.osgi-plugins
.bundled-plugins
This would clear out any corrupt plugin caches as well.
4. Start Jira
- If concerned about the JSM/Insight advisory CVE-2018-10054 , the main fix is to upgrade Jira to 4.20.0+, or as for mitigation, removing the H2 DB Jar file would be the best approach to avoid this vulnerability. Avoid disabling/installing the insight Plugin.
| Form Name | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
[JSDSERVER-10845] Disabling Insight on Jira Service Management Server 4.19+ will break and disable all JSM dependencies
Thanks for pointing that out 104614313d05. The description of this ticket has been updated with the outcome.
Regards,
Joshua
This is quite the nightmare for some instances, including ours, which has been quite stable for years.
Atlassian team, if disabling Insight causes so many negative side effects, can you at least disable the "Disable" button? And the same for "Uninstall"?
A second workaround if you upgrade to 8.20.x and have disabled Insight:
- Shutdown all Jira instances
- Enable all affected plugins in table pluginstate.
- Start all Jira instances
- And all corrupted / affected system plugins (JSM) are online
Our JSM installation is effectively broken at the moment.
The Insight app will not start and, because it has not started, we are now being bitten by https://confluence.atlassian.com/jirakb/jira-notifications-can-fail-if-insight-is-disabled-1064086720.html
This is a really serious issue for us - our agents are not getting any notifications so they are having to actively check queues, etc, which is a MASSIVE drain on their productivity.
In my opinion, Atlassian should at the very least issue licence keys for anyone on Server so that this plugin can be started.
Hi everyone,
I am deeply sorry to hear of the trouble experienced with this issue.
Due to dependencies introduced in Jira Service Management Data Center and Server 4.19, it is no longer possible to safely uninstall or disable Insight Asset Management, or remove related tables in the back-end of the product. Insight Asset Management is bundled with Jira Service Management (JSM) as a core part of the product. We continue to deepen the integration of Insight with JSM and do not have plans to provide the ability to disable the feature.
However we are aware of the confusion caused due to the problems outlined through your comments and above in the bug report; and we will endeavour to fix this and related problems in the product as soon as possible. We are also updating our documentation to make sure this change is communicated as clearly as possible.
We hope that you appreciate our candid and transparent communication. If you or your team continue to have any trouble with the issues outlined in this bug please do not hesitate to contact our support team.
Kind regards,
Alex
Jira Service Management, Server & Data Center
This happened to me as well after upgrading from 8.5 to 8.20. I disabled the Insight plugin and JSM went missing. Was showing that it was not installed, and all SDK plugins were disabled, and could not be enabled.
The only thing that fixed the issue was to delete all the disabled plugin keys from the pluginstate in the database, then restarting JIRA. Hopefully they come up with a fix soon as our security team does not want us to enable that, since we do not use it at all.
This caused a big mess during our latest upgrade, with the need to tinker directly with the SQL databases to fix it.
Very unnecessary.
At the very least, the CVE advisory should contain a big note saying 'do not disable/uninstall'. Zero code change, maximum effect.
PS: In case anyone else is reading this, the way to fix the broken JSM dependencies for us was to reset the plugin cache and enabled states:
- Stop Jira
- Connect to the Jira SQL database, then enter: delete from pluginstate;
- In JIRAHOME/plugins delete directories .osgi-plugins and .bundled-plugins
- Start Jira
This will then rebuild the dependencies/plugin caches on the first start (watch catalina.out to see the progress).
aba1389a0947 I reviewed the ticket description, but I think the comment you had here made things much clearer.
I'd love to see the following key point highlighted more prominently, for example with a warning macro: