High This High severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability was introduced in 5.4, 5.11, and 5.12 of Jira Service Management Data Center and Server.
Note: NVD Analysts have not published a CVSS score for this CVE at this time. NVD Analysts use publicly available information at the time of analysis to associate CVSS vector strings.
Atlassian recommends that Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
| Affected versions | Fixed versions |
|---|---|
| from 5.12.0 LTS to 5.12.5 LTS | 5.12.6 LTS recommended |
| from 5.11.0 to 5.11.3 | 5.12.6 LTS recommended |
| from 5.10.0 to 5.10.2 | 5.12.6 LTS recommended |
| from 5.9.0 to 5.9.2 | 5.12.6 LTS recommended |
| from 5.8.0 to 5.8.2 | 5.12.6 LTS recommended |
| from 5.7.0 to 5.7.2 | 5.12.6 LTS recommended |
| from 5.6.0 to 5.6.2 | 5.12.6 LTS recommended |
| from 5.5.0 to 5.5.1 | 5.12.6 LTS recommended |
| from 5.4.0 LTS to 5.4.18 LTS | 5.12.6 LTS recommended or 5.4.19 LTS |
| from 5.3.0 to 5.3.1 | 5.12.6 LTS recommended or 5.4.19 LTS |
| from 5.2.0 to 5.2.1 | 5.12.6 LTS recommended or 5.4.19 LTS |
| from 5.1.0 to 5.1.1 | 5.12.6 LTS recommended or 5.4.19 LTS |
| 5.0 | 5.12.6 LTS recommended or 5.4.19 LTS |
| from 4.22 to 4.22.6 | 5.12.6 LTS recommended or 5.4.19 LTS |
| Any earlier versions | 5.12.6 LTS recommended or 5.4.19 LTS |
See the release notes: https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html You can download the latest version of Jira Service Management Data Center and Server from the download center (https://www.atlassian.com/software/jira/service-management/download-archives).
The National Vulnerability Database provides the following description for this vulnerability: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
| Form Name | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
[JSDSERVER-15248] Denial of Service (DoS) com.nimbusds:nimbus-jose-jwt dependency in Jira Service Management Data Center and Server
| Description |
Original:
This High severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability was introduced in 5.4, 5.11, and 5.12 of Jira Service Management Data Center and Server.
Note: NVD Analysts have not published a CVSS score for this CVE at this time. NVD Analysts use publicly available information at the time of analysis to associate CVSS vector strings. Atlassian recommends that Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||*Affected versions*||*Fixed versions*|| |from 5.12.0 LTS to 5.12.5 LTS|5.12.6 LTS recommended| |from 5.11.0 to 5.11.3|5.12.6 LTS recommended| |from 5.10.0 to 5.10.2|5.12.6 LTS recommended| |from 5.9.0 to 5.9.2|5.12.6 LTS recommended| |from 5.8.0 to 5.8.2|5.12.6 LTS recommended| |from 5.7.0 to 5.7.2|5.12.6 LTS recommended| |from 5.6.0 to 5.6.2|5.12.6 LTS recommended| |from 5.5.0 to 5.5.1|5.12.6 LTS recommended| |from 5.4.0 LTS to 5.4.18 LTS|5.12.6 LTS recommended or 5.4.19 LTS| |from 5.3.0 to 5.3.1|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.2.0 to 5.2.1|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.1.0 to 5.1.1|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |5.0|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 4.22 to 4.22.6|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |Any earlier versions|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| See the release notes: [https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html] You can download the latest version of Jira Service Management Data Center and Server from the download center ([https://www.atlassian.com/software/jira/service-management/download-archives]). The National Vulnerability Database provides the following description for this vulnerability: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component. |
New:
This High severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability was introduced in 5.4, 5.11, and 5.12 of Jira Service Management Data Center and Server.
Note: NVD Analysts have not published a CVSS score for this CVE at this time. NVD Analysts use publicly available information at the time of analysis to associate CVSS vector strings. Atlassian recommends that Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||*Affected versions*||*Fixed versions*|| |from 5.12.0 LTS to 5.12.5 LTS|5.12.6 LTS recommended| |from 5.11.0 to 5.11.3|5.12.6 LTS recommended| |from 5.10.0 to 5.10.2|5.12.6 LTS recommended| |from 5.9.0 to 5.9.2|5.12.6 LTS recommended| |from 5.8.0 to 5.8.2|5.12.6 LTS recommended| |from 5.7.0 to 5.7.2|5.12.6 LTS recommended| |from 5.6.0 to 5.6.2|5.12.6 LTS recommended| |from 5.5.0 to 5.5.1|5.12.6 LTS recommended| |from 5.4.0 LTS to 5.4.18 LTS|5.12.6 LTS recommended or 5.4.19 LTS| |from 5.3.0 to 5.3.1|5.12.6 LTS recommended or 5.4.19 LTS| |from 5.2.0 to 5.2.1|5.12.6 LTS recommended or 5.4.19 LTS| |from 5.1.0 to 5.1.1|5.12.6 LTS recommended or 5.4.19 LTS| |5.0|5.12.6 LTS recommended or 5.4.19 LTS| |from 4.22 to 4.22.6|5.12.6 LTS recommended or 5.4.19 LTS| |Any earlier versions|5.12.6 LTS recommended or 5.4.19 LTS| See the release notes: [https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html] You can download the latest version of Jira Service Management Data Center and Server from the download center ([https://www.atlassian.com/software/jira/service-management/download-archives]). The National Vulnerability Database provides the following description for this vulnerability: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component. |
| Description |
Original:
This High severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability was introduced in 5.4, 5.11, and 5.12 of Jira Service Management Data Center and Server.
Note: NVD Analysts have not published a CVSS score for this CVE at this time. NVD Analysts use publicly available information at the time of analysis to associate CVSS vector strings. Atlassian recommends that Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||*Affected versions*||*Fixed versions*|| |from 5.12.0 LTS to 5.12.5 LTS|5.12.6 LTS recommended| |from 5.11.0 to 5.11.3|5.12.6 LTS recommended| |from 5.10.0 to 5.10.2|5.12.6 LTS recommended| |from 5.9.0 to 5.9.2|5.12.6 LTS recommended| |from 5.8.0 to 5.8.2|5.12.6 LTS recommended| |from 5.7.0 to 5.7.2|5.12.6 LTS recommended| |from 5.6.0 to 5.6.2|5.12.6 LTS recommended| |from 5.5.0 to 5.5.1|5.12.6 LTS recommended| |from 5.4.0 LTS to 5.4.16 LTS|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.3.0 to 5.3.1|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.2.0 to 5.2.1|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.1.0 to 5.1.1|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |5.0|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 4.22 to 4.22.6|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |Any earlier versions|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| See the release notes: [https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html] You can download the latest version of Jira Service Management Data Center and Server from the download center ([https://www.atlassian.com/software/jira/service-management/download-archives]). The National Vulnerability Database provides the following description for this vulnerability: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component. |
New:
This High severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability was introduced in 5.4, 5.11, and 5.12 of Jira Service Management Data Center and Server.
Note: NVD Analysts have not published a CVSS score for this CVE at this time. NVD Analysts use publicly available information at the time of analysis to associate CVSS vector strings. Atlassian recommends that Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||*Affected versions*||*Fixed versions*|| |from 5.12.0 LTS to 5.12.5 LTS|5.12.6 LTS recommended| |from 5.11.0 to 5.11.3|5.12.6 LTS recommended| |from 5.10.0 to 5.10.2|5.12.6 LTS recommended| |from 5.9.0 to 5.9.2|5.12.6 LTS recommended| |from 5.8.0 to 5.8.2|5.12.6 LTS recommended| |from 5.7.0 to 5.7.2|5.12.6 LTS recommended| |from 5.6.0 to 5.6.2|5.12.6 LTS recommended| |from 5.5.0 to 5.5.1|5.12.6 LTS recommended| |from 5.4.0 LTS to 5.4.18 LTS|5.12.6 LTS recommended or 5.4.19 LTS| |from 5.3.0 to 5.3.1|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.2.0 to 5.2.1|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.1.0 to 5.1.1|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |5.0|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 4.22 to 4.22.6|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |Any earlier versions|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| See the release notes: [https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html] You can download the latest version of Jira Service Management Data Center and Server from the download center ([https://www.atlassian.com/software/jira/service-management/download-archives]). The National Vulnerability Database provides the following description for this vulnerability: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component. |
| Fix Version/s | Original: 5.4.17 [ 106910 ] |
| Resolution | New: Fixed [ 1 ] | |
| Security | Original: Reporter and Atlassian Staff [ 10751 ] | |
| Status | Original: Draft [ 12872 ] | New: Published [ 12873 ] |
| Description |
Original:
This High severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability was introduced in 5.4, 5.11, and 5.12 of Jira Service Management Data Center and Server.
Note: NVD Analysts have not published a CVSS score for this CVE at this time. NVD Analysts use publicly available information at the time of analysis to associate CVSS vector strings. Atlassian recommends that Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||*Affected versions*||*Fixed versions*|| |from 5.12.0 LTS to 5.12.5 LTS|5.14.0 or 5.12.6 LTS recommended| |from 5.11.0 to 5.11.3|5.14.0 or 5.12.6 LTS recommended| |from 5.10.0 to 5.10.2|5.14.0 or 5.12.6 LTS recommended| |from 5.9.0 to 5.9.2|5.14.0 or 5.12.6 LTS recommended| |from 5.8.0 to 5.8.2|5.14.0 or 5.12.6 LTS recommended| |from 5.7.0 to 5.7.2|5.14.0 or 5.12.6 LTS recommended| |from 5.6.0 to 5.6.2|5.14.0 or 5.12.6 LTS recommended| |from 5.5.0 to 5.5.1|5.14.0 or 5.12.6 LTS recommended| |from 5.4.0 LTS to 5.4.16 LTS|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.3.0 to 5.3.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.2.0 to 5.2.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.1.0 to 5.1.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |5.0|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 4.22 to 4.22.6|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |Any earlier versions|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| See the release notes: [https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html] You can download the latest version of Jira Service Management Data Center and Server from the download center ([https://www.atlassian.com/software/jira/service-management/download-archives]). The National Vulnerability Database provides the following description for this vulnerability: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component. |
New:
This High severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability was introduced in 5.4, 5.11, and 5.12 of Jira Service Management Data Center and Server.
Note: NVD Analysts have not published a CVSS score for this CVE at this time. NVD Analysts use publicly available information at the time of analysis to associate CVSS vector strings. Atlassian recommends that Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||*Affected versions*||*Fixed versions*|| |from 5.12.0 LTS to 5.12.5 LTS|5.12.6 LTS recommended| |from 5.11.0 to 5.11.3|5.12.6 LTS recommended| |from 5.10.0 to 5.10.2|5.12.6 LTS recommended| |from 5.9.0 to 5.9.2|5.12.6 LTS recommended| |from 5.8.0 to 5.8.2|5.12.6 LTS recommended| |from 5.7.0 to 5.7.2|5.12.6 LTS recommended| |from 5.6.0 to 5.6.2|5.12.6 LTS recommended| |from 5.5.0 to 5.5.1|5.12.6 LTS recommended| |from 5.4.0 LTS to 5.4.16 LTS|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.3.0 to 5.3.1|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.2.0 to 5.2.1|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.1.0 to 5.1.1|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |5.0|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 4.22 to 4.22.6|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |Any earlier versions|5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| See the release notes: [https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html] You can download the latest version of Jira Service Management Data Center and Server from the download center ([https://www.atlassian.com/software/jira/service-management/download-archives]). The National Vulnerability Database provides the following description for this vulnerability: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component. |
| CVSSv3 Vector | New: N/A | |
| Vulnerability Source | New: Atlassian (Internal) [ 18430 ] |
| Priority | Original: Low [ 4 ] | New: High [ 2 ] |
| Description |
Original:
This High severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability was introduced in versions of Jira Service Management Data Center and Server.
This severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of [ ... ] allows an unauthenticated attacker to expose assets in your environment susceptible to exploitation which has [...] Atlassian recommends that Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||*Affected versions*||*Fixed versions*|| |from 5.12.0 LTS to 5.12.5 LTS|5.14.0 or 5.12.6 LTS recommended| |from 5.11.0 to 5.11.3|5.14.0 or 5.12.6 LTS recommended| |from 5.10.0 to 5.10.2|5.14.0 or 5.12.6 LTS recommended| |from 5.9.0 to 5.9.2|5.14.0 or 5.12.6 LTS recommended| |from 5.8.0 to 5.8.2|5.14.0 or 5.12.6 LTS recommended| |from 5.7.0 to 5.7.2|5.14.0 or 5.12.6 LTS recommended| |from 5.6.0 to 5.6.2|5.14.0 or 5.12.6 LTS recommended| |from 5.5.0 to 5.5.1|5.14.0 or 5.12.6 LTS recommended| |from 5.4.0 LTS to 5.4.16 LTS|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.3.0 to 5.3.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.2.0 to 5.2.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.1.0 to 5.1.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |5.0|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 4.22 to 4.22.6|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |Any earlier versions|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| See the release notes (). You can download the latest version of Jira Service Management Data Center and Server from the download center ([https://www.atlassian.com/software/jira/service-management/download-archives]). The National Vulnerability Database provides the following description for this vulnerability: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component. |
New:
This High severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability was introduced in 5.4, 5.11, and 5.12 of Jira Service Management Data Center and Server.
Note: NVD Analysts have not published a CVSS score for this CVE at this time. NVD Analysts use publicly available information at the time of analysis to associate CVSS vector strings. Atlassian recommends that Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||*Affected versions*||*Fixed versions*|| |from 5.12.0 LTS to 5.12.5 LTS|5.14.0 or 5.12.6 LTS recommended| |from 5.11.0 to 5.11.3|5.14.0 or 5.12.6 LTS recommended| |from 5.10.0 to 5.10.2|5.14.0 or 5.12.6 LTS recommended| |from 5.9.0 to 5.9.2|5.14.0 or 5.12.6 LTS recommended| |from 5.8.0 to 5.8.2|5.14.0 or 5.12.6 LTS recommended| |from 5.7.0 to 5.7.2|5.14.0 or 5.12.6 LTS recommended| |from 5.6.0 to 5.6.2|5.14.0 or 5.12.6 LTS recommended| |from 5.5.0 to 5.5.1|5.14.0 or 5.12.6 LTS recommended| |from 5.4.0 LTS to 5.4.16 LTS|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.3.0 to 5.3.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.2.0 to 5.2.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.1.0 to 5.1.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |5.0|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 4.22 to 4.22.6|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |Any earlier versions|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| See the release notes: [https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html] You can download the latest version of Jira Service Management Data Center and Server from the download center ([https://www.atlassian.com/software/jira/service-management/download-archives]). The National Vulnerability Database provides the following description for this vulnerability: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component. |
| Description |
Original:
This High severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability was introduced in versions of Jira Service Management Data Center and Server.
This severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of [ ... ] allows an unauthenticated attacker to expose assets in your environment susceptible to exploitation which has [...] Atlassian recommends that Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||*Affected versions*||*Fixed versions*|| |from 5.12.0 LTS to 5.12.5 LTS|5.14.0 or 5.12.6 LTS recommended| |from 5.11.0 to 5.11.3|5.14.0 or 5.12.6 LTS recommended| |from 5.10.0 to 5.10.2|5.14.0 or 5.12.6 LTS recommended| |from 5.9.0 to 5.9.2|5.14.0 or 5.12.6 LTS recommended| |from 5.8.0 to 5.8.2|5.14.0 or 5.12.6 LTS recommended| |from 5.7.0 to 5.7.2|5.14.0 or 5.12.6 LTS recommended| |from 5.6.0 to 5.6.2|5.14.0 or 5.12.6 LTS recommended| |from 5.5.0 to 5.5.1|5.14.0 or 5.12.6 LTS recommended| |from 5.4.0 LTS to 5.4.16 LTS|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.3.0 to 5.3.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.2.0 to 5.2.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.1.0 to 5.1.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |5.0|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 4.22 to 4.22.6|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |Any earlier versions|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| See the release notes (). You can download the latest version of Jira Service Management Data Center and Server from the download center ([https://www.atlassian.com/software/jira/service-management/download-archives]). The National Vulnerability Database provides the following description for this vulnerability: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component. |
New:
This High severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability was introduced in versions of Jira Service Management Data Center and Server.
This severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of [ ... ] allows an unauthenticated attacker to expose assets in your environment susceptible to exploitation which has [...] Atlassian recommends that Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||*Affected versions*||*Fixed versions*|| |from 5.12.0 LTS to 5.12.5 LTS|5.14.0 or 5.12.6 LTS recommended| |from 5.11.0 to 5.11.3|5.14.0 or 5.12.6 LTS recommended| |from 5.10.0 to 5.10.2|5.14.0 or 5.12.6 LTS recommended| |from 5.9.0 to 5.9.2|5.14.0 or 5.12.6 LTS recommended| |from 5.8.0 to 5.8.2|5.14.0 or 5.12.6 LTS recommended| |from 5.7.0 to 5.7.2|5.14.0 or 5.12.6 LTS recommended| |from 5.6.0 to 5.6.2|5.14.0 or 5.12.6 LTS recommended| |from 5.5.0 to 5.5.1|5.14.0 or 5.12.6 LTS recommended| |from 5.4.0 LTS to 5.4.16 LTS|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.3.0 to 5.3.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.2.0 to 5.2.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 5.1.0 to 5.1.1|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |5.0|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |from 4.22 to 4.22.6|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| |Any earlier versions|5.14.0 or 5.12.6 LTS recommended or 5.4.17 to 5.4.19 LTS| See the release notes (). You can download the latest version of Jira Service Management Data Center and Server from the download center ([https://www.atlassian.com/software/jira/service-management/download-archives]). The National Vulnerability Database provides the following description for this vulnerability: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component. |
| Affects Version/s | New: 5.11.0 [ 105890 ] |