Uploaded image for project: 'Jira Software Data Center'
  1. Jira Software Data Center
  2. JSWSERVER-20471

Security Vulnerability Tomcat AJP CNVD-2020-10487/CVE-2020-1938

XMLWordPrintable

    • 1
    • We collect Jira feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

      I would like to check whether Jira is affected by the recent security vulnerability issues TOMCAT AJP CNVD-2020-10487/CVE-2020-1938.

      If yes, please suggest the Jira version to be upgraded.

       

      thanks. 

            [JSWSERVER-20471] Security Vulnerability Tomcat AJP CNVD-2020-10487/CVE-2020-1938

            Colin Xu added a comment - - edited

            Hi f25acc213138 / i.murphy439501242,

            Please see https://confluence.atlassian.com/adminjiraserver/configuring-apache-reverse-proxy-using-the-ajp-protocol-938847753.html

            In summary, our products do not use AJP connectors by default - if you have not configured your instance to use the AJP connector, it is not vulnerable to the Ghostcat CVE.

            Linked is a guide for customers who wish to use AJP anyway, but see the notes at the top of the page:

            We recommend that you wait until Jira is bundled with the Tomcat version that fixes this issue, we’ll update this note once it’s released. For more info about this vulnerability, see:

            CVE-2020-1938: Ghostcat - Apache Tomcat AJP File Read/Inclusion Vulnerability

            Until then, if you need to use the AJP Connector, there are steps you can take to mitigate this issue. For more info, see this article.

            and

            Atlassian applications allow the use of reverse-proxies within our products, however Atlassian Support does not provide assistance for configuring them. Consequently, Atlassian can not guarantee providing any support for them.

            If assistance with configuration is required, please raise a question on Atlassian Answers

            Colin Xu added a comment - - edited Hi f25acc213138 / i.murphy439501242 , Please see https://confluence.atlassian.com/adminjiraserver/configuring-apache-reverse-proxy-using-the-ajp-protocol-938847753.html In summary, our products do not use AJP connectors by default - if you have not configured your instance to use the AJP connector, it is not vulnerable to the Ghostcat CVE. Linked is a guide for customers who wish to use AJP anyway, but see the notes at the top of the page: We recommend that you wait until Jira is bundled with the Tomcat version that fixes this issue, we’ll update this note once it’s released. For more info about this vulnerability, see: CVE-2020-1938: Ghostcat - Apache Tomcat AJP File Read/Inclusion Vulnerability Until then, if you need to use the AJP Connector, there are steps you can take to mitigate this issue. For more info, see this article . and Atlassian applications allow the use of reverse-proxies within our products, however Atlassian Support does not provide assistance for configuring them. Consequently, Atlassian can not guarantee providing any support for them. If assistance with configuration is required, please raise a question on Atlassian Answers

            Sharada Moorthy (Inactive) added a comment -

            CVSS v3 score: 7.5 => High severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity Low
            Privileges Required None
            User Interaction None
            Scope Metric

            Scope Unchanged
            Impact Metrics

            Confidentiality None
            Integrity None
            Availability High
            See http://go.atlassian.com/cvss for more details.

            https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

            Sharada Moorthy (Inactive) added a comment - CVSS v3 score: 7.5 => High severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required None User Interaction None Scope Metric Scope Unchanged Impact Metrics Confidentiality None Integrity None Availability High See http://go.atlassian.com/cvss for more details. https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

            Iain Murphy added a comment -

            This is very important for us, if there are no plans to fix this are there any instructions on upgrading Tomcat separate from Jira?

            Iain Murphy added a comment - This is very important for us, if there are no plans to fix this are there any instructions on upgrading Tomcat separate from Jira?

              cxu Colin Xu
              f25acc213138 win
              Votes:
              5 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: