Uploaded image for project: 'Jira Software Data Center'
  1. Jira Software Data Center
  2. JSWSERVER-20471

Security Vulnerability Tomcat AJP CNVD-2020-10487/CVE-2020-1938

XMLWordPrintable

    • 1
    • We collect Jira feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

      I would like to check whether Jira is affected by the recent security vulnerability issues TOMCAT AJP CNVD-2020-10487/CVE-2020-1938.

      If yes, please suggest the Jira version to be upgraded.

       

      thanks. 

            [JSWSERVER-20471] Security Vulnerability Tomcat AJP CNVD-2020-10487/CVE-2020-1938

            Colin Xu made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 547941 ]
            Colin Xu made changes -
            Resolution New: Answered [ 9 ]
            Status Original: Gathering Interest [ 11772 ] New: Closed [ 6 ]
            Colin Xu made changes -
            Assignee New: Colin Xu [ cxu ]
            Daniel Rauf made changes -
            Remote Link New: This issue links to "RAID-1987 (JIRA Server (Bulldog))" [ 488967 ]
            Daniel Rauf made changes -
            Link New: This issue relates to JRASERVER-70993 [ JRASERVER-70993 ]
            Daniel Rauf made changes -
            Link New: This issue relates to JRASERVER-71092 [ JRASERVER-71092 ]
            Security Metrics Bot made changes -
            Labels Original: patch-management security New: cvss-high patch-management security

            Colin Xu added a comment - - edited

            Hi f25acc213138 / i.murphy439501242,

            Please see https://confluence.atlassian.com/adminjiraserver/configuring-apache-reverse-proxy-using-the-ajp-protocol-938847753.html

            In summary, our products do not use AJP connectors by default - if you have not configured your instance to use the AJP connector, it is not vulnerable to the Ghostcat CVE.

            Linked is a guide for customers who wish to use AJP anyway, but see the notes at the top of the page:

            We recommend that you wait until Jira is bundled with the Tomcat version that fixes this issue, we’ll update this note once it’s released. For more info about this vulnerability, see:

            CVE-2020-1938: Ghostcat - Apache Tomcat AJP File Read/Inclusion Vulnerability

            Until then, if you need to use the AJP Connector, there are steps you can take to mitigate this issue. For more info, see this article.

            and

            Atlassian applications allow the use of reverse-proxies within our products, however Atlassian Support does not provide assistance for configuring them. Consequently, Atlassian can not guarantee providing any support for them.

            If assistance with configuration is required, please raise a question on Atlassian Answers

            Colin Xu added a comment - - edited Hi f25acc213138 / i.murphy439501242 , Please see https://confluence.atlassian.com/adminjiraserver/configuring-apache-reverse-proxy-using-the-ajp-protocol-938847753.html In summary, our products do not use AJP connectors by default - if you have not configured your instance to use the AJP connector, it is not vulnerable to the Ghostcat CVE. Linked is a guide for customers who wish to use AJP anyway, but see the notes at the top of the page: We recommend that you wait until Jira is bundled with the Tomcat version that fixes this issue, we’ll update this note once it’s released. For more info about this vulnerability, see: CVE-2020-1938: Ghostcat - Apache Tomcat AJP File Read/Inclusion Vulnerability Until then, if you need to use the AJP Connector, there are steps you can take to mitigate this issue. For more info, see this article . and Atlassian applications allow the use of reverse-proxies within our products, however Atlassian Support does not provide assistance for configuring them. Consequently, Atlassian can not guarantee providing any support for them. If assistance with configuration is required, please raise a question on Atlassian Answers
            David Black made changes -
            Labels Original: no-cvss-required patch-management security New: patch-management security
            Colin Xu made changes -
            Labels Original: cvss-high patch-management security New: no-cvss-required patch-management security

              cxu Colin Xu
              f25acc213138 win
              Votes:
              5 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: