Dear Atlassian team,

Please could you clarify the sentence: "This High severity Third-Party Dependency vulnerability was introduced in versions 8.20.0,.."

For me it is not clear if the vulnerability was in introduced in version 8.20.0 and remain in all later  8.20.x versions

or

if the vulnerability was only affects to version 8.20.0.

Is the only fix available other than 9.11.3? Is not any planned fixing for 8.20.X?

As a suggestion try to avoid the words " vulnerability was introduced" and use explicitly " vulnerability affected to". This will avoid misunderstandings.

Looking forward to your feedback,

Thanks in advance,

Cheers,

Roberto Correa

what is about 9.4.xx this is a LT Version! when did  we get a Fix for it? No aswer about Rainers question is not a good support.

Hi Atlassian,

could you confirm the information of eb53ad17838b?

Q4 is almost over. When should the release take place? It's always difficult to plan upgrades at the end of the year. Therefore we need more precise release information than "Q4/2023".

Since 9.4.x is still in LTS (until 15 Nov 2023), when can we expect a fix for 9.4.x?

In general, I have to say that I cant understand your information policy on that. The Secrutiy Bulletin is basically a good idea. But to publicly announce information about dozens of security vulnerabilities with a high score and only offer a fix in the latest feature release is a poor performance, without information to LTS.

It would be nice if Atlassian could reply to the comments here.

Regards

Edgar König

For LTS i got this announcment from the support
"Currently, the vulnerabilities are fixed in the latest (non-LTS) Jira version, which is 9.11.3. Our development team is working on the next LTS version of Jira that is 9.12.0 and will contain the fixes. At this moment, it's targeted to be released in Q4 (calendar year) and we have made an announcement about it here"
Announcing Jira 9.12 & JSM 5.12 LTS (atlassian.com)

Dear Atlassian,

Please inform us which LTS Version you plan to provide a fix for lower than current Fix Version 9.11.3 (=no LTS Version).

Thank you & Best Regards

Dear Atlassian,

Please inform us if 9.4.10 is also affected. 
Thank you & Regards

Hi Atlassian-Team,

please clearify the fixed versions of this Vulnerability. You had this problems in the past, where you first mentioned the wrong fixed and affected versions and corrected them afterwards.

I dont think that Jira 9.11.3 is the only fixed version.

• this issue was created on 12/Nov/2023
• The "fixed" Jira version was released on 09/Nov/2023
• newest Jira LTS was released on 08/Nov/2023

On the other hand, if the LTS really is affected, you have 18 days left to fix this issue. So could we can expect an new LTS release in the next days?

Thanks and best regards

Edgar König

Dear Atlassian-Team,

could you please be slightly more specific regarding the fact which sub-versions are affected?
How should "9.4.0" be interpreted? Does this mean all 9.4.x versions are affected or just 9.4.0? And will there be a fix also backported to the current LTS version 9.4. (you are just mentioning 9.11.3 as fixed version)?

With the introduction of your monthly security bulleting you're aiming at a more clearly structured overview of security issues. But to be honest, it's slightly the opposite and at least partially more confusing ...

Thanks & best regards,
-Rainer

Dear Atlassian Team,

Please inform us urgently whether only JIRA 8.20.0 is actually affected or all 8.20.x versions

Regards