bitvoodoo Advisories
Space shortcuts
Space Tools
bitvoodoo Advisories BVADVIS

Versions Compared

Old Version 10

changes.mady.by.user Daniele Talerico

Saved on

compared with

New Version 11

changes.mady.by.user Daniele Talerico

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


Warning

This is a public space:

For the draft, please restrict the page during creation and
remove this warning when page is published



English

Contents


German

Inhalte



French

Contenu


Table of Contents



Page properties


Date

 

Product
  • Jira Service Management Data Center
  • Jira Service Management Server
Vulnerability

high (8.4)

CVECVE-2019-13990
Official linkhttps://confluence.atlassian.com/security/cve-2019-13990-xxe-xml-external-entity-injection-vulnerability-in-jira-service-management-data-center-and-jira-service-management-server-1295385959.html




English

Dear customer,

On Oct 17 2023 10:00 PDT, Atlassian issued a Security Advisory for Jira Service Management Server and Data Center.
The Cloud versions of the applications as well as other Atlassian products are not affected.

What you need to know

The affected versions contain vulnerable versions of Terracotta Quartz Scheduler which allow authenticated attackers to initiate an XML External Entity injection attack using job descriptions.

Atlassian has committed to issuing critical advisories based on the NVD vulnerability score, in this case the CVSS for this third party CVE is critical (9.8), but this score doesn’t always account for the context in which a vulnerable component is used in our software. Unauthenticated attackers without local access to the system are unable to exploit this vulnerability. As such, our internal assessment of this vulnerability is scored as high severity.

Info

Atlassian is not calling for immediate action to be taken from the bulletin.

Atlassian rates the severity level of this vulnerability as high


Affected Versions

Info

Jira Service Management Data Center and Server

  • 4.20.0
  • 4.20.1
  • 4.20.10
  • 4.20.11
  • 4.20.12
  • 4.20.13
  • 4.20.14
  • 4.20.15
  • 4.20.16
  • 4.20.17
  • 4.20.18
  • 4.20.19
  • 4.20.2
  • 4.20.20
  • 4.20.21
  • 4.20.22
  • 4.20.23
  • 4.20.24
  • 4.20.25
  • 4.20.3
  • 4.20.4
  • 4.20.5
  • 4.20.6
  • 4.20.7
  • 4.20.8
  • 4.20.9
  • 4.21.0
  • 4.21.1
  • 4.22.0
  • 4.22.1
  • 4.22.2
  • 4.22.3
  • 4.22.4
  • 4.22.6
  • 5.0.0
  • 5.1.0
  • 5.1.1
  • 5.2.0
  • 5.2.1
  • 5.3.0
  • 5.3.1
  • 5.3.2
  • 5.3.3
  • 5.4.0
  • 5.4.1
  • 5.4.2
  • 5.4.3
  • 5.4.4
  • 5.4.5
  • 5.4.6
  • 5.4.7
  • 5.4.8
  • 5.4.9
  • 5.5.1
  • 5.6.0
  • 5.7.0
  • 5.7.1
  • 5.8.0
  • 5.8.1
  • 5.9.0
  • 5.10.0


What should I do?

Localtab Group


Localtab
activetrue
titleConfluence Server & Data Center
tabIconbvicon-server

You use Jira Service Management Data Center and Server

Info

Atlassian is not calling for immediate action to be taken from the bulletin.

Their internal assessment Atlassian rates the severity level of this vulnerability is scored as high severity.


Update

Atlassian addresses this issue with following versions:

  • 4.20.26 or later
  • 5.10.1 or later
  • 5.4.10 or later
  • 5.7.2 or later
  • 5.8.2 or later
  • 5.9.2 or later

Mitigation

If you are unable to upgrade to a fixed version immediately, you can temporarily remediate this vulnerability by disabling Assets on your Jira Service Management instance by following these instructions. This has the consequence of disabling Assets functionality.


Localtab
titleAtlassian Confluence Cloud
tabIconbvicon-cloud

You use Jira Service Management Cloud

Tip

You are not affected by this Security Advisory. No need for action.



Localtab
titlebitvoodoo Cloud
tabIconbvicon-cloud

You use Jira Service Management on servers operated by bitvoodoo

Info

Atlassian is not calling for immediate action to be taken from the bulletin.

Their internal assessment Atlassian rates the severity level of this vulnerability is scored as high severity.

Mitigation

If you are unable to upgrade to a fixed version immediately, you can temporarily remediate this vulnerability by disabling Assets on your Jira Service Management instance.
Customers will get contacted to discuss the implementation of this mitigation.




Support

If you still have questions or concerns regarding this advisory, please contact the bitvoodoo support via support.bitvoodoo.ch.


German

Dear customer,

On Oct 17 2023 10:00 PDT, Atlassian issued a Security Advisory for Jira Service Management Server and Data Center.
The Cloud versions of the applications as well as other Atlassian products are not affected.

What you need to know

The affected versions contain vulnerable versions of Terracotta Quartz Scheduler which allow authenticated attackers to initiate an XML External Entity injection attack using job descriptions.

Atlassian has committed to issuing critical advisories based on the NVD vulnerability score, in this case the CVSS for this third party CVE is critical (9.8), but this score doesn’t always account for the context in which a vulnerable component is used in our software. Unauthenticated attackers without local access to the system are unable to exploit this vulnerability. As such, our internal assessment of this vulnerability is scored as high severity.

Info

Atlassian is not calling for immediate action to be taken from the bulletin.

Atlassian rates the severity level of this vulnerability as high

Affected Versions

Info

Jira Service Management Data Center and Server

  • 4.20.0
  • 4.20.1
  • 4.20.10
  • 4.20.11
  • 4.20.12
  • 4.20.13
  • 4.20.14
  • 4.20.15
  • 4.20.16
  • 4.20.17
  • 4.20.18
  • 4.20.19
  • 4.20.2
  • 4.20.20
  • 4.20.21
  • 4.20.22
  • 4.20.23
  • 4.20.24
  • 4.20.25
  • 4.20.3
  • 4.20.4
  • 4.20.5
  • 4.20.6
  • 4.20.7
  • 4.20.8
  • 4.20.9
  • 4.21.0
  • 4.21.1
  • 4.22.0
  • 4.22.1
  • 4.22.2
  • 4.22.3
  • 4.22.4
  • 4.22.6
  • 5.0.0
  • 5.1.0
  • 5.1.1
  • 5.2.0
  • 5.2.1
  • 5.3.0
  • 5.3.1
  • 5.3.2
  • 5.3.3
  • 5.4.0
  • 5.4.1
  • 5.4.2
  • 5.4.3
  • 5.4.4
  • 5.4.5
  • 5.4.6
  • 5.4.7
  • 5.4.8
  • 5.4.9
  • 5.5.1
  • 5.6.0
  • 5.7.0
  • 5.7.1
  • 5.8.0
  • 5.8.1
  • 5.9.0
  • 5.10.0


What should I do?

Localtab Group


Localtab
activetrue
titleConfluence Server & Data Center
tabIconbvicon-server

You use Jira Service Management Data Center and Server

Info

Atlassian is not calling for immediate action to be taken from the bulletin.

Their internal assessment Atlassian rates the severity level of this vulnerability is scored as high severity.

Update

To address this issue, Atlassian released the following versions:

  • 4.20.26 or later
  • 5.10.1 or later
  • 5.4.10 or later
  • 5.7.2 or later
  • 5.8.2 or later
  • 5.9.2 or later

Mitigation

If you are unable to upgrade to a fixed version immediately, you can temporarily remediate this vulnerability by disabling Assets on your Jira Service Management instance by following these instructions. This has the consequence of disabling Assets functionality.


Localtab
titleAtlassian Confluence Cloud
tabIconbvicon-cloud

You use Jira Service Management Cloud

Tip

You are not affected by this Security Advisory. No need for action.



Localtab
titlebitvoodoo Cloud
tabIconbvicon-cloud

You use Jira Service Management on servers operated by bitvoodoo

Info

Atlassian is not calling for immediate action to be taken from the bulletin.

Their internal assessment Atlassian rates the severity level of this vulnerability is scored as high severity.

Mitigation

If you are unable to upgrade to a fixed version immediately, you can temporarily remediate this vulnerability by disabling Assets on your Jira Service Management instance.
Customers will get contacted to discuss the implementation of this mitigation.





Support

If you still have questions or concerns regarding this advisory, please contact the bitvoodoo support via support.bitvoodoo.ch.


French

Chère cliente, cher client,

Le 17 octobre 2023 à 19h, Atlassian a publié un avis de sécurité pour Jira Service Management Serveur & Data Center.

Les versions Cloud des applications ainsi que les autres produits Atlassian ne sont pas concernés.

Ce qu'il faut savoir

Les versions concernées contiennent des versions vulnérables de Terracotta Quartz Scheduler qui permettent à des attaquants authentifiés d'initier une attaque par injection d'entité externe XML en utilisant des descriptions de tâches.

Atlassian s'est engagé à émettre des avis critiques basés sur le score de vulnérabilité NVD, dans ce cas le CVSS pour ce CVE tiers est critique (9.8), mais ce score ne prend pas toujours en compte le contexte dans lequel un composant vulnérable est utilisé dans notre logiciel. Les attaquants non authentifiés qui n'ont pas d'accès local au système sont incapables d'exploiter cette vulnérabilité. Par conséquent, notre évaluation interne de cette vulnérabilité est classée comme étant de haute sévérité.

Info

Atlassian is not calling for immediate action to be taken from the bulletin.

Atlassian rates the severity level of this vulnerability as high

Versions affectées

Info

Jira Service Management Data Center et Serveur:

  • 4.20.0
  • 4.20.1
  • 4.20.10
  • 4.20.11
  • 4.20.12
  • 4.20.13
  • 4.20.14
  • 4.20.15
  • 4.20.16
  • 4.20.17
  • 4.20.18
  • 4.20.19
  • 4.20.2
  • 4.20.20
  • 4.20.21
  • 4.20.22
  • 4.20.23
  • 4.20.24
  • 4.20.25
  • 4.20.3
  • 4.20.4
  • 4.20.5
  • 4.20.6
  • 4.20.7
  • 4.20.8
  • 4.20.9
  • 4.21.0
  • 4.21.1
  • 4.22.0
  • 4.22.1
  • 4.22.2
  • 4.22.3
  • 4.22.4
  • 4.22.6
  • 5.0.0
  • 5.1.0
  • 5.1.1
  • 5.2.0
  • 5.2.1
  • 5.3.0
  • 5.3.1
  • 5.3.2
  • 5.3.3
  • 5.4.0
  • 5.4.1
  • 5.4.2
  • 5.4.3
  • 5.4.4
  • 5.4.5
  • 5.4.6
  • 5.4.7
  • 5.4.8
  • 5.4.9
  • 5.5.1
  • 5.6.0
  • 5.7.0
  • 5.7.1
  • 5.8.0
  • 5.8.1
  • 5.9.0
  • 5.10.0


Que dois-je faire ?

Localtab Group


Localtab
activetrue
titleConfluence Server & Data Center
tabIconbvicon-server

Vous utilisez Jira Service Management Data Center ou Serveur:

Info

Atlassian is not calling for immediate action to be taken from the bulletin.

Their internal assessment Atlassian rates the severity level of this vulnerability is scored as high severity.

Update

Pour remédier à ce problème, Atlassian a mis en place :

Les versions Jira Service Management Data Center er Serveur:

  • 4.20.26 ou plus récente
  • 5.10.1 ou plus récente
  • 5.4.10 ou plus récente
  • 5.7.2 ou plus récente
  • 5.8.2 ou plus récente
  • 5.9.2 ou plus récente

Actions correctives: 

Si vous n'êtes pas en mesure de passer immédiatement à une version corrigée, vous pouvez remédier temporairement à cette vulnérabilité en désactivant Assets sur votre instance de Jira Service Management en suivant ces instructions. Cela a pour conséquence de désactiver la fonctionnalité Assets.


Localtab
titleAtlassian Confluence Cloud
tabIconbvicon-cloud

Vous utilisez Jira Service Management Cloud

Tip

Vous n'êtes pas concerné par cet avis de sécurité. Aucune action n'est nécessaire.



Localtab
titlebitvoodoo Cloud
tabIconbvicon-cloud

Vous utilisez Jira Service Management sur des serveurs exploités par bitvoodoo

Info

Atlassian is not calling for immediate action to be taken from the bulletin.

Their internal assessment Atlassian rates the severity level of this vulnerability is scored as high severity.

Actions correctives: 

Si vous n'êtes pas en mesure de passer immédiatement à une version corrigée, vous pouvez remédier temporairement à cette vulnérabilité en désactivant Assets sur votre instance de Jira Service Management en suivant ces instructions.




Support

Si vous avez encore des questions ou des inquiétudes concernant cet avis, veuillez contacter le support de bitvoodoo via support.bitvoodoo.ch.



...

bitvoodoo Advisories BVADVIS