How to fix this bug CVE-2016-1000031

[China infrastructure]

How to fix this bug CVE-2016-1000031

[China infrastructure]

Hi Daniel,

Will this risk affect JIRA and confluence?

[Daniel Eads]

Jira and Confluence are not affected at all by this CVE. Cheers!

[China infrastructure]

Hi Daniel,

Thank you for your reply. Jira and confluence are installed on our server. Can we fix this risk item? Are there any links to fixes? thank you

[Daniel Eads]

There is no risk item for Jira and Confluence. The CVE only affects Fisheye and Crucible, which are not part of Jira or Confluence.

If you do not have Fisheye or Crucible installed (these are separate applications entirely), you do not need to take any action.

[Daniel Eads]

Hey there,

According to our issue tracker, Atlassian Fisheye and Atlassian Crucible contained vulnerable versions of the Apache Commons FileUpload library noted in CVE-2016-1000031. However, our implementation of these libraries did not use the DiskFileItem class which was the attack vector in this advisory. Despite that, Fisheye and Crucible 4.7.0 now contain a patched version of the library.

Cheers,
Daniel