Is JIRA Software vulnerable to the recent Zip Slip exploit?

[Matt George]

Hello Everyone,

A new zip file exploit has been found by the folks at snyk - we're currently doing the rounds on everything that might be affected.

I'd assume JIRA is ok as I believe it doesn't unpackage any of the archive files that get uploaded as attachments but I wanted to check, just for peace of mind

Thanks,

Matt

A bit of further reading in case you're interested:

• https://snyk.io/research/zip-slip-vulnerability 
• https://github.com/snyk/zip-slip-vulnerability