Is it enough to update Jira Software via .obr after a Security bulletin?

[Thomas Clemens]

Hi,

we came across the the question if it would be enough to update our Jira Software instance (data center) in the application itself, as you can use the .obr version of Jira Software to update it directly there.

This does not update Jira Core though, which stays in the old version and there doesn't appear to be an .obr version for Jira core.

I assume it is always recommended to update with a real downtime for the security issues, but I was still wondering if we could differentiate there somehow?

The security bulletin only seems to specify Jira Data Center ir Jira Service Management Data Center. Is the first synonymous with Core and Software?

Kind regards,

Thomas

[Matt Doar (Adaptavist)]

Jira Software is a plugin for Jira Core. So updating the obr file will not update Jira Core. For most security vulnerabilities you need to update Jira Core, which may also come with a new Jira Software obr version