Does Jira v8.20.1 is exposed to Spring4Shell vulnerability?

[Moshe Meidan]

Hello,

Following this security advisor, can you please advise if the product I am using is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965)?

https://confluence.atlassian.com/kb/faq-for-cve-2022-22965-1115149136.html

If yes, what is the recommended mitigation/fix?

I am double-checking this as the information in the FAQ is not clear enough.

Thanks,

Moshe

[Thiago Masutti · Accepted solution]

Hi @Moshe Meidan 
Welcome to the Atlassian Community.

According to the FAQ, Jira DC (including 8.20.1) is vulnerable to only if all of the following conditions are met:

• The product is running on JDK 9 or higher,

• An attacker tricks a user into making a malicious HTTP request,

• The request contains a valid Cross-Site Request Forgery token (note that the same-origin policy prevents an attacker from obtaining a user’s valid token),

• The targeted user is logged into the application with ‘system administrator’ privileges.

• Jira and Confluence only: The targeted user also has an active ‘secure administrator session’ (note that these sessions only last for 10 minutes by default).

If you are running Jira with any version of JRE/JDK 8, then you should be good.

Otherwise, if your company requires fast response, then you can start Jira with OpenJDK 8.

The details of that change are described in https://confluence.atlassian.com/jirakb/change-the-java-version-used-by-jira-server-765594330.html.

Kind regards,
Thiago Masutti

[Moshe Meidan]

Thanks!