Vulnerabilities "org.codehaus.jackson.JsonParseException: Unexpected character"

[Massimo Sepicacchi]

Hi all,
After upgrade from jira 8.13.8 to 8.21.1 Appear a pop-up info, about ;

Security Vulnerabilities In the jira log( and in  Instance Health tab)  there is this exception:

java.lang.RuntimeException: org.codehaus.jackson.JsonParseException: Unexpected character ('<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
at [Source: java.io.StringReader@2d77f1a9; line: 1, column: 2]
at com.atlassian.troubleshooting.healthcheck.checks.vuln.CveValidator.parseJson(CveValidator.java:61)
at com.atlassian.troubleshooting.stp.hercules.regex.cacheables.ResultWithFallback.map(ResultWithFallback.java:56)
at com.atlassian.troubleshooting.healthcheck.checks.vuln.CveValidator.lambda$validateCves$1(CveValidator.java:52)
at java.base/java.util.Optional.map(Unknown Source)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(Unknown Source)
at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.copyInto(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source)
at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.evaluate(Unknown Source)
at java.base/java.util.stream.ReferencePipeline.collect(Unknown Source)
at com.atlassian.troubleshooting.healthcheck.checks.vuln.CveValidator.validateCves(CveValidator.java:44)
at com.atlassian.troubleshooting.healthcheck.checks.vuln.SecurityVulnerabilityHealthCheck.check(SecurityVulnerabilityHealthCheck.java:33)
at com.atlassian.troubleshooting.healthcheck.impl.PluginSuppliedSupportHealthCheck.check(PluginSuppliedSupportHealthCheck.java:66)

How do I know where the point of the error is? 

[Arthur S]

Hi, did you find your answer ?

I found this documentation where it's says you need to allow access to *.atl-paas.net. from your proxy

https://confluence.atlassian.com/confkb/security-vulnerabilities-instance-health-check-failing-1115668729.html

I hope it helps you

[Leonard Chew]

I think the Error you see is NOT the Security Vulnerability itself, but a problem displaying the Security Vulnerability.

I had the same Error on Jira 8.20.0.

After refreshing the page, the error was gone and the real message was displayed.
Seems as if Jira has some constellations, where it cannot display the content of the Security Vulnerabilities. 

If the error continues to show, you can report it to Atlassian. For me, it was a one-time occurrence and I cannot reproduce it anymore.