Why is 8.5.X (Enterprise Release) not patching the most recent security vulnerability?

[Christopher Gronde]

Atlassian release Jira Server 8.5.X to be the Enterprise Release, meaning that it would receive security patches and updates for 2 years, meaning we would not have to do a major update for 2 years.  The first CVE to hit Jira https://jira.atlassian.com/browse/JRASERVER-70607?src=confmacro now says that in order to patch this we have to upgrade to 8.7.1.  What happened to the Enterprise Release?  Why is this not being mitigated in 8.5.x?  What's the point of having an Enterprise Release and then tell us we have to upgrade past it?

[Kurt Klinner · Accepted solution]

@Christopher Gronde 

Hi Christopher,

think this is due to the fact that the mentioned CVE is ranked as one with Severiy 3 - Minor,

according to the Bug Fix Policy https://www.atlassian.com/trust/security/bug-fix-policy

non critical vulnerabilities may be backported if feasible, but there is no gurantee for that

Non-critical vulnerabilities

When a security issue of a High, Medium or Low severity is discovered, Atlassian will include a fix in the next scheduled release. The fix may also be backported to Enterprise releases, if feasible. 

ER will receive backports of critical bugfixes

Hope that helps

Cheers

Kurt