security advisory versions affected

[Alicia Pena]

This Jira security advisory initially released 4/20/22 then updated with additional advisories for plugins shows fixed in 8.20.x>=8.20.6 .  But we’re staging 8.20.8 for our next long term support version.  Should we assume it’s fixed in all the . releases after .6 too?  https://confluence.atlassian.com/jira/jira-security-advisory-2022-04-20-1115127899.html?s[…]l-2020_EML-12929&utm_medium=email&utm_source=alert-email

[serkan_sezer]

Hi @Andy Heinzer , we are using version 8.20.1. But I'm having confusion with the rankings in the announcement request. Is version 8.20.1 immune from the threat? Do we need to upgrade?

https://jira.atlassian.com/browse/JRASERVER-73650

@Alicia Pena thank you for the title

[Andy Heinzer]

No, 8.20.1 is not immune from this security advisory.  8.20.x is part of our Long Term Support releases.  Yes, you should upgrade to 8.20.6 (or a higher version within the 8.20.x line) in order to resolve this.

[Alicia Pena]

Nevermind. I was misreading it.  

[Andy Heinzer]

Within the 8.20.x line, yes, the fix is contained in all the subsequent 8.20 versions starting with 8.20.6 and higher.  So yes, 8.20.8 will also contain this fix.