Skip to main content

Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
  1. Home
  2. Alerts & Advisories
  3. Alerts
  4. Critical Vulnerability in Atlassian's Jira Data Center and Jira Service Management Data Center
Alerts

Critical Vulnerability in Atlassian's Jira Data Center and Jira Service Management Data Center

23 July 2021

Atlassian has released security updates to address a critical vulnerability (CVE-2020-36239) present in their Jira Data Center and Jira Service Management Data Center products. The vulnerability exists due to a missing authentication flaw in the implementation of Ehcache (an open source component) in the affected products, giving potential attackers unrestricted access to Ehcache Remote Method Invocation (RMI) ports. Successful exploitation of this vulnerability may allow an attacker to perform Remote Code Execution (RCE), which may lead to a compromise of the Jira server.

The following versions of Jira Data Center, Jira Core Data Center and Jira Software Data Center are affected:

  • From version 6.3.0 to before 8.5.16 (v8.5.16 is the patched version)

  • From version 8.6.0 to before 8.13.8 (v8.13.8 is the patched version)

  • From version 8.14.0 to before 8.17.0 (v8.17.0 is the patched version)

The following versions of Jira Service Management Data Center are affected:

  • From version 2.0.2 to before 4.5.16 (v4.5.16 is the patched version)

  • From version 4.6.0 to before 4.13.8 (v4.13.8 is the patched version)

  • From version 4.14.0 to before 4.17.0 (v4.17.0 is the patched version)

Administrators and users who are using affected versions of the products are advised to upgrade to the latest versions immediately, and restrict Ehcache RMI ports access to only cluster instances of Jira Data Center, Jira Core Data Center, and Jira Software Data Center, and Jira Service Management Data Center.

More information can be found here:

https://confluence.atlassian.com/adminjiraserver/jira-data-center-and-jira-service-management-data-center-security-advisory-2021-07-21-1063571388.html


Back to top