SB2023121272 - Atlassian Jira Data Center and Server update for third-party software

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) XML External Entity injection (CVE-ID: CVE-2020-25649)

The vulnerability allows a remote attacker to modify information on the system.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and modify information on the system.

2) Resource exhaustion (CVE-ID: CVE-2023-44487)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improperly control of consumption for internal resources when handling HTTP/2 requests with compressed HEADERS frames. A remote attacker can send a sequence of compressed HEADERS frames followed by RST_STREAM frames and perform a denial of service (DoS) attack, a.k.a. "Rapid Reset".

Note, the vulnerability is being actively exploited in the wild.

3) Improper input validation (CVE-ID: CVE-2021-31684)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within indexOf() function of JSONParserByteArray. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

4) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2023-3635)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://confluence.atlassian.com/security/security-bulletin-december-12-2023-1319249520.html
• https://jira.atlassian.com/browse/JSWSERVER-25461