Security risk of JIRA standalone installation running JRE version 1.6.0_26 vs 1.6.0_29 (latest)

Posted by kayaker243 on Server Fault See other posts from Server Fault or by kayaker243
Published on 2011-11-14T00:31:31Z Indexed on 2011/11/14 1:54 UTC
Read the original article Hit count: 453

Filed under:

security

|

jira

|

jre

|

atlassian

Atlassian recently introduced a standalone installer that installs JIRA, along with its own JRE. Unfortunately the JRE Atlassian bundles with this installer is 1.6.0_26, whereas the current version of the JRE is 1.6.0_29. This is potentially concerning given there were vulnerabilities in _26 that were fixed in the subsequent versions. We are currently using the bundled-installer version of JIRA and one contractor has recommended we ditch this for the system-installed JRE.

My question is this: what is the actual security risk of continuing to use the _26 version of the JRE included in the bundled installer? There is no public access to our install of JIRA (only about 20 employees and contractors can login to our JIRA) and it's only accessible on a subdomain of a domain at which there's no publicly-available website. If there's a not insignificant risk inherent in sticking with the older JRE, why hasn't Atlassian upgraded the default JRE?

© Server Fault or respective owner

Related posts about security

sudo apt-get update errors

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Here is what I get on my terminal when running sudo apt-get update errors. I dont know if the issue is from my sources.list or my proxy setup(have not made any changes to proxies). Thank you for any help in advanced. Ign http://security.ubuntu.com oneiric-security Release.gpg Ign http://security… >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Devx - Search for 'Devx'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Internet.com - Search for 'Internet.com'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
StackOverFlowError while creating Mac object on AS400/Java

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello all, I am a newbie to AS400-Java programming. I am trying to create my first program to test the implementation of Message Authentication Code (MAC). I am trying to use the HMACSHA1 hash function. My (Java 1.4) program runs fine on a dev box (V5R4).But fails terribly on the QA box (V5R3). My… >>> More
Google App Engine - Spring Security Issue (java.security.AccessControlException)

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm currently getting the AccessControlException below when I deploy to app engine (I don't see it when I run in my local environment). I'm using GAE 1.3.1, Spring 3.0.1, and Spring Security 3.0.2. Any ideas how to get around this issue? It appears to be an issue with Spring Security trying to get… >>> More

Related posts about jira

Running jira at jira.[my domain].com

as seen on Server Fault - Search for 'Server Fault'
I have jira installed on my server. It was running at http://[my ip address]:8100. I could manage to change it to http://jira.[my domain].com. Now after I access it at http://jira.[my domain].com, a browser path changes to http://jira.[my domain].com:8100/secure/Dashboard.jspa. Why does the port… >>> More
Webservice Jira gives: Error: No such operation 'getIssuesFromJqlSearch' from Jira 4.01

as seen on Stack Overflow - Search for 'Stack Overflow'
When I use the Webservice of Jira, I need to use the method getIssuesFromJqlSearch to describe a certain (JQL) Query. But it returns me "No such operation 'getIssuesFromJqlSearch'". Is this method in Jira 4.01 not implemented yet? BTW: I need a method to get all Issues from one specific project… >>> More
Apache reverse proxy POST 403

as seen on Server Fault - Search for 'Server Fault'
I am trying to get Jira and Stash to talk to each other via a Trusted Application link. The setup, currently, looks like this: Jira - http - Jira Proxy -https- stash proxy -http- stash. Jira and the Jira proxy are on the same machine. The Jira Proxy is showing 403 Forbidden for POST requests from… >>> More
Running JIRA on a VM

as seen on Stack Overflow - Search for 'Stack Overflow'
Anyone have any success or failure running Jira on a VM? I am setting up a new source control and defect tracking server. My server room is near full and my services group suggested a VM. I saw that a bunch of people are running SVN on VM (including NCSA). The VM would also free me from hardware… >>> More
Generating a Change Log from Subversion Logs and integrating with Jira

as seen on Stack Overflow - Search for 'Stack Overflow'
We use Subversion for version control and Jira for tickets. All our commit messages have a Jira ticket id in it. The repository has a traditional organization with a main trunk and a version branch. I'd like to answer this question: Which closed ticket items entered in this release? See that… >>> More