erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: August 12, 2021

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: Jira CVE-2021-26086: 2021 File-Read Bug Added to KEV in 2024. Anyone still running Jira Server or Data Center older than 8.5.14, 8.13.6 or 8.16.1, especially if it is reachable from the internet.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2021-26086

Jira CVE-2021-26086: 2021 File-Read Bug Added to KEV in 2024

The bug itself only leaks files, and any Jira from the last four years is fixed; the real job is to find any Jira 8.x this old still answering on the network and upgrade or retire it.

Must act: Anyone still running Jira Server or Data Center older than 8.5.14, 8.13.6 or 8.16.1, especially if it is reachable from the internet.

Can relax: Jira Cloud users and anyone on Jira 8.17.0 or any 9.x or later release.

  1. Inventory every Jira instance and its version (Administration > System > System info, or GET /rest/api/2/serverInfo).
  2. Upgrade anything below 8.5.14, 8.13.6 or 8.16.1 to a supported Jira Data Center release, or migrate to Cloud; Jira Server has been unsupported since February 15, 2024.
  3. Until then, take the instance off the internet and block request paths containing /WEB-INF/ at the reverse proxy or WAF.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.