Is 8.18.0 affected

[TQS IT Department]

 Is 8.18.0 affected by Jira Data Center And Jira Service Management Data Center Security Advisory 2021-07-21?

[Daniel Eads]

Jira Data Center 8.18.0 is not affected by the security advisory, however we have removed that version as available for download because of a bug. If you are already on Jira Data Center or Jira Server 8.18.0, it is worth trying to set aside some time to upgrade to 8.18.1 which contains the fix for that bug.

Cheers,
Daniel | Atlassian Support

[Dawn Fama]

Unfortunately, if you are on JIRA DC v8.18 and use the UPM in your DC instance to plan your upgrade, you do not get the option to download 8.18.1 DC, it says you are on the recommended version. 

Then when you go to manage your licenses and select the download option it takes you to AWS or Azure option - Download Jira Software Data Center | Atlassian its a bit tricky to find latest self hosted DC release.

Also, should check the bundled version of tomcat - Application Server Apache Tomcat/8.5.65 is vulnerable - [JRASERVER-72609] Upgrade the bundled version of Apache Tomcat to 8.5.68 or later - Create and track feature requests for Atlassian products.

for  CVE-2021-33037  

8.18 release is now bundled with fixed tomcat 8.5.68 - may need to follow atlassian docs to manually upgrade How to upgrade Apache Tomcat version used by Jira | Jira | Atlassian Documentation

[Chris Isaak]

Per : https://confluence.atlassian.com/adminjiraserver/jira-data-center-and-jira-service-management-data-center-security-advisory-2021-07-21-1063571388.html?utm_source=alert-email&utm_medium=email&utm_campaign=Jira%20Data%20Center-advisory_july-2021_EML-10812&jobid=105135348&subid=1521081460  

Upgrade Jira Center to version 8.17.0 or higher.

If you cannot upgrade to 8.17.0, then upgrade to 8.5.16 or 8.13.8.

Upgrade Jira Service Management Data Center to version 4.17.0 or higher.

If you cannot upgrade to 4.17.0, then upgrade to 4.5.16 or 4.13.8.