When will the bundled AdoptOpenJDK 11.0.11+9 be updated?

[Gary Vecchio]

There is currently an open vulnerability in AdoptOpenJDK 11.0.11+9. See CVE-2021-35550

CVE-2021-35550 | Tenable®

[Mahtab]

Hi team,

As we do not have the ETA and the version of Jira which would include the updated version of AdoptOpenJDK which does not have this vulnerability, to remediate this issue in the meantime, we recommend upgrading Java to a minor release of AdoptOpenJDK 11 which does not have this vulnerability. Bundled Tomcat and Java versions is our document which tracks the Jira versions and the bundled Java and Tomcat. 

Upgrading Java

The best way to do this is to install the desired Java version directly on the Jira hosting machine, instead of upgrading the bundled one, then set the environment variables to make Jira able to utilize that Java. The steps of that procedure can be found on our Change the Java version used by Jira server article. If you are using Windows as a Service, please ensure to update the Java on Tomcat properties of the Service.

Please ensure the upgraded Java version is covered in the JIRA Supported Platforms.

Regads,

Mahtab Shahlori