Security Bug Fix Policy
Atlassian makes it a priority to ensure that customers' systems cannot be compromised by exploiting vulnerabilities in Atlassian products.
Scope
The following describes how and when we resolve security bugs in our products. It does not describe the complete disclosure or advisory process that we follow.
Security bug fix Service Level Objectives (SLO)
Atlassian sets service level objectives for fixing security vulnerabilities based on the security severity level and the affected product. We have defined the following timeframes for fixing security issues in our products:
Accelerated Resolution Timeframes
These timeframes apply to all cloud-based Atlassian products, and any other software or system that is managed by Atlassian, or is running on Atlassian infrastructure. They also apply to Jira Align (both the cloud and self-managed versions).
- Critical severity bugs to be fixed in product within 2 weeks of being verified
- High severity bugs to be fixed in product within 4 weeks of being verified
- Medium severity bugs to be fixed in product within 6 weeks of being verified
- Low severity bugs to be fixed in product within 25 weeks of being verified
Extended Resolution Timeframes
These timeframes apply to all self-managed Atlassian products. A self-managed product is installed by customers on customer-managed systems, and includes Atlassian's server, data center, desktop, and mobile applications.
- Critical, High, and Medium severity bugs to be fixed in product within 90 days of being verified
- Low severity bugs to be fixed in product within 180 days of being verified
Critical Vulnerabilities
When a Critical security vulnerability is discovered by Atlassian or reported by a third party, Atlassian will do all of the following:
- Issue a new, fixed release for the current version of the affected product as soon as possible.
- Issue a new maintenance release for a previous version as follows:
Product | Back port policy | Example |
|---|---|---|
| Jira Software Server and Data Center Jira Core Server and Data Center Jira Service Management Server and Data Center (previously known as Jira Service Desk) | Issue new bug fix releases for:
| For example, if a critical security bug fix is developed on 1 January 2020, the following new bug fix releases would need to be produced:
|
| Confluence Server and Data Center | Issue new bug fix releases for:
| For example, if a critical security bug fix is developed on 1 January 2020, the following new bug fix releases would need to be produced:
|
| Bitbucket Server and Data Center | Issue new bug fix releases for:
| For example, if a critical security bug fix is developed on 1 January 2020, the following new bug fix releases would need to be produced:
Bitbucket 6.3.0 was released on 14 May 2019, more than 6 months before the date of the fix. If it was designated a Long Term Support release, a bug fix release would also be produced. |
| We will only issue new bug fix releases for the current and previous feature release version. | For example, if a critical security bug fix is developed on 1 January 2020 for Bamboo, the following new bug fix releases would need to be produced:
|
For Crowd, Fisheye, and Crucible, we will provide a bug fix release for the latest feature release of the affected product.
It is important to stay on the latest bug fix release for the version of the product you are using (this is best practice). For example if you are on Jira Software 7.5.0, you should upgrade to Jira Software 7.5.3 proactively. If a new security bug fix is released, e.g. Jira Software 7.5.4, the delta between the two versions is minimal (i.e. only the security fix), making it easier to apply.
The critical vulnerabilities resolution process does not apply to our Atlassian Cloud products as these services are always fixed by Atlassian without any additional action from customers.
Product | Example |
|---|---|
| Jira Software | Example Jira Software 9.13.x because 9.13.0 is the latest feature release |
| Example Jira Software 9.12.x because 9.12.0 is the latest Long Term Support release | |
| Example Jira Software 9.4.x because 9.4.0 is the previous Long Term Support release | |
| Jira Service Management | Example Jira Service Management 5.13.x because 5.13.0 is the latest feature release |
| Example Jira Service Management 5.12.x because 5.12.0 is the latest Long Term Support release | |
| Example Jira Service Management 5.4.x because 5.4.0 is the second latest supported Long Term Support release | |
| Confluence | Example Confluence 8.7.x because 8.7.0 is the latest feature release |
| Example Confluence 8.5.x because 8.5.0 is the latest Long Term Support release | |
| Example Confluence 7.19.x because 7.19.0 is the second latest supported Long Term Support release | |
| Bitbucket | Example Bitbucket 8.17.x because 8.17.0 is the latest feature release |
| Example Bitbucket 8.9.x because 8.9.0 is the latest Long Term Support release | |
| Example Bitbucket 7.21.x because 7.21.0 is the second latest supported Long Term Support release | |
| Bamboo | Example Bamboo 9.5.x because 9.5.0 is the latest feature release |
| Example Bamboo 9.2.x because 9.2.0 is the latest Long Term Support release | |
| Crowd | Example Crowd 5.3.x because 5.3.0 is the latest feature release |
| Fisheye/Crucible | Example Fisheye/Crucible 4.8.x because 4.8.0 is the latest feature release |
No other product versions would receive new bug fixes.
Frequent upgrades ensure that your product instances are secure. It's a best practice to stay on the latest bug fix release of the latest feature release or LTS release of your product.
Non-critical vulnerabilities
When a security issue of a High, Medium or Low severity is discovered, Atlassian will aim to release a fix within the service level objectives listed at the beginning of this document. The fix may also be backported to Long Term Support releases, if feasible.
You should upgrade your installations when a bug fix release becomes available to ensure that the latest security fixes have been applied.
Other information
Severity level of vulnerabilities is calculated based on Severity Levels for Security Issues.
We will continuously evaluate our policies based on customer feedback and will provide any updates or changes on this page.