Política de correção de bugs de segurança
Para a Atlassian, é prioridade garantir que os sistemas dos clientes não sejam comprometidos explorando as vulnerabilidades nos produtos da Atlassian.
Escopo
This policy describes how and when we may resolve security vulnerabilities in our products.
Objetivos de Nível de Serviço (SLO) de atualização de segurança
Atlassian sets service level objectives for fixing security vulnerabilities based on the security severity level and the affected product. We've defined the following timeframe objectives for fixing security issues in our products:
Accelerated Resolution Objectives
These timeframes apply to all cloud-based Atlassian products, and any other software or system that is managed by Atlassian, or is running on Atlassian infrastructure. They also apply to Jira Align (both the cloud and self-managed releases).
- Critical vulnerabilities to be fixed in product within 10 days of being verified
- High vulnerabilities to be fixed in product within 28 days of being verified
- Medium vulnerabilities to be fixed in product within 84 days of being verified
- Low vulnerabilities to be fixed in product within 175 days of being verified
Cronogramas de Resolução Estendida
These timeframe objectives apply to all self-managed Atlassian products. A self-managed product is installed by customers on customer-managed systems and includes Atlassian's Data Center and mobile apps.
- Critical, High, and Medium vulnerabilities to be fixed in product within 90 days of being verified
- Low vulnerabilities to be fixed in product within 180 days of being verified
Vulnerabilidades críticas
When a critical vulnerability is discovered by Atlassian or reported by a third party, Atlassian will take the following actions:
- For cloud products, we will ship a new fixed release for the affected product as soon as possible
- For self-managed products, we will:
- ship a bug fix release for the latest feature release of the affected product
- ship a new feature release for the affected product on the release schedule
- ship a bug fix release for all supported LTS releases of the affected product, in accordance with the Atlassian Support End of Life Policy.
Critical Vulnerabilities
When a critical vulnerability is discovered by Atlassian or reported by a third party, Atlassian will take the following actions:
- For cloud products, we will ship a new fixed release for the affected product as soon as possible
- For self-managed products, we will:
- Ship a bug fix release for the latest feature release of the affected product.
- Ship a new feature release for the affected product on the release schedule.
- Ship a bug fix release for all supported LTS releases of the affected product, in accordance with the Atlassian Support End of Life Policy.
Produto | Política de back port | Exemplo |
|---|---|---|
| Jira Software Server e Data Center Jira Core Server e Data Center Jira Service Management Server e Data Center (antes chamado Jira Service Desk) | Lançar novas atualizações de segurança para:
| Por exemplo, se uma atualização de segurança crítica for desenvolvida em 1º de janeiro de 2020, vai ser necessário produzir as seguintes novas versões de atualização de segurança:
|
| Confluence Server e Data Center | Lançar novas atualizações de segurança para:
| Por exemplo, se uma atualização de segurança crítica for desenvolvida em 1º de janeiro de 2020, vai ser necessário produzir as seguintes novas versões de atualização de segurança:
|
| Bitbucket Server e Data Center | Lançar novas atualizações de segurança para:
| Por exemplo, se uma atualização de segurança crítica for desenvolvida em 1º de janeiro de 2020, vai ser necessário produzir as seguintes novas versões de atualização de segurança:
O Bitbucket 6.3.0 foi lançado em 14 de maio de 2019, mais de 6 meses antes da data da correção. Se fosse designado como uma versão de Suporte de longo prazo, também seria produzida uma versão de correção de bug. |
| Versões de atualização de segurança serão lançadas apenas para as versões atual e anterior do função. | Se uma atualização de segurança crítica do Bamboo for desenvolvida em 1º de janeiro de 2020, as seguintes novas versões de atualização de segurança devem ser desenvolvidas:
|
For Crowd, Fisheye, and Crucible, we will provide a bug fix release for the latest feature release of the affected product.
Examples of critical vulnerability fixes for self-managed products:
Examples of critical vulnerability fixes for self-managed products:
If a critical vulnerability fix is developed on Feb 1, 2024, the following are example releases that would receive the bug fix:
Produto | Exemplo |
|---|---|
| Jira Software | Exemplo Jira Software 9.13.x because 9.13.0 is the latest feature release |
| Exemplo Jira Software 9.12.x because 9.12.0 is the latest Long Term Support release | |
| Exemplo Jira Software 9.4.x because 9.4.0 is the previous Long Term Support release | |
| Jira Service Management | Exemplo Jira Service Management 5.13.x because 5.13.0 is the latest feature release |
| Exemplo Jira Service Management 5.12.x because 5.12.0 is the latest Long Term Support release | |
| Exemplo Jira Service Management 5.4.x because 5.4.0 is the second latest supported Long Term Support release | |
| Confluence | Exemplo Confluence 8.7.x because 8.7.0 is the latest feature release |
| Exemplo Confluence 8.5.x because 8.5.0 is the latest Long Term Support release | |
| Exemplo Confluence 7.19.x because 7.19.0 is the second latest supported Long Term Support release | |
| Bitbucket | Exemplo Bitbucket 8.17.x because 8.17.0 is the latest feature release |
| Exemplo Bitbucket 8.9.x because 8.9.0 is the latest Long Term Support release | |
| Exemplo Bitbucket 7.21.x because 7.21.0 is the second latest supported Long Term Support release | |
| Bamboo | Exemplo Bamboo 9.5.x because 9.5.0 is the latest feature release |
| Exemplo Bamboo 9.2.x because 9.2.0 is the latest Long Term Support release | |
| Crowd | Exemplo Crowd 5.3.x because 5.3.0 is the latest feature release |
| Fisheye/Crucible | Exemplo Fisheye/Crucible 4.8.x because 4.8.0 is the latest feature release |
No other product versions would receive new bug fixes.
Frequent upgrades ensure that your product instances are secure. It's a best practice to stay on the latest bug fix release of the latest feature release or LTS release of your product.
Vulnerabilidades não críticas
When a security issue of a High, Medium, or Low severity is discovered, Atlassian will aim to release a fix within the service level objectives listed at the beginning of this document. The fix may also be backported to Long Term Support releases, if feasible. The feasibility of backporting depends on complex dependencies, architectural changes, and compatibility, among other factors.
Você deve fazer o upgrade das instalações quando sair uma atualização de segurança nova para garantir que as correções de segurança mais recentes foram implementadas.
Outras informações
The severity level of vulnerabilities is calculated based on Severity Levels for Security Issues.
We'll continuously evaluate our policies based on customer feedback and will provide any updates or changes on this page.