Produkty
Dla zespołów
Wsparcie
Wypróbuj teraz
Kup teraz
Search Toggle menu
Close search

Planuj, śledź i wspieraj

Jira Software

Śledzenie projektów i zgłoszeń

Jira Align

Planowanie zwinne w przedsiębiorstwie

Jira Core

Podstawowe zarządzanie biznesem

Jira Service Desk

Zarządzanie usługami IT oparte na współpracy

Opsgenie

Nowoczesne zarządzanie incydentami

Statuspage

Informowanie o zdarzeniach

Współpraca

Confluence

Współpraca przy tworzeniu dokumentacji

Trello

Współpracuj przy dowolnym projekcie, korzystając z narzędzi wizualnych

Twórz kod, kompiluj i wydawaj

Bitbucket

Zarządzanie kodem w repozytorium Git

Sourcetree

Klient Git i Mercurial dla komputerów stacjonarnych

Bamboo

Zarządzanie integracją i wersją

BEZPIECZEŃSTWO i TOŻSAMOŚĆ

Atlassian Access

Bezpieczeństwo i kontrola w rozwiązaniu Cloud

Crowd

Zarządzanie użytkownikami w samodzielnie zarządzanych środowiskach
Zobacz wszystkie produkty
Close dropdown

Według wielkości zespołu

Start-upy

Idealne dla start-upów, które korzystają ze wsparcia inkubatorów oraz tych, które przygotowują się do wejścia na giełdę

Małe firmy

Zdobądź odpowiednie narzędzia dla rozwijającej się firmy

Enterprise

Dowiedz się, jak pomagamy zespołom odnieść sukces

Według funkcji zespołu

Oprogramowanie

Planuj, kompiluj i wydawaj produkty wysokiej jakości

Marketing

Przygotuj skuteczną strategię

HR

Usprawnij zarządzanie ludźmi

Prawo

Działaj w sposób bezpieczny i godny zaufania

Operacje

Prowadź działalność w sposób wydajny

IT

Zapewniaj usługi i wsparcie wysokiej jakości

Finanse

Uprość procesy finansowe

Reagowanie na incydenty

Reaguj na incydenty, rozwiązuj je i ucz się na każdym przypadku
Zobacz wszystkie produkty
Close dropdown

Wsparcie Atlassian

Pomoc techniczna

Utwórz zgłoszenie

Zakup licencji

Pomoc dotycząca cen i konta użytkownika

Dokumentacja

Przewodniki po wszystkich naszych produktach

Migracja do wersji Cloud

Zaplanuj migrację z wersji Server do Cloud

Usługi Enterprise

Wsparcie dla dużych zespołów

Wsparcie udzielane przez społeczność

Pomoc oferowana przez społeczność

Uzyskaj pomoc od innych użytkowników

Program partnerski

Dowiedz się więcej o partnerach firmy Atlassian

Znajdź partnera

Niestandardowe usługi konsultingowe

Dowiedz się więcej i dołącz

O nas

Poznaj naszą firmę

Kariera

Przeszukaj nasze najnowsze oferty pracy

Szkolenia i certyfikaty

Rozwijaj swoje umiejętności i uzyskaj aprobatę Atlassian

Blogi

Publikacje na każdy temat pisane przez liderów w dziedzinie
Wyświetl wszystkie informacje pomocy technicznej
Close dropdown

Security Bug Fix Policy

Atlassian makes it a priority to ensure that customers' systems cannot be compromised by exploiting vulnerabilities in Atlassian products.

Scope

The following describes how and when we resolve security bugs in our products. It does not describe the complete disclosure or advisory process that we follow.

Security bug fix Service Level Agreement (SLA)

We have defined the following timeframes for fixing security issues in our products:

  • Critical severity bugs (CVSS v2 score >= 8, CVSS v3 score >= 9) to be fixed in product within 4 weeks of being reported
  • High severity bugs (CVSS v2 score >= 6, CVSS v3 score >= 7) to be fixed in product within 6 weeks of being reported
  • Medium severity bugs (CVSS v2 score >= 3, CVSS v3 score >= 4) to be fixed in product within 8 weeks of being reported
     

Critical Vulnerabilities

When a Critical security vulnerability is discovered by Atlassian or reported by a third party, Atlassian will do all of the following:

  • Issue a new, fixed release for the current version of the affected product as soon as possible.
  • Issue a new maintenance release for a previous version as follows:
     

 

Product
Back port policy
Example

Jira Software Server and Data Center

Jira Core Server and Data Center

Jira Service Desk Server and Data Center

Issue new bug fix releases for:

  • Any versions designated a 'Long Term Support release' that have not reached end of life.
  • All feature versions released within 6 months of the date the fix is released.

For example, if a critical security bug fix is developed on 1 January 2020, the following new bug fix releases would need to be produced:

  • Jira 8.6.x because 8.6.0 was released on 17 December 2019
  • Jira 8.5.x because 8.5.0 was released on 21 October 2019
  • Jira 8.4.x because 8.4.0 was released on 9 September 2019
  • Jira 8.3.x because 8.3.0 was released on 22 July 2019
  • Jira 7.13.x because 7.13 is a Long Term Support release, and 7.13.0 was released on 28 November 2018

Confluence Server and Data Center

Issue new bug fix releases for:

  • Any versions designated a 'Long Term Support release' that have not reached end of life.
  • All feature versions released within 6 months of the date the fix is released.

For example, if a critical security bug fix is developed on 1 January 2020, the following new bug fix releases would need to be produced:

  • Confluence 7.2.x because 7.2.0 was released on 12 December 2019
  • Confluence 7.1.x because 7.1.0 was released on 4 November 2019
  • Confluence 7.0.x because 7.0.0 was released on 10 September 2019
  • Confluence 6.13.x because 6.13 is a Long Term Support release, and 6.13.0 was released on 4 December 2018

Bitbucket Server and Data Center

Issue new bug fix releases for:

  • Any versions designated a 'Long Term Support release' that have not reached end of life.
  • All feature versions released within 6 months of the date the fix is released.

For example, if a critical security bug fix is developed on 1 January 2020, the following new bug fix releases would need to be produced:

  • Bitbucket 6.9.x because 6.9.0 was released on 10 December 2019
  • Bitbucket 6.8.x because 6.8.0 was released on 6 November 2019
  • Bitbucket 6.7.x because 6.7.0 was released on 1 October 2019
  • Bitbucket 6.6.x because 6.6.0 was released on 27 August 2019
  • Bitbucket 6.5.x because 6.5.0 was released on 24 July 2019

Bitbucket 6.3.0 was released on 14 May 2019, more than 6 months before the date of the fix. If it was designated a Long Term Support Release, a bug fix release would also be produced.

All other products (Bamboo, Crucible, Fisheye, etc)

We will only issue new bug fix releases for the current and previous feature release version.

For example, if a critical security bug fix is developed on 1 January 2020 for Bamboo, the following new bug fix releases would need to be produced:

  • Bamboo 6.10.x because it was released on 17 September 2019 and is the current release
  • Bamboo 6.9.x because 6.9.0 is the previous release
Product

Jira Software Server and Data Center

Jira Core Server and Data Center

Jira Service Desk Server and Data Center
Back port policy

Issue new bug fix releases for:

  • Any versions designated a 'Long Term Support release' that have not reached end of life.
  • All feature versions released within 6 months of the date the fix is released.
Example

For example, if a critical security bug fix is developed on 1 January 2020, the following new bug fix releases would need to be produced:

  • Jira 8.6.x because 8.6.0 was released on 17 December 2019
  • Jira 8.5.x because 8.5.0 was released on 21 October 2019
  • Jira 8.4.x because 8.4.0 was released on 9 September 2019
  • Jira 8.3.x because 8.3.0 was released on 22 July 2019
  • Jira 7.13.x because 7.13 is a Long Term Support release, and 7.13.0 was released on 28 November 2018
Product

Confluence Server and Data Center
Back port policy

Issue new bug fix releases for:

  • Any versions designated a 'Long Term Support release' that have not reached end of life.
  • All feature versions released within 6 months of the date the fix is released.
Example

For example, if a critical security bug fix is developed on 1 January 2020, the following new bug fix releases would need to be produced:

  • Confluence 7.2.x because 7.2.0 was released on 12 December 2019
  • Confluence 7.1.x because 7.1.0 was released on 4 November 2019
  • Confluence 7.0.x because 7.0.0 was released on 10 September 2019
  • Confluence 6.13.x because 6.13 is a Long Term Support release, and 6.13.0 was released on 4 December 2018
Product

Bitbucket Server and Data Center
Back port policy

Issue new bug fix releases for:

  • Any versions designated a 'Long Term Support release' that have not reached end of life.
  • All feature versions released within 6 months of the date the fix is released.
Example

For example, if a critical security bug fix is developed on 1 January 2020, the following new bug fix releases would need to be produced:

  • Bitbucket 6.9.x because 6.9.0 was released on 10 December 2019
  • Bitbucket 6.8.x because 6.8.0 was released on 6 November 2019
  • Bitbucket 6.7.x because 6.7.0 was released on 1 October 2019
  • Bitbucket 6.6.x because 6.6.0 was released on 27 August 2019
  • Bitbucket 6.5.x because 6.5.0 was released on 24 July 2019

Bitbucket 6.3.0 was released on 14 May 2019, more than 6 months before the date of the fix. If it was designated a Long Term Support release, a bug fix release would also be produced.
Product

All other products (Bamboo, Crucible, Fisheye, etc)
Back port policy

We will only issue new bug fix releases for the current and previous feature release version.
Example

For example, if a critical security bug fix is developed on 1 January 2020 for Bamboo, the following new bug fix releases would need to be produced:

  • Bamboo 6.10.x because it was released on 17 September 2019 and is the current release
  • Bamboo 6.9.x because 6.9.0 is the previous release

It is important to stay on the latest bug fix release for the version of the product you are using (this is best practice). For example if you are on Jira Software 7.5.0, you should upgrade to Jira Software 7.5.3 proactively. If a new security bug fix is released, e.g. Jira Software 7.5.4, the delta between the two versions is minimal (i.e. only the security fix), making it easier to apply. 

The critical vulnerabilities resolution process does not apply to our Atlassian Cloud products as these services are always fixed by Atlassian without any additional action from customers.

Non-critical vulnerabilities

When a security issue of a High, Medium or Low severity is discovered, Atlassian will include a fix in the next scheduled release. The fix may also be backported to Long Term Support releases, if feasible. 

You should upgrade your installations when a bug fix release becomes available to ensure that the latest security fixes have been applied.

Other information

Severity level of vulnerabilities is calculated based on Severity Levels for Security Issues.

We will continuously evaluate our policies based on customer feedback and will provide any updates or changes on this page. 

FAQ

What is a 'Long Term Support release'? Show +
  

Long Term Support releases are for Server and Data Center customers who prefer to allow more time to prepare for upgrades to new feature versions, but still need to receive bug fixes. Some products will designate a particular version to be a Long Term Support release, which means that security bug fixes, will be made available for the full 2 year support window.
What is a 'Feature release'? Show +
  

A Feature release is a version (for example 4.3) which contains new features or major changes to existing features, that has not been designated a Long Term Support release.  See the Atlassian Bug Fixing Policy for more information on our release terminology.
Why do you only cover 6 months of Feature releases for Bitbucket, Jira and Confluence? Show +
  

Bitbucket Server releases very frequently, therefore 6 months covers 5-6 major versions. Since mid 2017, Jira and Confluence have moved to a similar release cadence, and are now also releasing 5-6 times per year.
Why do other products like Bamboo and Fisheye/Crucible only back port to one previous major version? Show +
  

Our efforts are focused on Jira, Confluence and Bitbucket Server, but we may consider extending Bamboo, Fisheye/Crucible and other products to cover additional major versions, based on the demand to do this.