notice

Security Bugfix Policy | Atlassian

1,673 words, 68 clausesno date on the pageread 11/10/2026source

·Ascend to new heights with Atlassian Cloud. Data Center support ends on March 28, 2029. Together, we'll make this transition a success. Learn more and get support ->

·Security Bug Fix Policy

·Scope

·This policy describes how and when we may resolve security vulnerabilities in our products.

·Security bug fix service level objectives (SLOs)

·Atlassian sets service level objectives for fixing security vulnerabilities based on the security severity level and the affected product. We've defined the following timeframe objectives for fixing security issues in our products:

·Accelerated Resolution Objectives

·These timeframes apply to: All cloud-based Atlassian products

·Any software or system managed by Atlassian
·Any software or system running on Atlassian infrastructure
·Jira Align, cloud and self-managed releases

·Depending on the vulnerability level, we defined the following timelines for applying the fix in a product after verifying: Critical must be fixed in 10 days High must be fixed in 28 days Medium should be fixed in 84 days Low should be fixed in 175 days

·Extended Resolution Timeframes

·These timeframe objectives apply to all Data Center Atlassian products and mobile apps. Data center products are installed by customers on customer-managed systems.

·Critical, High, and Medium severity vulnerabilities to be fixed in a product within 90 days of being verified
·Low severity vulnerabilities to be fixed in a product within 180 days of being verified

·Shared responsibility model

·While Atlassian is committed to delivering secure products out of the box, we also rely on a shared responsibility model. This model requires customers to implement practices that continue beyond deployment and extend into operational phases. Some of these responsibilities include:

·Operating Atlassian software on private networks.
·Ensuring timely implementation of security fixes once they're released.
·Configuring Web Application Firewalls (WAF), VPNs, multi-factor authentication, and single sign-on.
·Implementing encryption and access controls.
·Performing regular backups.
·Conducting regular security audits.

·Critical Vulnerabilities

·When a critical vulnerability is discovered by Atlassian or reported by a third party, Atlassian will take the following actions:

·For cloud products, we will ship a new fixed release for the affected product as soon as possible
·For self-managed products, we will:
·Ship a bug fix release for the latest feature release of the affected product.
·Ship a new feature release for the affected product on the release schedule.
·Ship a bug fix release for all supported LTS releases of the affected product, in accordance with the Atlassian Support End of Life Policy. Product | Back port policy | Example

Jira Software Server and Data Center Jira Server and Data Center Jira Service Management Server and Data Center (previously known as Jira Service Desk)	Issue new bug fix releases for: Any versions designated an 'Long Term Support release' that have not reached end of life. All feature versions released within 6 months of the date the fix is released.	For example, if a critical security bug fix is developed on 1 January 2020, the following new bug fix releases would need to be produced: Jira 8.6.x because 8.6.0 was released on 17 December 2019 Jira 8.5.x because 8.5.0 was released on 21 October 2019 Jira 8.4.x because 8.4.0 was released on 9 September 2019 Jira 8.3.x because 8.3.0 was released on 22 July 2019 Jira 7.13.x because 7.13 is a Long Term Support release, and 7.13.0 was released on 28 November 2018
Confluence Server and Data Center	Issue new bug fix releases for: Any versions designated a 'Long Term Support release' that have not reached end of life. All feature versions released within 6 months of the date the fix is released.	For example, if a critical security bug fix is developed on 1 January 2020, the following new bug fix releases would need to be produced: Confluence 7.2.x because 7.2.0 was released on 12 December 2019 Confluence 7.1.x because 7.1.0 was released on 4 November 2019 Confluence 7.0.x because 7.0.0 was released on 10 September 2019 Confluence 6.13.x because 6.13 is a Long Term Support release, and 6.13.0 was released on 4 December 2018
Bitbucket Server and Data Center	Issue new bug fix releases for: Any versions designated a 'Long Term Support release' that have not reached end of life. All feature versions released within 6 months of the date the fix is released.	For example, if a critical security bug fix is developed on 1 January 2020, the following new bug fix releases would need to be produced: Bitbucket 6.9.x because 6.9.0 was released on 10 December 2019 Bitbucket 6.8.x because 6.8.0 was released on 6 November 2019 Bitbucket 6.7.x because 6.7.0 was released on 1 October 2019 Bitbucket 6.6.x because 6.6.0 was released on 27 August 2019 Bitbucket 6.5.x because 6.5.0 was released on 24 July 2019 Bitbucket 6.3.0 was released on 14 May 2019, more than 6 months before the date of the fix. If it was designated a Long Term Support release, a bug fix release would also be produced.
All other products (Bamboo, Crucible, Fisheye, etc)	We will only issue new bug fix releases for the current and previous feature release version.	For example, if a critical security bug fix is developed on 1 January 2020 for Bamboo, the following new bug fix releases would need to be produced: Bamboo 6.10.x because it was released on 17 September 2019 and is the current release Bamboo 6.9.x because 6.9.0 is the previous release

·For Fisheye and Crucible, we will provide a bug fix release for the latest feature release of the affected product.

·Examples of critical vulnerability fixes for self-managed products:

Product	Example
Jira Software and Jira Service Management	Example Jira Software 11.3.x because 11.3.0 is both the latest feature and Long Term Support release
Example Jira Software 10.3.x because 10.3.0 is the previous Long Term Support release
Confluence	Example Confluence 10.2.x because 10.2.0 is the latest feature and Long Term Support release
Example Confluence 9.2.x because 9.2.0 is the second latest supported Long Term Support release
Bitbucket	Example Bitbucket 10.3.x because 10.3.0 is the latest feature release
Example Bitbucket 10.2.x because 10.2.0 is the latest Long Term Support release
Example Bitbucket 9.4.x because 9.4.0 is the second latest supported Long Term Support release
Bamboo	Example Bamboo 12.1.x because 12.1.0 is the latest feature and Long Term Support release
Example Bamboo 10.2.x because 10.2.0 is the second latest supported Long Term Support release
Crowd	Example Crowd 7.2.x because 7.2.0 is the latest feature and Long Term Support release
Fisheye/Crucible	Example Fisheye/Crucible 4.9.x because 4.9.0 is the latest feature release

·No other product versions would receive new bug fixes.

·Frequent upgrades ensure that your product instances are secure. It's a best practice to stay on the latest bug fix release of the latest feature release or LTS release of your product.

·Non-critical vulnerabilities

·When a security issue of High, Medium, or Low severity is discovered, Atlassian will aim to release a fix within the service level objectives listed at the beginning of this document. If feasible, the fix may also be backported to Long-Term Support releases. The feasibility of backporting is influenced by a variety of factors, including software dependencies, architectural modifications, and compatibility issues, among others.

·To ensure your installations contain the latest security fixes, upgrade them whenever a bug fix release becomes available.

·Other information

·The severity level of vulnerabilities is calculated based on Severity Levels for Security Issues.

·We'll continuously evaluate our policies based on customer feedback and provide any updates or changes on this page.

·FAQ

An arrangement between a provider like Atlassian and its customers to implement best practices that persist beyond the initial deployment and extend into the operational phases. For details, check out the Data Center security checklist and shared responsibilities.
Long Term Support releases are for Data Center customers who prefer to allow more time for upgrades to new feature releases but still need to receive bug fixes. Some products will designate a specific version as a Long Term Support release, indicating that security bug fixes will be provided throughout the entire two-year support period.
A feature release is a version that hasn't been designated an LTS release. Instead, it contains new features, changes to supported platforms (such as databases, operating systems, Git versions), or removal of features. Learn more about the Atlassian Bug Fixing Policy.
Bug fix releases may include enhancements to stability and performance as well as addressing functionality bugs and security vulnerabilities. Depending on the nature of the fixes, they may introduce minor changes to existing features. However, they don't include new features or high-risk changes so they can be adopted quickly. We recommend promptly upgrading to the latest bug fix release for your current version.
You can always check the software download portal or visit the product-specific download pages. Jira Software Data Center Jira Service Management Confluence Data Center Bitbucket Data Center Bamboo Data Center Crowd Data Center
Atlassian supports releases for two years after the initial feature or Long-Term Support (LTS) release. For example, we provide technical support for Jira Software 9.14.x for two years after Jira 9.14.0 was released.
Check out the Atlassian Data Center End of Support Policy for the most up-to-date information.
Vulnerability refers to a weakness or flaw that may be exploited by a threat or risk. In the context of cybersecurity, a vulnerability could be a flaw in software, network, or system that allows unauthorized users to gain access or cause damage. This could include outdated software, weak passwords, or missing data encryption.
A security bug fix is a set of changes made to a system or application to address vulnerabilities that hackers could exploit. These vulnerabilities, also known as security bugs, could lead to unauthorized access, data theft, or other malicious activities.
Atlassian publishes monthly Security Advisories and provides access to the Vulnerability Disclosure Portal. The Vulnerability Disclosure Portal is a central hub for information about disclosed vulnerabilities in any of our products. It's updated monthly with the release of each Security Bulletin and provides an easy way to search and access data from previous bulletins.