Security Bugfix Policy

Ascend to new heights with Atlassian Cloud. Data Center support ends on March 28, 2029. Together, we’ll make this transition a success. Learn more and get support ->

Security Bug Fix Policy

Scope

This policy describes how and when we may resolve security vulnerabilities in our products.

Security bug fix service level objectives (SLOs)

Atlassian sets service level objectives for fixing security vulnerabilities based on the security severity level and the affected product. We've defined the following timeframe objectives for fixing security issues in our products:

Accelerated Resolution Objectives

These timeframes apply to:

• All cloud-based Atlassian products

• Any software or system managed by Atlassian

• Any software or system running on Atlassian infrastructure

• Jira Align, cloud and self-managed releases Depending on the vulnerability level, we defined the following timelines for applying the fix in a product after verifying:

• Critical must be fixed in 10 days

• High must be fixed in 28 days

• Medium should be fixed in 84 days

• Low should be fixed in 175 days Extended Resolution Timeframes

These timeframe objectives apply to all Data Center Atlassian products and mobile apps. Data center products are installed by customers on customer-managed systems.

• **Critical, High, **and Medium severity vulnerabilities to be fixed in a product within 90 days of being verified
• Low severity vulnerabilities to be fixed in a product within 180 days of being verified

Shared responsibility model

While Atlassian is committed to delivering secure products out of the box, we also rely on a shared responsibility model. This model requires customers to implement practices that continue beyond deployment and extend into operational phases. Some of these responsibilities include:

• Operating Atlassian software on private networks.
• Ensuring timely implementation of security fixes once they're released.
• Configuring Web Application Firewalls (WAF), VPNs, multi-factor authentication, and single sign-on.
• Implementing encryption and access controls.
• Performing regular backups.
• Conducting regular security audits.

Critical Vulnerabilities

When a critical vulnerability is discovered by Atlassian or reported by a third party, Atlassian will take the following actions:

• For cloud products, we will ship a new fixed release for the affected product as soon as possible
• For self-managed products, we will: Ship a bug fix release for the latest feature release of the affected product.
• Ship a new feature release for the affected product on the release schedule.
• Ship a bug fix release for all supported LTS releases of the affected product, in accordance with the Atlassian Support End of Life Policy.

Product

Back port policy

Example

Jira Software Server and Data Center

Jira Server and Data Center

Jira Service Management Server and Data Center (previously known as Jira Service Desk)

Issue new bug fix releases for:

• Any versions designated an 'Long Term Support release' that have not reached end of life.

• All feature versions released within 6 months of the date the fix is released. For example, if a critical security bug fix is developed on 1 January 2020, the following new bug fix releases would need to be produced:

• Jira 8.6.x because 8.6.0 was released on 17 December 2019

• Jira 8.5.x because 8.5.0 was released on 21 October 2019

• Jira 8.4.x because 8.4.0 was released on 9 September 2019