CVE-2018-5382 Security Finding - Is this still a vulnerability in JS 6.4.2?

[kurtis.fleming]

Link to community article in question: https://community.jaspersoft.com/questions/1100966/security-finding-cve-2018-5382-jasperreports

We are currently seeking approval from our security team for Jaspersoft Studio 6.4.2 to bypass the web gateways and connect direct.  be carried out until we can confirm that the security finding CVE-2018-5382 has been addressed.

• Do the patch notes of JS 6.4.2 (or previous versions if addressed some time ago) that is intended for deployment contain explicit reference to CVE-2018-5382?
• What version of org.bouncycastle:bcprov-jdk15on:XX is used with Jaspersoft 6.4.2?

Thanks.

 

[hozawa]

AFIK, there's no security patches for community versions. You'll need to purchase commercial version.

[kurtis.fleming]

We currently have the Commercial version, through our subscription to CA PPM SaaS. Can you please advise on the above query, and what security patches have been applied?

[kurtis.fleming]

We currently have the Commercial version, through our subscription to CA PPM SaaS. Can you please advise on the above query, and what security patches have been applied?

[djohnson53]

If you have a support contract with TIBCO, you should raise this issue with them.