False fixed version for CVE-2026-42044 and CVE-2026-29145

Vulnerability Tests
1

In the NVTs with OIDs

1.3.6.1.4.1.25623.1.0.136593 and 1.3.6.1.4.1.25623.1.0.136598

, the Affected Software and Solution versions are wrong in the 11.3 branch of Jira.

As [JSWSERVER-26812] Prototype Pollution “Gadget” Axios Dependency in Jira Software Data Center - Create and track feature requests for Atlassian products. and [JSWSERVER-26850] BASM (Broken Authentication & Session Management) in Jira Software Data Center - Create and track feature requests for Atlassian products. state, the fixed versions are 11.3.7 and 11.3.4, not 11.3.20.

These are only the two NVTs that I’ve found. There might easily be more.

2

Hi Leon, as this is an Enterprise feed topic, it’s appreciated if you (Enterprise customers) can forward this to our Support team (regardless if Community or Enterprise content). The community forum is primarily for community users to help each other and only on a voluntary basis from Greenbone members. Thank you for bringing this to our attention.

1 Like
3

Thanks a lot for your report. Besides the previous mentioned request that customer relevant requests are suggested to be going over the known support channels (for easier tracking, SLA and relevant other topics) this was actually a valid report and has been handled now accordingly (the changes should be included in one of the next few feed updates).

These are only the two NVTs that I’ve found. There might easily be more.

I have checked all of the 2026 ones and there are none in addition. If you still find any please use the known support channels as advised for additional reporting.

2 Likes