CVE-2022-26134 - Critical severity unauthenticated remote code execution vulnerability

[Pedro Felgueiras]

On the notification page they said they expect EOD June 3 PDT

It’s not EBD and the time zone is PDT sou we could have to wait 15 hours 

[Jimmy Seddon]

@tina-louise_allaire_canada_ca that sounds like your company admins posted that alert banner message.  You will want to reach out to them (possibly your IT team) that would not have been something that Atlassian posted.

[tina-louise_allaire_canada_ca]

Hello,

What time is end of business day for you? I have the following message on our Confluence: Maintenance Notification: Please note due to the Confluence Server and Data Center vulnerability - CVE-2022-26134 - the server will be shut down after the end of business today. The server will be available again once patching is complete.

Thank you

Tina

[Frank Hess]

Current version version is 7.18.0 thus fixed version should be 7.18.1 which currently isn't listed but can already be downloaded: https://product-downloads.atlassian.com/software/confluence/downloads/atlassian-confluence-7.18.1.tar.gz ;-)

[IT Admins]

I expect there will be a bugfix-release to address this, like a 7.18.1 would become 7.18.2 etc.

[cooreilly]

enabling alerts is great ... but when you do that it says it might not take affect for 5 days.  

[Pandiyan Muthuraman]

Do we get the fix in existing LTS version ? or will expect a new minor release with fixes. 

[Pedro Felgueiras]

Does anyone have a guide on how to restrict URL with "${" on tomcat or does it needs to be restricted outside tomcat 

[Joachim Schenk]

Hi Folks,

did you noticed that the old Partner portal is still available? 

https://partners.atlassian.com

I think this site should be taken offline and redirected to the new cloud site

Regards,

[David Grizzell]

Beyond what @Robert Tang mentions, in general, I suggest making sure you are updated to the latest available release of Confluence as well as patching your O/S. This will put you in a good position so that when the patch is released for this exploit the upgrade will be relatively painless.

[Robert Tang]

Awesome! Seems this is only limited to Confluence at the moment and it stays this way. 

[Robert Tang]

Can I confirm whether JIRA is affected by this or not?