Confluence - Path traversal vulnerability - CVE-2019-3398 - Server Ed. 6.4.2

Pedro Tome_lxz0jj

Hello,

I have confluence Server Ed 6.4.2 with SEN Licence

To resolve security issue "Confluence - Path traversal vulnerability - CVE-2019-3398" i am force to upgrade Confluence, but i cant ugrade to none of the secure versions unless i pay new licence, and i cant work with this version because its insecure.

How can I work with the system if I cant upgrade and a cant stay in this version because of security issue?

it seems only fair to release some kind of fix for free

(not the temporary workarround)

Best regards

Daniel Eads

Hi Pedro,

The security advisory details how to mitigate the attack vector for this vulnerability. If you are not on a mitigated version and can't upgrade, using the "temporary workaround" is what you need to do. That is the fix for free.

From our licensing FAQ regarding security:

Your initial purchase entitles you to perpetual use of the software, and includes 12 months of software maintenance – access to new software releases/enhancements, our world-class Support team, critical bug fixes, and security patches – from the date of purchase. While renewing your software maintenance annually is optional, it is strongly encouraged in order to ensure continuous access to all of the benefits listed above.

Based on your license tier of 10 users, you are looking at a cost of $10 USD /yr to renew your support maintenance. You can get started renewing at my.atlassian.com and use the renewed license on a recent release of Confluence.

Cheers,
Daniel