Regarding the "spring4shell" vulnerability in https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/ .
Does anyone know that this vulnerability affects Atlassian products such like a Jira, Confluence? (As asked by Chihara in other groups there is no security advisory as yet hence asking the question in the recommended group)
Can anyone from Atlassian comment on this please? This is a major security event.
Please reference our FAQ for now, we do hope to have formal announcement soon:
https://confluence.atlassian.com/kb/faq-for-cve-2022-22963-cve-2022-22965-1115149136.html
Hello, we have a very limited window to triage and mitigage critical vulnerabilities. With this case being critical, we are well past the triage period. Kindly advise your findings as soon as possible. Most of our vendors have already published information, as this has been in our radar for a few days now. Thank you!
Seconded! Hurry up, Atlassian!
Update:Please see the latest FAQs posted over the weekend: https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2022-22965
As always, you can monitor security vulnerabilities at the following link https://www.atlassian.com/trust/security/advisories
You can also report a vulnerability using this article https://www.atlassian.com/trust/security/report-a-vulnerability so Atlassian will provide an offical answer for that question.
We will continue to monitor the situation and provide a response soon.
Jodie
Is there a timeline or JAC bug we can follow along to see when patches will become available? Downgrading JDKs might not always be feasible for every customer.
It looks like you're new here. Sign in or register to get started.
