Atlassian critical vulnerable. Which version I need to update?

Question

Hi. About vulnerable https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

We have two server instances with confluence. 7.16.1 and 7.1.0. Expired license.

Which version do I need to download for fixed it and without buying new licenses?

Nic Brough -Adaptavist- · Answer

Yes, Atlassian is building their tech on top of other things.  Almost everyone does.  If those things are compromised, then you need those things to be fixed.  You can't expect someone else who has built on it to fix it directly, they have no choice but to move on.

Atlassian is doing better than most suppliers of software here.  They are supporting a range of versions of their software, and they have fixed the latest version.

If you choose to work with an old version, that's fine, but it is your choice to do so and you can't expect a vendor to support an old version that they have explicitly stated that they will not support because it is too old.

The vulnerability in this case does look to be an Atlassian problem, and they have fixed it for everyone who currently has a supported licence.

Tony Montana · Answer

@Andy Heinzer This vulnerability is due to you. Why did we should pay for this update? Are you suggesting that we stop using Atlassian products?

Andy Heinzer · Answer

If your license is expired, then you cannot upgrade.  But you still could try to follow the mitigation steps in the security advisory to protect yourself.  Note: Confluence End Of Life versions are not fully tested with the workaround.