How to fix Multiple Products Security Advisory - CVE-2022-26136, CVE-2022-26137

Question

currently, we running following products, How can we fix those two Vulnerabilities?

We are currently running:

Bamboo -  8.0.4

Bitbucket - 7.17.5

Confluence - 7.13.7

Crowd - 4.4.0

Jira - 8.20.10

Jira Service Management - 4.20.10

I am new for those products, could you give me the steps to fix,  Thanks

Sam Earnshaw · Answer

Your Confluence instance is not vulnerable, but I am in the same boat as you with the other systems. As there are no workarounds, I am planning to upgrade them ASAP and I would suggest you do the same.

Sebastian Krzewiński · Answer

Hi

If there is nothing about workaround I'm afraid that upgrade is the only way to fix it.

You can also talk with network/security engineers to block access to your instances from the Internet or you can talk with them about some solution that will prevent you any security issues (e.g. WAF for Azure or something similar).

Regards,

Seba

Alin Faur · Answer

Is there any chance for identifying a workaround that would only patch applications in their existing version instead of having to upgrade?