Hello,
I would like to ask you (in general) which applications from Atlassian platform are impacted by vulnerability CVE-2022-42889 and what is the statement from Atlassian.
Thank you a lot.
Jan
Ηι @Jan Milata
Please take a look at this https://community.atlassian.com/t5/Confluence-questions/Does-Confluence-server-7-13-7-use-Apache-Commons-Text-v-1-5-1-9/qaq-p/2167474 where a member of the Atlassian team replies. Currently Atlassian is investigating.
Hi Alex,
Thank you. I found this discussion earlier and also regarding Bamboo (https://community.atlassian.com/t5/Bamboo-questions/Does-Atlassian-bamboo-server-7-2-4-use-Apache-Commons-Text-ver-1/qaq-p/2165500).
I am looking for statement for all Atlassian applications in general.
@Jan Milata there isn't one yet. I would suggest to watch this page https://www.atlassian.com/trust/security/advisories for any news concerning CVEs affecting Atlassian products
I'm already monitoring that, but it is updated according to fixes (till August 2022 currently). Customers want to know impacts earlier than with patch.
Three weeks later, I still could not find any statement from Atlassian on the CRITICAL (score 9.8!) Text4Shell vulnerability CVE-2022-42889 - especially not on Atlassian Security Board nor the Atlassian Security Advisories.But at least the latest Jira 8 (v8.22.6) is affected: our OPS is going to shut down our JIRA instance due to findings of commons-text in the vulnerable versions 1.5, 1.6, 1.7, and 1.9!So why doesn't Atlassian take care of this problem?
BTW: there are only two "Jira" Jira-Issues by now - one for Bamboo, the other for Bitbucket. Both are claiming not to be affected. Still no Jira Software bug report for this issue?
Unfortunately, I can't create one on https://support.atlassian.com/ since our Jira instance is self-hosted.
Who can?!
https://community.atlassian.com/t5/Jira-questions/Re-Re-CVE-2022-42889/qaq-p/2173903/comment-id/554575#M554575
Ticket has been created for tracking...
[JRASERVER-74501] Upgrade Apache Commons-text for CVE-2022-42889 - Create and track feature requests for Atlassian products.
Would suggest watching, voting, and posting all updates/questions to the above ticket.
It looks like you're new here. Sign in or register to get started.
