CVE‑2023‑22523 & CVE‑2022‑1471 : unable to find further information nor when a patch is released

PNG Jira Lead

Atlassian has today emailed us alerting us to the following:

Jira Service Management Cloud, Data Center and Server
• CVE‑2023‑22523 – RCE vulnerability in Assets Discovery app
• CVE‑2022‑1471 – SnakeYAML library RCE vulnerability impacts multiple products (Data Center and Server only)

Jira Software and Jira Core Data Center and Server, Automation for Jira apps
• CVE-2022-1471 – SnakeYAML library RCE vulnerability impacts multiple products

 

However, doing the following searches at jira.atlassian.com

text ~ CVE‑2023‑22523

found nothing

 

For the next CVE:

text ~ CVE‑2022‑1471

also found nothing

 

and doing a general internet search across atlassian.com:

site:atlassian.com CVE‑2023‑22523

found nothing,

and for:

site:atlassian.com CVE‑2022‑1471

only shows up:

Trivy vulnerabiltiy scan of atlassian/jira-softwar...

 

Where could I go next to find out what Jira versions are affected, please, and monitor for any patches to be released?

Ste Wright

Hi @PNG Jira Lead 

The email should have links to the relevant pages - see all the links and advisories on this page: https://confluence.atlassian.com/security/security-advisories-bulletins-1236937381.html

Ste