Andy Heinzer Atlassian Team

Yes this vulnerability applies to Windows editions as well. The files you mentioned are the replacement files. Not the files that are currently on your system. You need to download those specific files you mentioned from the Advisory itself. Then remove the existing files with similar (but not exactly the same names). Then…

The release notes in question explain that starting in 8.8.0, Jira Software now allows for future sprint start dates. Before the 8.8.0 version, you could not set the start date of a sprint, unless you clicked the start sprint button, which would then begin the sprint. If you clicked that button in older versions, it would…

The terms of server licensing only permit you to upgrade to versions released during the term of your support maintenance. If your server license expires, and then any new version is released, you won't be able to upgrade to it, even if it happens to be within the same minor version release numbering. (say from 7.13.0 to…

I recommend upgrading to a 7.13.x version as it will contain the fix for https://jira.atlassian.com/browse/CONFSERVER-61266 But more specifically, upgrade to 7.13.7 as this also contains the fix for the more recent Advisory. Plus this version is part of our Long term support releases, which ensures this minor version will…

@Adrian Kuijpers this article you commented on pertains only to Confluence Cloud. However as the recent CVE advisory states, that CVE only pertains to Confluence Server and Confluence Data Center. Confluence Cloud is not affected by that CVE. Updated versions of the server and data center editions have been shipped as of…

Sorry to hear about this problem. But your suspicion about the database versions is most likely correct. This version of Confluence does not support Postgres 12 yet. Please see Confluence 7.13 Supported Platforms for a complete list of the supported platforms. As for next steps, I'd recommend setting up a Postgres 11…

There are steps to follow in Upgrading Confluence Manually that explain the necessary versions to upgrade to in sequence. It would require multiple upgrades in order to get that data onto a supported platform.

Hi @Gaurav Aggarwal I took a closer look at this with my own Bitbucket and Jira integration. The problem here is that some elements of the pull request can be amended, such as title or description, but other elements cannot, such as branch name. At least in my own case, even if I decline this pull request, and then even go…

Please visit https://my.atlassian.com/ I can see that your account does have a valid and active server license. You might need to obtain the updated license key from that site and apply it to your site in order to be able to complete this upgrade. Andy

Unfortunately, no. Even these very old versions are susceptible to this vulnerability. The Advisory itself does provide some mitigation steps for more recent versions. You might be able to reduce the risk by restricting network access to this Confluence application. But give the nature of a RCE (Remote code execution) type…

Sorry to hear that. I found that this address was also within another suppression system. I have removed that as well. Please try once more. Andy

Hi @Héctor Leal I found that email address on our suppression list. I have removed it from that list. Try to resend the verification email once more now. You should be able to receive it now.

Hi Triston, I believe this is something that could be done with an app like Scriptrunner for Confluence. I personally have not used this app, but it appears to offer the ability to auto create Jira issues based on new page creation. So perhaps it can be adjusted to new comments within a specific space. There also might be…

Hi Addison, I understand that you are looking into the AO table of a Jira Server/DC database, and are interested to understand why many sprints listed there have a null value for the activated_date field. I had to do a bit of digging to find this answer, but I think I have located it. This field was not always in existence…

@Venkata Mangipudi Please create a technical support request by visiting https://support.atlassian.com/contact/ I recommend that you have a billing or technical contact of your Confluence server license open a support case. Otherwise users that are not listed within the SEN could be redirected back here to Community. For…

Hi @Chris Howard The advisory recommends that you upgrade Confluence as a long term fix for this vulnerability. However the mitigation steps in the advisory are not how you upgrade Confluence. For instructions with that, you might want to see Upgrading Confluence. The mitigation steps in the advisory are intended to…

@Dom I was not able to find your address on the suppression list. From our end it appears that mail is being delivered to your mailbox. You might need to reach out to your mail administrator for more help here, but I also found that your team mate created this support case for additional help…

There are different workarounds steps depending on your version. Those are the steps for 7.15 and higher versions. But the advisory also contains a different workaround steps for 7.0.0 - 7.14.x versions. Search for the phrase For Confluence 7.0.0 - Confluence 7.14.2 and you will find slightly different mitigation steps for…

Sorry to hear about this problem. Sometimes user email addresses can be added to a suppression list. Could you please let me know the email address in question here? With that information we can remove this block or investigate further. Andy

Hi Melanie, I understand that some users are not receiving email invitations in a timely manner. I have not encountered this particular problem, but this will be very difficult to troubleshoot just within our Community site. I would recommend that you reach out to one of your site-admins, and ask that they create a support…

I'm not sure I understand your question. If you are running 7.4.6, this version is vulnerable as per the recent security advisory for Confluence Server and Data Center. We recommend upgrading to a version that contains this fix, such as 7.4.17. Confluence 7.4.x is the previous generation of our Long Term Support releases,…

@fidel dali Those versions are at End Of Life (EOL). Please see our EOL policy, it explains that we do not offer support on these EOL versions. Based on the upgrading documentation guide, if the software maintenance period included in your license has expired, you can keep using Confluence, but you'll need to renew before…

Hi Pradeep, Please see the advisory for complete details. Confluence Cloud is not affected. Confluence Server and Confluence Data Center are affected. Updated versions have been released on Friday of last week.

If your license is expired, then you cannot upgrade. But you still could try to follow the mitigation steps in the security advisory to protect yourself. Note: Confluence End Of Life versions are not fully tested with the workaround.

Correct, 7.16.3 is still vulnerable. Please upgrade to 7.16.4 in order to resolve this.

Hi Patrick, The release notes for 7.16.4 are linked on that page, https://confluence.atlassian.com/doc/issues-resolved-in-7-16-4-1137639706.html You can also find the downloads and release notes within the download archives page.

Hi I don't know of means to manually integrate Jira with Power BI. However there are several options within our Marketplace, try this search link https://marketplace.atlassian.com/search?hosting=cloud&product=jira&query=power%20bi I hope that helps. Andy

Hi Frank, If the Confluence instance cannot be accessed from the general internet, the risk of an exploit/attack originating from there is negated. However, out of an abundance of caution, the guidance on the Confluence Security Advisory page for CVE-2022-26134 still applies, even for these End of Life (EOL) versions. Due…

Hi Drew, I've seen this problem before. I think the root cause is in regards to team-managed projects having a separate, and second "Story Points" field. This causes a lot of confusion for automation when having to then copy this field. I suspect that the field you entered this value to, is not actually the…

If the Confluence instance cannot be accessed from the general internet, the risk of an exploit/attack originating from there is negated. However, out of an abundance of caution, the guidance on the Confluence Security Advisory page for CVE-2022-26134 still applies. Due to the critical nature of this vulnerability and the…