CVE-2022-26134 and confluence server version 5.1.5

[Danijel Pavlovic]

Hi ,

So given that the jar/class file workaround is compiled on Java 8 is it possible to get the files compiled for at least java 7 so that we can implement the workaround on earlier versions that aren't able to upgrade to java8?

Files that would require to be recompiled-

• xwork-1.0.3-atlassian-10.jar

• webwork-2.1.5-atlassian-4.jar

• CachedConfigurationProvider.class

[Nic Brough -Adaptavist-]

I'm afraid not, you are way out of support, by many years, and your only option to become secure is to upgrade to a supported version of Confluence, on a secure and supported version of Jave, not try to mess around with bits of old libraries.