Hello Support-Team
We use all Atlassian Based apps (automation, TeamCalender, Insight, Portfolio ...)
Can You explain me, what impact the https://tanzu.vmware.com/security/cve-2022-22965 has on your Jira/Confluence Server Apps.
Did you use Spring in your apps and did you use it, from the Atlassian Core-System or do you use a different Version? In case the your App is infected, in which timeframe we can expect an Update?
Best regards,
Roland Günther
Refer to the following FAQ: https://confluence.atlassian.com/kb/faq-for-cve-2022-22963-cve-2022-22965-1115149136.html
Hi Roland,
As Robert mentioned the FAQ in https://confluence.atlassian.com/kb/faq-for-cve-2022-22963-cve-2022-22965-1115149136.html has a response to these questions from our security team. It also links to how marketplace apps could potentially be affected over in https://community.developer.atlassian.com/t/attention-cve-2022-22965-spring-framework-rce-investigation/57172
In short, we have not yet found any of our Atlassian applications to be affected by this CVE. From our response:
No, Atlassian on-premises products are not vulnerable to any known exploit. Out of an abundance of caution, the following products that use impacted versions of Spring will be updated in accordance with our Data Center and Server Bug Fix Policy:
Regards,
Andy
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.