Spring Framework

Roland Günther
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
April 6, 2022

Hello Support-Team

We use all Atlassian Based apps (automation, TeamCalender, Insight, Portfolio ...)

Can You explain me, what impact the https://tanzu.vmware.com/security/cve-2022-22965 has on your Jira/Confluence Server Apps.
Did you use Spring in your apps and did you use it, from the Atlassian Core-System or do you use a different Version? In case the your App is infected, in which timeframe we can expect an Update?

Best regards,
Roland Günther

2 answers

1 vote
Robert Wen_ReleaseTEAM_
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
April 6, 2022
0 votes
Andy Heinzer
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
April 7, 2022

Hi Roland,

As Robert mentioned the FAQ in https://confluence.atlassian.com/kb/faq-for-cve-2022-22963-cve-2022-22965-1115149136.html has a response to these questions from our security team.  It also links to how marketplace apps could potentially be affected over in https://community.developer.atlassian.com/t/attention-cve-2022-22965-spring-framework-rce-investigation/57172

In short, we have not yet found any of our Atlassian applications to be affected by this CVE.  From our response:

No, Atlassian on-premises products are not vulnerable to any known exploit. Out of an abundance of caution, the following products that use impacted versions of Spring will be updated in accordance with our Data Center and Server Bug Fix Policy:



Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events