Spring Framework

[Roland Günther]

Hello Support-Team

We use all Atlassian Based apps (automation, TeamCalender, Insight, Portfolio ...)

Can You explain me, what impact the https://tanzu.vmware.com/security/cve-2022-22965 has on your Jira/Confluence Server Apps.
Did you use Spring in your apps and did you use it, from the Atlassian Core-System or do you use a different Version? In case the your App is infected, in which timeframe we can expect an Update?

Best regards,
Roland Günther

[Robert Wen_ReleaseTEAM_]

Refer to the following FAQ: https://confluence.atlassian.com/kb/faq-for-cve-2022-22963-cve-2022-22965-1115149136.html

[Andy Heinzer]

Hi Roland,

As Robert mentioned the FAQ in https://confluence.atlassian.com/kb/faq-for-cve-2022-22963-cve-2022-22965-1115149136.html has a response to these questions from our security team.  It also links to how marketplace apps could potentially be affected over in https://community.developer.atlassian.com/t/attention-cve-2022-22965-spring-framework-rce-investigation/57172

In short, we have not yet found any of our Atlassian applications to be affected by this CVE.  From our response:

No, Atlassian on-premises products are not vulnerable to any known exploit. Out of an abundance of caution, the following products that use impacted versions of Spring will be updated in accordance with our Data Center and Server Bug Fix Policy:

Regards,

Andy