Spring4Shell: Security Analysis of the latest Java RCE '0-day' vulnerabilities in Spring

[James Clarke]

Regarding the "spring4shell"  vulnerability  in https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/ .

Does anyone know that this vulnerability affects Atlassian products such like a Jira, Confluence? 

(As asked by Chihara in other groups there is no security advisory as yet hence asking the question in the recommended group) 

[Jodie Vlassis · Accepted solution]

Please reference our FAQ for now, we do hope to have formal announcement soon:

https://confluence.atlassian.com/kb/faq-for-cve-2022-22963-cve-2022-22965-1115149136.html

[David Yu]

Is there a timeline or JAC bug we can follow along to see when patches will become available? Downgrading JDKs might not always be feasible for every customer.

[Jodie Vlassis · Accepted solution]

Update:

Please see the latest FAQs posted over the weekend: https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2022-22965

As always, you can monitor security vulnerabilities at the following link https://www.atlassian.com/trust/security/advisories

You can also report a vulnerability using this article https://www.atlassian.com/trust/security/report-a-vulnerability so Atlassian will provide an offical answer for that question.

We will continue to monitor the situation and provide a response soon.

Jodie

[Jay Moczulski]

Hello, we have a very limited window to triage and mitigage critical vulnerabilities. With this case being critical, we are well past the triage period. Kindly advise your findings as soon as possible. Most of our vendors have already published information, as this has been in our radar for a few days now. Thank you! 

[Martha]

Seconded! Hurry up, Atlassian!

[John Smith]

Can anyone from Atlassian comment on this please? This is a major security event.