Spring4Shell: Security Analysis of the latest Java RCE '0-day' vulnerabilities in Spring

[James Clarke]

Regarding the "spring4shell"  vulnerability  in https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/ .

Does anyone know that this vulnerability affects Atlassian products such like a Jira, Confluence? 

(As asked by Chihara in other groups there is no security advisory as yet hence asking the question in the recommended group) 

[John Smith]

Can anyone from Atlassian comment on this please? This is a major security event.

[Jodie Vlassis]

Please reference our FAQ for now, we do hope to have formal announcement soon:

https://confluence.atlassian.com/kb/faq-for-cve-2022-22963-cve-2022-22965-1115149136.html

[David Yu]

Is there a timeline or JAC bug we can follow along to see when patches will become available? Downgrading JDKs might not always be feasible for every customer.

[Jay Moczulski]

Hello, we have a very limited window to triage and mitigage critical vulnerabilities. With this case being critical, we are well past the triage period. Kindly advise your findings as soon as possible. Most of our vendors have already published information, as this has been in our radar for a few days now. Thank you! 

[Martha]

Seconded! Hurry up, Atlassian!

[Jodie Vlassis]

Update:

Please see the latest FAQs posted over the weekend: https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2022-22965

As always, you can monitor security vulnerabilities at the following link https://www.atlassian.com/trust/security/advisories

You can also report a vulnerability using this article https://www.atlassian.com/trust/security/report-a-vulnerability so Atlassian will provide an offical answer for that question.

We will continue to monitor the situation and provide a response soon.

Jodie