Does Confluence server 7.13.7 use Apache Commons Text (v 1.5-1.9), per CVE-2022-42889?

[Tony Simon]

Is Apache Commons Text used in Confluence server 7.13.7? If so, how can we remediate? Thank you!

[Srinatha Tondihal · Accepted solution]

Hi @Tony Simon ,

Welcome to Atlassian community. 

Confluence 7.13.7 uses commons-text-1.8.jar. At this stage there’s no indication whether arbitrary code execution is possible  and security team at Atlassian is already investigating this. So please await for an official announcement from Atlassian . 

Thanks,

Srinath T

[Priya Ayyadevara]

Hi Srinatha,

Is there an update on this ?

Cheers

Priya

[cdenboer]

I opened a case and received the message that there is nothing found by Atlassian that confluence is vulnerable. 

[cdenboer]

Why not here so anybody can learn from it?

[Srinatha Tondihal]

Hi @Priya Ayyadevara ,

Can you please open a support ticket for this.

Thanks,

Srinath T 

[David Pasternak]

Is it really needed that every customer has to create a support ticket for an official Bug? Wouldn't it be better, when Atlassian post a message for ALL?