CVE-2022-26136, CVE-2022-26137 - Which version is affected / not affected?

[Manuel Ruiz]

Hi,

as i can see in https://confluence.atlassian.com/security/multiple-products-security-advisory-cve-2022-26136-cve-2022-26137-1141493031.html our used jira & confluence versions are listed in "affected" and also in "fixed" version. So what is to do? Are we affected or not?

We are using confluence 7.13.7 and jira 8.20.7

Affected:

• confluence 7.13.x < 7.13.7

  • or is the meaning "lower than 7.13.7 but not 7.13.7"?

• jira 8.20.x < 8.20.10

  • 8.20.7 is between those values...BUT

Fixed:

• 7.13.x >= 7.13.7
  • How can 7.13.x till 7.13.7 be in the fixed list when its also in the affected list?
• 8.20.x >= 8.20.10 
  • 8.20.7 is also between those values...? So, affected, not affected? Maybe affected?

Can anybody translate this table into simple version information like "fixed since x.x.xx"? As i can see in the changelog there is also no fix information about the cve in the last versions.

Best Regards

Manuel

[Payne]

Confluence is fixed since 7.13.7

Jira is fixed since 8.20.10

"x" is being used as a placeholder. For Confluence:

Affected 7.13.x < 7.13.7 means 7.13.0, 7.13.1, ..., 7.13.6

Fixed 7.13.x >= 7.13.7 means 7.13.7, 7.13.8, ...

For Jira:

Affected 8.20.x < 8.20.10 means 8.20.0, 8.20.1, ..., 8.20.9

Fixed 8.20.x >= 8.20.10 means 8.20.10, 8.20.11, ...

[Manuel Ruiz]

This placeholder make absolut no sense, but, however, thanks.