log4j vulnerability

[Dabin Daniel Sundaram]

Do the confluence version 7.4.1 is vulnerable to log4j.

[Ollie Guan]

Hi @Dabin Daniel Sundaram ,

Impact on On-Premises Products

No Atlassian on-premises products are vulnerable to CVE-2021-44228.

Some on-premises products use an Atlassian-maintained fork of Log4j 1.2.17, which is not vulnerable to CVE-2021-44228.

https://community.atlassian.com/t5/Trust-Security-articles/Atlassian-s-Response-to-Log4j-CVE-2021-44228/ba-p/1886598

[Kishan Sharma]

Hi @Dabin Daniel Sundaram 

In addition to what Ollie mentioned, you can find more information on advisory page and the previously-published FAQ:

• https://confluence.atlassian.com/display/SECURITY/Multiple+Products+Security+Advisory+-+Log4j+Vulnerable+To+Remote+Code+Execution+-+CVE-2021-44228
• https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html