Sourcetree Log4j vulnerability

[Val Lieder]

Dear Atlassian Support-Team,

currently there is a critical vulnerability Critical vulnerability in log4j published (CVE-2021-44228) in Java issued by BSI with alert level red.
Could you please so be kind to let us know if your application "Sourcetree", that we have in use, is affected by this vulnerability and please answer the following questions:

- Is there already a patch for this application?

- If there is no patch, is there at least a workaround to temporarily close the vulnerability?

- What is the version of the log4j java module you are using ?

- Is it possible to update to a higher version of this log4j java module (version >= 2.15) ?

Attached is the link to the vulnerability reported by BSI:
https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2021/211211_log4Shell_WarnstufeRot.html

Thanks and regards
Valerian Lieder (IT)

[Natchiar Venkatachalam]

SourceTree is not using log4j an hence is not affected by this vulnerability.