Is atlassian-bamboo-agent-installer-8.0.4.jar class log4j 2.9.0 vulnerable to CVE-2021-44228

Question

We had to extract the atlassian-bamboo-agent-installer-8.0.4.jar and to analyse for CVE-2021-44228 for our client.

What we found was that log4j 2.9.0 is in the atlassian-bamboo-agent-installer-8.0.4.jar/classpath.zip, but apparently its not an issue per Nexus-IQ.

Any idea if atlassian will be updating the atlassian-bamboo-agent-installer-8.0.4.jar ?

Below are the extracted findings of the bamboo agent installer jar

Alexey Chystoprudov · Answer

Old version was cached, it should be visible now

Ben Paul · Answer

Hi Alexey,

I still can't see any reference to Bamboo agents on the linked advisory?

Alexey Chystoprudov · Answer

Bamboo agents are not affected as well. Added it to advisory