About Log4j Security Vulnerability

Question

Please check and let us know the Confluence product is impacted with Log4j Security Vulnerability or not ? and current Confluence Version 37.4.9we are using.

Daniel Eads · Answer

Hi @Suman ragi ,

While Confluence 7.4.9 is not vulnerable to CVE-2021-44228, there are a couple other advisories in recent months that do affect that version:

* Confluence Server and Data Center - CVE-2021-26084 - Confluence Server Webwork OGNL injection 
* Multiple Products Security Advisory - Unrendered unicode bidirectional override characters - CVE-2021-42574

At your earliest convenience, I would recommend upgrading to Confluence 7.4.14 (the latest long-term support version in the 7.4 line) to mitigate these other two.

Cheers,
Daniel | Atlassian Support

Kishan Sharma · Answer

Hi @Suman ragi Welcome to the Atlassian Community! You can also refer below posts for more information

* https://confluence.atlassian.com/display/SECURITY/Multiple+Products+Security+Advisory+-+Log4j+Vulnerable+To+Remote+Code+Execution+-+CVE-2021-44228
* https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html

Tom Lister_fo1j4e · Answer

This post should help

https://community.atlassian.com/t5/Trust-Security-articles/Atlassian-s-Response-to-Log4j-CVE-2021-44228/ba-p/1886598