Has anyone been able to get a response from Atlassian or seen any press release or info about what Atlassian is doing about Apache Log4j2 vulnerability? I opened a ticket yesterday and because of the level of severity was shown we would be contacted within 2 hours. It's been a day.
They have the following FAQ page:https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html
There is also this page, which addresses 3rd-party apps:
https://confluence.atlassian.com/security/multiple-products-security-advisory-log4j-vulnerable-to-remote-code-execution-cve-2021-44228-1103069934.html
From what I can read, the version of log4j that Atlassian uses for on-prem systems is not vulnerable out of the box. If you are running on-prem, you can configure it to be vulnerable, but you have to perform multiple steps to do so. They have already mitigated the vulnerability in cloud, so it is no longer a concern. You can read up on it here: https://thejiraguy.com/2021/12/15/log4shell/
It looks like you're new here. Sign in or register to get started.
