log4j impact on bamboo plugins

Question

Hi

pls provide the impact of log4j issue on below bamboo plugins

Stellarity SoftwarePowerShell Task for Bamboo (Server)AutoTestingToolsUFT for Bamboo for Bamboo (Server)Mibex Software GmbHSonar for Bamboo for Bamboo (Server)

Sergey Podobry _Stellarity Software_ · Answer

PowerShell Task for Bamboo (Server) uses Bamboo's log4j facility and doesn't make any changes to it, adds JMS Appender or includes javax.jms API in the CLASSPATH. So you're safe unless someone has write access to the Bamboo's log4j.properties file.

Also read FAQ for CVE-2021-44228 from Atlassian.

Roman Stoffel · Answer

Exactly, most apps will use Bamboo's logging infrastructure, so the Atlassian report applies.

This applies for our Sonar for Bamboo Server as well.

Nic Brough -Adaptavist- · Answer

Apps are affected because they use Bamboo's log4j implementation, they don't re-invent the wheel.

See https://community.atlassian.com/t5/Trust-Security-articles/Atlassian-s-Response-to-Log4j-CVE-2021-44228/ba-p/1886598 for more.