I wonder to know the impact of CVE vulnerabilities: CVE-2019-17571 , CVE-2020-9488

Question

Dear Sirs

My customer has a Jira Server 7.2.2 installation. The log4j library version installed in is 1.2.16. Associated with this version there was two vulnerabilities CVE-2019-17571  and CVE-2020-9488.

Is there any type of affection on Jira with both vulnerabilities?

If so, could you provide me with the workarround to fix them?

Thank you very much!

Best regards

Francisco Villena · Answer

Thanks @Thomas Clemens

It could be any incompatibility by using Log4j  1.2.17-atlassian-3 in a Jira Server 7.2.2)?, I don´t think so, but if the case any of you have got any problems when installing that version of log4j.

Thanks!

Thomas Clemens · Answer

I don't think the Answer has anyting to do with the vulnerabilities fvillena asked about.

@Francisco Villena

I checked the exact Version of Log4j wich was used in our Version of Confluence & jira. In our case, it was 1.2.17-atlassian-3 wich is the atlassian Branch, wich was the fix for CVE-2019-17571. I will have to go and check the 2020 one, but you will proberbly find the answer with the help of the Web-Search whos name may not be said out loud. Merry new Year!

Aron Gombas _Midori_ · Answer

See the official advisory here:

https://confluence.atlassian.com/security/multiple-products-security-advisory-log4j-vulnerable-to-remote-code-execution-cve-2021-44228-1103069934.html