plugins affected by log4j vulnerability? CVE-2021-44228

Question

Hi,

could anyone help to find out if the following plugins are affected by the log4j vulnerability?
Or do I have to write to the manufacturers individually?

* Adaptavist ScriptRunner for JIRA (com.onresolve.jira.groovy.groovyrunner )
* Configuration Manager for JIRA (com.accxia.sd.plugins.tailor.tailorman-sd-confirm)
* Doublecheck for Jira Service Desk (com.accxia.sd.plugins.tailor.tailorman-sd-confirm )
* Elements Copy and Sync (formerly Exocet) (com.valiantys.jira.plugins.exocet.jira-plugin-exocet-pro)
* Structure (com.almworks.jira.structure)
* Custom Content for JIRA (com.tngtech.jira.plugins.customcontent.jira-gadget-custom-content )
* Integrity Check for JIRA (com.botronsoft.jira.rollout.integrity-check )
* Power Admin (com.botronsoft.jira.poweradmin)
* Configuration Manager Core Bundle (com.botronsoft.jira.rollout.configuration-manager-core)

thank you

Sebastian Pawlik from IT Team

Alex Berenfeld · Answer

Hi,

Apologies, did not see this post. I believe we confirmed this with your team via email but Doublecheck is not impacted by the Log4J vulnerability.

Thank you,

Alex

Mahdi Challouf · Answer

Dears,

We're using Jira Software DC version 8.20.6 with a list of add-ons, and the security team informed that there is vulnerabilities issue for log4j, I'm sure that the installed Jira version is not affected but is there a way please to check if any of the installed apps are affected?

Regards

IT-Team TraceTronic · Answer

still for information, apps also not affected:

Botronsoft.com apps:

* Configuration Manager for JIRA
* Configuration Manager Core Bundle
* Integrity Check for JIRA
* Power Admin

TNG Technology Consulting GmbH

* Custom Content for JIR