Upgrade Jira's Log4j 1.2.x.jar to Log4j 2.17.0.jar

Jeawoong Choi

Hello

I checked Log4j's vulnerability in Jira. So I delivered the information to the company's security team, and the company's policy was instructed to upgrade Log4j to version 2.17.0
So I'm going to upgrade it. Is there any problem? Or, please check if there is anything else to guide.

 

Thanks.

Kurt Klinner

@Jeawoong Choi 

 

Jira Server and Data Center use a Atlassian-maintained fork of Log4j 1.2.17, which is not vulnerable to CVE-2021-44228, see also https://confluence.atlassian.com/security/multiple-products-security-advisory-log4j-vulnerable-to-remote-code-execution-cve-2021-44228-1103069934.html

As for CVE-2021-45046 and CVE-2021-45105 Atlassian is going to upgrade to log4j 2.17.0 (or greater) in line with the timeframes detailed in the Atlassian Security Bugfix Policy i think you should wait for the new versions to be provided by Atlassian

 

Cheers

Kurt