We didn't find string “org.apache.log4j.net.JMSAppender" in our server. Is it unaffected by Log4J?

Srijana Acharya

Hi Atlassian Support team,

We followed the steps to check our Jira & Confluence Server to identify the Log4J vulnerability. However, we just found the files with WEB-INF/lib/log4j2-stacktrace-origins-2.2-atlassian-2.jar where the String "org.apache.log4j.net.JMSAppender" was not examined. 

We further followed on the similar Question here: Solved: Is log4j2-stacktrace-origins-2.2-atlassian-2.jar v.. But the exact suggestion is not provided.

Thus, not finding the net.JMSAppender string means that the Server is out of Log4J risks?

Thanks a lot for the Support!

 

 

Jack Brickey

I would refer you to the following:

• Atlassian’s-Response-to-Log4j-CVE-2021-44228 
• Atlassian Support - if the above does not resolve your issue. Note - you need to be he technical contact to submit a ticket