Dear Atlassian Support-Team,
currently there is a critical vulnerability Critical vulnerability in log4j published (CVE-2021-44228) in Java issued by BSI with alert level red.
Could you please so be kind to let us know if your application "Sourcetree", that we have in use, is affected by this vulnerability and please answer the following questions:
- Is there already a patch for this application?
- If there is no patch, is there at least a workaround to temporarily close the vulnerability?
- What is the version of the log4j java module you are using ?
- Is it possible to update to a higher version of this log4j java module (version >= 2.15) ?
Attached is the link to the vulnerability reported by BSI:
https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2021/211211_log4Shell_WarnstufeRot.html
Thanks and regards
Valerian Lieder (IT)
