Log4j vulnerability

Question

Hi,

We were asked to remove log4j-core.jar and other log4jXXX.jar related files from Confluence ,JIRA & GIT servers.

Kindly confirm if there is any impact to the application if they ask us to remove these files due to log4j vulnerability.

Let us know if you need the path where these files are available

Guru Darbar · Answer

Would it break the application if you replaced the offending .jar files with the updated ones from Apache?

https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/2.17.1/log4j-core-2.171.jar

and

https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-api/2.17.1/log4j-api-2.17.1.jar

If that works, then the applications would pass a CVE audit.

Kishan Sharma · Answer

Hi @Sandeep Vellore

Atlassian Security team investigated the impact of the Log4j remote code execution vulnerability (CVE-2021-44228) and have determined that no Atlassian on-premises products are vulnerable to CVE-2021-44228.

So you don't need to remove the log4j.jar files. You can check if you are vulnerable by inspecting the Log4j configuration file. If you find a line containing the org.apache.log4j.net.JMSAppender, you may be vulnerable. If you do not find a line containing the org.apache.log4j.net.JMSAppender, you do not have this specific vulnerable configuration. I would suggest you to go through FAQ as well for more details.

Pramodh M · Answer

Hi @Sandeep Vellore

Don't remove the jar files, the issue has already been fixed. You just need to upgrade the servers to a fixed version or the latest version if it's possible for you

Please find the reference here

https://confluence.atlassian.com/security/multiple-products-security-advisory-log4j-vulnerable-to-remote-code-execution-cve-2021-44228-1103069934.html

Thanks,
Pramodh