Regarding Log4j vulnerability

Semi Ara

Hi,

We blocked bitbucket.org access from our office network as per the Log4j IOCs, 

our RnD would like to access bitbucket.org for their development purposes, but we would like to make sure Log4j stuff is handled before allowing access to that site.

Can anyone confirm that the Log4j vulnerability is no longer a threat in bitbucket.org?

thanks

Semi

Alexis Robert

Hi @Semi Ara , 

 

Atlassian Cloud products, and specifically Bitbucket Cloud (accessed from bitbucket.org domain) are not vulnerable as Atlassian already took the necessary measures to mitigate this. You can see the official communication from Atlassian here : https://confluence.atlassian.com/security/multiple-products-security-advisory-log4j-vulnerable-to-remote-code-execution-cve-2021-44228-1103069934.html

 

This means that in you case, the Log4j vulnerability is no longer a threat.

 

Let me know if this helps, 

 

--Alexis