CVE-2021-44228 CLASSPATH

[José Ladeira de Lima Silva]

Regarding your FAQ:

https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html

when you say:

• The javax.jms API is included in the application's CLASSPATH

Which application are you referring to?  Is the JAVA application's CLASSPATH or Bamboo/Atlassian's CLASSPATH ?

As far as I know the JAVA CLASSPATH in Ubuntu is something like /usr/lib/jvm/java-8-openjdk-amd64/jre/lib where the JAR files are.  However in the Bamboo directory we can also find JAVA JAR files in ./atlassian-bamboo-8.0.0/atlassian-bamboo/WEB-INF/lib/.

I'm asking this because I'm not sure which is the CLASSPATH we should look for the javax.jms API

Thank you

[Alexey Chystoprudov · Accepted solution]

Both

[José Ladeira de Lima Silva]

Thank you !