Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
4,299,341
Community Members
 
Community Events
165
Community Groups

Log4J vulnerability

We have a self-managed instance of Bamboo, which is currently on version 8.1.3. Our security scans have picked up this version has log4j-1.2.15.jar (bundled in atlassian-nav-links-plugin-3.3.9.jar), which has multiple vulnerabilities (e.g. CVE-2021-44228). Atlassian has confirmed self managed instances that maintain fork of log4j-1.2.17.jar is not vulnerable for some of these (link below) but there's no mention of log4j-1.2.15.

https://confluence.atlassian.com/security/multiple-products-security-advisory-log4j-vulnerable-to-remote-code-execution-cve-2021-44228-1103069934.html#:~:text=Summary%20of%20Vulnerability%20Multiple%20Atlassian%20products%20use%20the,attacker%20controlled%20LDAP%20and%20other%20JNDI%20related%20endpoints.

Can you please advise if self-managed instances that maintain a fork of log4j-1.2.15.jar has any known vulnerabilities? Also advise if there's a way to update the log4j-1.2.15 to 1.2.17. Current version of Bamboo (8.2.3) doesn't seem to solve this issue.

Feel free to get back to me if you require further information. Thanks.

1 answer

1 vote

Hello @Rakhita_Kumarawadu,

We have a self-managed instance of Bamboo, which is currently on version 8.1.3. Our security scans have picked up this version has log4j-1.2.15.jar

Bamboo 8.1.3 bundles log4j-1.2.17-atlassian-15 and not log4j-1.2.15 -- Notice that the version is 1.2.17, whilst the patch is "-15".

If you are looking to update it to log4j-1.2.17-atlassian-16 (latest by today, 08/Jun/2022) you will need to upgrade Bamboo to any of the following versions as listed on the provided FAQ:

  • Bamboo 8.0.7
  • Bamboo 8.1.4
  • Bamboo 8.2.1

Kind regards,

Eduardo Alvarenga
Atlassian Support APAC

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Published in Bamboo

Bamboo Data Center on Kubernetes

Hi, If you are running self-managed environments and looking to adopt modern infrastructure, Bamboo Data Center can now be deployed in a Kubernetes cluster. By leveraging Kubernetes, you can easily...

965 views 3 8
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you