Is version 7.5.1 vulnerable to log4j exploit?

[Robert Eanes]

Is version 7.5.1 vulnerable to log4j exploit?

[Daniel Eads]

Hi all,

Daniel from Atlassian Support - I'd like to let you know that we have updated the advisory to include more information about Bitbucket Server, Bitbucket Data Center, and the bundled elasticsearch product. Please refer to the advisory for the most current guidance:

• https://confluence.atlassian.com/security/multiple-products-security-advisory-log4j-vulnerable-to-remote-code-execution-cve-2021-44228-1103069934.html 

Thanks,
Daniel Eads | Atlassian Support 

[Fabio Racobaldo _Herzum_]

Hi @Robert Eanes ,

B

itbucket is NOT affected.

https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html

I see Bitbucket Server/Data Center isn't in the list of products using Log4j but I can see Log4j JAR files in my installation directory, is my instance vulnerable?

No. Neither Bitbucket Server nor Data Center use Log4j, they use Logback.

Hope this helps,

Fabio

[Craig Castle-Mead]

Bitbucket allows you to run an external Elasticsearch environment instead of the bundled version, so ensure you check the Elasticsearch config/version/exposure as well as the main product.

CCM