Regarding Log4j vulnerability

[Semi Ara]

Hi,

We blocked bitbucket.org access from our office network as per the Log4j IOCs, 

our RnD would like to access bitbucket.org for their development purposes, but we would like to make sure Log4j stuff is handled before allowing access to that site.

Can anyone confirm that the Log4j vulnerability is no longer a threat in bitbucket.org?

thanks

Semi

[Alexis Robert]

Hi @Semi Ara , 

Atlassian Cloud products, and specifically Bitbucket Cloud (accessed from bitbucket.org domain) are not vulnerable as Atlassian already took the necessary measures to mitigate this. You can see the official communication from Atlassian here : https://confluence.atlassian.com/security/multiple-products-security-advisory-log4j-vulnerable-to-remote-code-execution-cve-2021-44228-1103069934.html

This means that in you case, the Log4j vulnerability is no longer a threat.

Let me know if this helps, 

--Alexis