Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Get started Tell me more

Atlassian Community about banner

4,462,888

Community Members

Community Events

176

Community Groups

log4j update

/app/atlassian/bitbucket/7.4.2/app/WEB-INF/lib/log4j-api-2.11.1.jar
/app/atlassian/bitbucket/7.4.2/app/WEB-INF/lib/log4j-to-slf4j-2.12.1.jar
/app/atlassian/bitbucket/7.4.2/elasticsearch/lib/log4j-api-2.11.1.jar
/app/atlassian/bitbucket/7.4.2/elasticsearch/lib/log4j-core-2.11.1.jar

Can I Update these log4j to an upper version like 2.16?

2 answers

1 accepted

1 vote

Answer accepted

No, it could well break Bitbucket, and it would render you unsupported.

I'm assuming this is in response to the CVE - see https://community.atlassian.com/t5/Trust-Security-articles/Atlassian-s-Response-to-Log4j-CVE-2021-44228 for the guidance on what to do.

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Reply

0 votes

what will happen if we delete these log4j files?

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Bitbucket will stop working.

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Like

How to upgrade log4j files to the 2.16 version?

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Like

You do not. You will need to upgrade your bitbucket

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Like

In bamboo latest version also uses log4j 2.9.0 file, how to remediate this?

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Like

Make sure none of the users can set up plans that could throw malicious code into the log file.

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Like

Hi Nic - How to monitor these new plans? What is the solution for the long-term fix?

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Like

Reply

Suggest an answer

Log in or Sign up to answer

Was this helpful?

Thanks!

DEPLOYMENT TYPE

SERVER

TAGS