About Log4j Security Vulnerability

[Suman ragi]

Please check and let us know the Confluence product is impacted with Log4j Security Vulnerability or not ? and current Confluence Version 37.4.9we are using.

[Tom Lister]

This post should help

https://community.atlassian.com/t5/Trust-Security-articles/Atlassian-s-Response-to-Log4j-CVE-2021-44228/ba-p/1886598

[Daniel Eads]

Hi @Suman ragi ,

While Confluence 7.4.9 is not vulnerable to CVE-2021-44228, there are a couple other advisories in recent months that do affect that version:

• Confluence Server and Data Center - CVE-2021-26084 - Confluence Server Webwork OGNL injection 
• Multiple Products Security Advisory - Unrendered unicode bidirectional override characters - CVE-2021-42574 

At your earliest convenience, I would recommend upgrading to Confluence 7.4.14 (the latest long-term support version in the 7.4 line) to mitigate these other two.

Cheers,
Daniel | Atlassian Support

[Kishan Sharma]

Hi @Suman ragi Welcome to the Atlassian Community! You can also refer below posts for more information

• https://confluence.atlassian.com/display/SECURITY/Multiple+Products+Security+Advisory+-+Log4j+Vulnerable+To+Remote+Code+Execution+-+CVE-2021-44228
• https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html