Log4j upgrade in Jira / JSM - EAP available

[#1]

G’day ya'll,

As you may have heard we’re going to release the upgrade to Log4j 2 with Jira 9.5 / JSM 5.5. We’ve recently released a 9.5 / 5.5 EAP that you can use to test and adapt your apps / integrations to ensure that they are compatible with the new version of Log4j.

Here are some resources that we hope you’ll find useful:

• Preparing for Jira 9.5 / JSM 5.5
• Log4j upgrade details for third-party vendors 3
• EAP source files. Alternatively, if you use maven.atlassian.com, grab milestone 9.5.0-m0003.

We’re letting you know about this so that you have enough time for testing your apps and sharing feedback. More information about the features and fixes that’ll become part of the 9.5 / 5.5 release will be available at a later stage.

A Jira EAP delivered so soon doesn’t mean we’re skipping release 9.4 / 5.4.

It’s on our roadmap. Stay tuned!

Cheers,

Andrzej Kotas

[Babu R]

It would be great if we can get it released along with upcoming LTS version.

[Andrzej Kotas]

Hey Babu,

since the Log4j upgrade is a breaking change, that will have impact on integrations and plugins, it is not considered to be backported to the 9.4 / 5.4 version. 

9.4/ 5.4 will keep the non vulnerable, patched version of atlassian/log4j1. For more details, check the source code of the forked library on the atlassian/log4j1 project page and the list of security vulnerabilities addressed in atlassian/log4j1

Log4j2.x will be available with the 2023 LTS.