Is Jira Software Data Center (on-prem) vulnerable to CVE-2019-17571 ?

[jy]

Based on https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html

The following products use the Atlassian-maintained fork of Log4j 1.2.17:

Jira Software and Data Center

How does it mitigate and resolve against this critical vulnerability which affect log4j1.2.17?

https://nvd.nist.gov/vuln/detail/CVE-2019-17571

Does Atlassian not intend to upgrade their log4j to 2.17.0 or 2.17.1?

[Fabio Racobaldo _Herzum_]

Hi @jy ,

in order to mitigate that security issue you should disable JMSAppender as specified in the linked article.

Btw, Atlassian says that they forked log4j 1.2.17 (in 1.2.17-atlassian-3) in order to delete the code affected. Therefore, JIRA is not vulnerable to CVE-2019-17571.

Please take a look to the following issue https://jira.atlassian.com/browse/JRASERVER-62838

Hope this helps,

Fabio