Log4j Vulnerability CVE-2021-45046

[Jayachandran Palanisamy]

Team,

Do you have any update reg. this vulnerability?
https://nvd.nist.gov/vuln/detail/CVE-2021-45046

I m not able to see any updates reg. that in this KB since it's relevant to CVE-2021-44228
https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html

/Jay

[Daniel Ebers]

Please also review https://jira.atlassian.com/browse/JRASERVER-62838 where you can see the progress of a version 2 implementation for Log4j within Atlassian products.
As of today, version 2 is not available but a special patched version of Log4j is used with Jira, for example.

[Daniel Eads]

Hi all,

Daniel from Atlassian Support - I'd like to let you know that we have updated the advisory to include more information about Bitbucket Server, Bitbucket Data Center, and the bundled elasticsearch product. Please refer to the advisory for the most current guidance:

• https://confluence.atlassian.com/security/multiple-products-security-advisory-log4j-vulnerable-to-remote-code-execution-cve-2021-44228-1103069934.html 

Thanks,
Daniel Eads | Atlassian Support 

[Chihara]

There are 2 log4j-core-2.x libraries in Bitbucket 7.18. One is app/WEB-INF/lib/log4j-core-2.14.1.jar and the other is elasticseach/lib/log4j-core-2.11.1.jar and  JNDILookup.class in them.

Does anyone knows if Bitbucket is not affected for CVE-2021-45046 or not?

[Brendan St-Martin]

Based on the previous responses that on-prem versions of Jira/Confluenc/etc. use a forked version of log4j1 then they should be clear of CVE-2021-45046 also, as per the apache log4j security page: "Log4j 1.x mitigation: Log4j 1.x is not impacted by this vulnerability."

[Kishan Sharma]

Hi @Jayachandran Palanisamy 

Here's an official response statement from Atlassian on Community

You can also find more information on the previously-published FAQ:

• https://confluence.atlassian.com/display/SECURITY/Multiple+Products+Security+Advisory+-+Log4j+Vulnerable+To+Remote+Code+Execution+-+CVE-2021-44228
• https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html

[Mikael Sandberg]

Please refer to this thread for all the details, https://community.atlassian.com/t5/Trust-Security-articles/Atlassian-s-Response-to-Log4j-CVE-2021-44228/ba-p/1886598