Log4j vulnernerability in jira apps

[Ramakrishna Grandhi]

Hi, we've a jira server app and its .jar file. It has a dependency on log4j 1.2.6 indirectly i.e. we dont have the ref in pom.xml but one of the dependencies has it. Can someone advise on how to make this transitive dependency to latest log4j?

[Nic Brough -Adaptavist- · Accepted solution]

Yes. Groovy really is very powerful because it can use most of the internals, and should only ever be used by administrators (because you can, in theory, trust them to know how to avoid doing any damage with it)

You may find it safer to let them work with a dev/test system as an admin, and then promote their work when you've proved it's ok.

[Ryan O Sullivan]

Thanks Nic, thought as much