Log4j vulnernerability in jira apps

[Ramakrishna Grandhi]

Hi, we've a jira server app and its .jar file. It has a dependency on log4j 1.2.6 indirectly i.e. we dont have the ref in pom.xml but one of the dependencies has it. Can someone advise on how to make this transitive dependency to latest log4j?

[Nic Brough -Adaptavist-]

The standard LDAP connection only pulls in the data that JIRA needs (name, email, password verification, and timezone).  So the short answer is that you can't, without coding something to fetch it from LDAP.

[rambabu patina]

Thanks you Nic for quick reply

[rambabu patina]

Hi Nic, And one more thing is, We are maintaining crowd and all users are coming form LDAP to the crowd. And we integrated jira with crowd, so all the users in the jira coming form crowd. As you said we cannot find the location of the user in the jira. This is clear to me. But is any way to get the location in crowd with API? Thanks, Rambabu

[Nic Brough -Adaptavist-]

I think you'd need to extend the LDAP connector in Crowd, as implied by https://confluence.atlassian.com/display/CROWD/LDAP+Object+Structures