log4j2 vulnerability CVE-2021-44228

[Bakiyaraj Periyasamy]

Hi Team,

We are using Jira version which has “log4j2-stacktrace-origins-2.2-atlassian-2.jar” installed in lib. Is this version of jar impacted because of  log4j2 vulnerability CVE-2021-44228?

If it is impacted, what is the remediation ? is there any workaround?

Thanks

Baki

[Daniel Eads]

Hi all,

Daniel with Atlassian Support here to let you know our security team has finished its investigation. We have an official response statement here on Community, which you can access at this link.

More information can be found on our advisory page, as well as the previously-published FAQ:

• https://confluence.atlassian.com/display/SECURITY/Multiple+Products+Security+Advisory+-+Log4j+Vulnerable+To+Remote+Code+Execution+-+CVE-2021-44228
• https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html

Thanks,
Daniel Eads | Atlassian Support

[ITS Admin GVPL]

Thanks Daniel,

We don't find the line containing: org.apache.log4j.net.JMSAppender

But for the above question asked by Bakiyaraj, I don't see a direct answer in those solutions provided by you.

We also find : log4j2-stacktrace-origins-2.2-atlassian-2.jar  installed.

Are we affected ?

Kindly advise.

Thanks,

Hariharan

[Hieu]

<dependencies>
    <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-api</artifactId>
        <version>1.7.7</version>
        <scope>provided</scope>
   </dependency>
</dependencies>

extract the jar file, I saw that in this jar, Atlassian use log4j 1.7.7, so I don't think we have to adjust some things

[Nikki Zavadska _Appfire_]

HI @Bakiyaraj Periyasamy

You can find all updates related to Log4J vulnerability on this FAQ page 👉 https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html

[Nikki Zavadska _Appfire_]

If you find a line containing the org.apache.log4j.net.JMSAppender, you may be vulnerable. If you do not find a line containing the org.apache.log4j.net.JMSAppender, you do not have this specific vulnerable configuration.

[Kishan Sharma]

Hi @Bakiyaraj Periyasamy You can read this FAQ related to the log4j zero-day, hopefully it will help address some initial questions you may have.