Dear customer,
On Thursday 9th December, developers and security researchers found a security vulnerability in Apache Log4j 2.
What you need to know
A security vulnerability was discovered in Apache Log4j 2. Log4j is a popular logging package for Java.
This is a security issue affecting a broad range of software based upon Java. Atlassian products such as Jira and Confluence run on Java and also utilize Log4j.
Atlassian products
Atlassian on-premise applications use an outdated version of Log4j and are not affected.
As of now, Atlassian issued no full Security Advisory. On 10th December, Atlassian put out a FAQ for this exploit under https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html
Data Center & Server
Our Security team is currently investigating the impact of the Log4j remote code execution vulnerability (CVE-2021-44228) and determining any possible impact on our on-premise products.
So far, we do not believe our on-premises products are vulnerable to exploitation in their default configuration. However, if a you have modified the default logging configuration (l
og4j.properties) to enable the JMS Appender functionality, remote code execution may be possible in the following products (Bitbucket Server & Data Center are not affected):
Jira Server & Data Center
Confluence Server & Data Center
Bamboo Server & Data Center
- Crowd Server & Data Center
Fisheye
Crucible
What should I do?
Your application is hosted with bitvoodoo
We have checked our installations according to the information in the FAQ. The installations have no configurations that could lead to misuse. As your Atlassian application uses the default configuration of Log4j, you are not affected by the exploit.
Third-party apps can still pose a risk. We cannot determine whether there is a risk in this respect in your installation. As we cannot speak for other app vendors, we cannot be sure that other apps are safe. You might need to get in touch with other Atlassian Marketplace vendors. Please contact our support if you need assistance.
We have checked our bitvoodoo apps and found them to be risk-free. You can find more information about our apps here: Log4Shell - bitvoodoo apps - 2021-12-13
You host your application yourself
If you have never customized the settings of Log4j inside the Atlassian installation, you are on the safe side. As your Atlassian application uses the default configuration of Log4j, you are not affected by the exploit.
If you have set Log4j to work with JMS Appenders or are unsure, follow the instructions "How can I mitigate this exploit?" in the FAQ for CVE-2021-44228.
Third-party apps can still pose a risk. We cannot determine whether there is a risk in this respect in your installation. As we cannot speak for other app vendors, we cannot be sure that other apps are safe. You might need to get in touch with other Atlassian Marketplace vendors, contact our support if you need assistance.
We have checked our bitvoodoo apps and found them to be risk-free. You can find more information about our apps here: Log4Shell - bitvoodoo apps - 2021-12-13
Further Reading
Support
If you still have questions or concerns regarding this advisory, please contact the bitvoodoo support via support.bitvoodoo.ch.
