CVE-2021-44228 - log4shell, and CVE-2021-45046

Reference

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046

• https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

Summary

A vulnerability affecting the Java logging library Apache Log4j 2 has been publicly disclosed for versions 2.0.x to 2.15.0. On-premises Jira and Confluence instances, and by extension, our apps do not use the affected library. However, your instance may still be exposed depending on local configuration.

See the Atlassian FAQ for more:

Impact

All our apps use the platform provided log4j implementation which is 1.2.x, so are not vulnerable to this exploit.

Validation

We have performed our own validation using a proof-of-concept found online. We verified that the version of log4j shipped with Jira did not result in a replication when using the default logger configuration.

App-specific testing

As JEMH specifically processes user supplied content we have also verified that the exploit doesn’t work from email content with default configurations of log4j.

Our App log4j Dependencies

New releases of our apps will be specifically using log4j version 1.2.17-atlassian-13 (or higher) that is not vulnerable to these exploits. See below for app versions with this update:

Unaffected Apps

The following apps do not use log4j so are not applicable.

• Enterprise Mail Handler for Jira Cloud (JEMHC)

• SU for Bitbucket