Update on CVE-2021-44228

[Sharda GUPTA]

Hi team,

‌

Please confirm if the latest security advisory released by Atlassian (CVE-2021-44228) have any impact on the below plugins on Bamboo (server) installation:

‌

Apologies if this is not the right place for this information but had no way to reach you and was unable to search in any of the wikis.

Regards,

Sharda

[Sergey Podobry]

Hi Sharda!

It’s a good place to ask questions.

All our addons use Bamboo's log4j facility and don't make any changes to it, add JMS Appender or include javax.jms API in the CLASSPATH.

So you're safe unless someone has write access to the Bamboo's log4j.properties file.

Also read FAQ for CVE-2021-44228 from Atlassian for additional information.

[Sharda GUPTA]

Hey Sergey,

Thank you for the update. Your quick response is highly appreciated!

Have a nice day..

Regards,

Sharda