Log4shell vulnerability?

[Duncan Pierce]

Hi,

Has Bitbucket (or any of the other Atlassian products required to use it) been affected by the recent "log4shell" vulnerability in Log4J?

Thanks for your help!

[Daniel Eads · Accepted solution]

Hi all,

Daniel with Atlassian Support here to let you know our security team has finished its investigation. We have an official response statement here on Community, which you can access at this link.

More information can be found on our advisory page, as well as the previously-published FAQ:

• https://confluence.atlassian.com/display/SECURITY/Multiple+Products+Security+Advisory+-+Log4j+Vulnerable+To+Remote+Code+Execution+-+CVE-2021-44228
• https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html

Thanks,
Daniel Eads | Atlassian Support

[Nikki Zavadska _Appfire_ · Accepted solution]

Hi, you can find FAQs and Atlassian recommendations and updates related to Log4J here 👉 https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html

[Nikki Zavadska _Appfire_]

"You can check if you are vulnerable by inspecting the Log4j configuration file. If you find a line containing the org.apache.log4j.net.JMSAppender, you may be vulnerable. If you do not find a line containing the org.apache.log4j.net.JMSAppender, you do not have this specific vulnerable configuration."

[Nikki Zavadska _Appfire_]

☝️above is information for data-centre and server

In terms of Cloud there is a mention in FAQ that Atlassian security team is investigating the impact on Cloud but nothing specific is mentioned there yet.

[Alex Young]

ElasticSearch in our BitBucket has the affected JAR files

But Atlassian are saying Bitbucket is not affected?

Whats the deal please?

[ltoinel]

Hi, My Confluence instance used for an Opensource project has been hacked since the 22th November.

• A cryptojacker installed a /tmp/.solr/solrd process to mine cryptomoney.
• A new attack has been detected the 5th december. A ransomware crypted the data of my confluence database.
  
  Take care of your instances publicly available from Internet !