I'm also seeing this in all my Jira 7.2.7 and Confluence 5.10 instances. I'm running ClamAV 0.99.4/24797/Mon Jul 30 09:42:33 2018
The virus signature update last night now finds UPM to be malware. Because we do not automatically quarantine suspect files, this didn't cause an issue on application restart. It's just noisy.
I've ticketed Atlassian for this.
There are two workarounds available -
* exclude the directories where the jar files exist so clamscan doesn't find the files
* exclude the files (disclosure: this method was developed by another engineer and I have not vetted it)
In order to add a file to the false-positive whitelist you need to add the info to a file named sigfile.fp in the same directory as the db files for clamav this is located in /var/clamav. Actually you can name the file anything you want just ensure the extension is .fp This is the info that is required, again it is a simple task in bash to get the data.
- MD5 sum
- File size in bytes
- 6 digit date
- Base file name with last extension removed. So if the file is foo.bat then the file name is foo. If it is foo.bar.bat the file name is foo.bar.
With that info you would add it to /var/clamav/sigfile.fp formatted like this:
MD5:SIZE:DATEID_NAME
That entry represents a single file and make sure there is only one entry per line 1000 files then 1000 lines
And that is all there is to it, it takes effect as soon as the file is saved.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.