is there any new Fisheye and Crucible releases planned to address the Log4j issue
Asked by rajesh@csgi:

is there any new Fisheye and Crucible releases planned to address the Log4j issue


Answers:
author: Fabio Racobaldo _Herzum_
body: Hi [rajesh@csgi](/t5/user/viewprofilepage/user-id/3968213) ,

if you are referring to CVE-2021-4422228 Fecru is not affected. Please check the following article <https://confluence.atlassian.com/security/multiple-products-security-advisory-log4j-vulnerable-to-remote-code-execution-cve-2021-44228-1103069934.html>

### All Other Self-Managed Products {#toc-hId-1317264630}

**No other Atlassian self-managed products are vulnerable to CVE-2021-44228.**

Some self-managed products use an Atlassian-maintained fork of Log4j 1.2.17, which is not vulnerable to CVE-2021-44228. We have done additional analysis on this fork and confirmed a new but similar vulnerability ([CVE-2021-4104](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104)) that can only be exploited by a trusted party. For that reason, Atlassian rates the [severity level](https://www.atlassian.com/security/security-severity-levels) for all other self-managed products as **low**. Specifically, Atlassian products that use Log4j 1.x are only affected if all of the following non-default configurations are in place:

* The JMS Appender is configured in the application's Log4j configuration

* The `javax.jms` API is included in the application's `CLASSPATH`

* The JMS Appender has been configured with a JNDI lookup to a third party. Note: this can only be done by a trusted user modifying the application's configuration, or by trusted code setting a property at runtime

The following products use the Atlassian-maintained fork of Log4j 1.2.17:

* Bamboo Server and Data Center (including Bamboo Agents)

* Confluence Server and Data Center

* Crowd Server and Data Center

* Fisheye / Crucible

* Jira Service Management Server and Data Center

* Jira Software Server and Data Center (including Jira Core)

Hope this helps,

Fabio

comments: author: rajesh@csgi
body: Thanks Fabio,

Could you confirm the same regarding Bitbucket.


author: Fabio Racobaldo _Herzum_
body: you're welcome [rajesh@csgi](/t5/user/viewprofilepage/user-id/3968213) .

Bitbucket is impacted so you need to choose one of the proposed actions as defined in the linked article.


author: Roel Storms
body: This blog does not address the chainsaw vulnerability which is present in Log4j 1.2.17 which Atlassian explains is used by Fisheye. "Some self-managed products use an Atlassian-maintained fork of Log4j 1.2.17, which is not vulnerable to CVE-2021-44228. "

This blog is also from December. That is before chainsaw was published in January. Why it Atlassian not addressing the Chainsaw issue?

[CVE-2022-23307 : CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw wa (cvedetails.com)](https://www.cvedetails.com/cve/CVE-2022-23307/)


author: Anusha Hegde
body: [@Fabio Racobaldo _Herzum_](/t5/user/viewprofilepage/user-id/781528) : Fisheye and crucible having the jar of log4j-1.2.16.jar is vulnerable to [CVE-2021-4104?](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104) can you please clarify on this or share any information if you have related to it.