log4j update

[mike]

/app/atlassian/bitbucket/7.4.2/app/WEB-INF/lib/log4j-api-2.11.1.jar
/app/atlassian/bitbucket/7.4.2/app/WEB-INF/lib/log4j-to-slf4j-2.12.1.jar
/app/atlassian/bitbucket/7.4.2/elasticsearch/lib/log4j-api-2.11.1.jar
/app/atlassian/bitbucket/7.4.2/elasticsearch/lib/log4j-core-2.11.1.jar

Can I Update these log4j to an upper version like 2.16?

[Nic Brough -Adaptavist- · Accepted solution]

No, it could well break Bitbucket, and it would render you unsupported.

I'm assuming this is in response to the CVE - see https://community.atlassian.com/t5/Trust-Security-articles/Atlassian-s-Response-to-Log4j-CVE-2021-44228 for the guidance on what to do.

[Prabhu Ganesh]

what will happen if we delete these log4j files?

[Nic Brough -Adaptavist-]

Bitbucket will stop working.

[Prabhu Ganesh]

How to upgrade log4j files to the 2.16 version?

[Nic Brough -Adaptavist-]

You do not.  You will need to upgrade your bitbucket

[Prabhu Ganesh]

In bamboo latest version also uses log4j 2.9.0 file, how to remediate this?

[Nic Brough -Adaptavist-]

Make sure none of the users can set up plans that could throw malicious code into the log file.

[Prabhu Ganesh]

Hi Nic - How to monitor these new plans? What is the solution for the long-term fix?