stash-java-client-core log4j 1.x to log4j 2.17 upgrade?

[Eshwar Sundar]

I see stash-java-client-core latest version uses log4j 1.X.

I am aware log4j 1.X is not vulnerable to the Zero Day vulnerability but still I prefer to upgrade to 2.17 

Has anyone found how to this? Is there any work around to make sure log4j 1.X is not being used? I see it is a compile dependency which implies stash-java-client-core requires log4j to work.

Any answer would be really helpful. Thanks

[Urmo Luts]

Hi

I asked same question from support and i did get this answer:

• Although Jira is using the classic version of log4j but the version shipped with our products is forked, developed, and maintained in-house at Atlassian, so it’s not the same Apache EOL version, therefore, not vulnerable by default. This is consistently being maintained and updated by our in-house development team.
• Do not update Log4j manually as this could potentially break the application. Some on-premises products use an Atlassian-maintained fork of Log4j 1.2.17, which is NOT vulnerable to CVE-2021-44228. We have done additional analysis on this fork and confirmed a new - but similar - low severity vulnerability that can only be exploited by a trusted party if you have specific, non-default configurations. 

I hope it will help You also.

With best

Urmo