Log4j2 vulnerabilities - the saga continues

[SS]

Since Atlassian's Response to Log4j (CVE-2021-44228), two more vulnerabilities have been unearthed and Log4j2 has been updated to v2.17.0 to patch the vulns.

Do CVE-2021-45046 or CVE-2021-45105 have any impact on the Atlassian fork of Log4j2?

[Venkateshwar Aynala]

CVE-2021-45046 has been covered here FAQ for CVE-2021-44228 and CVE-2021-45046 . But yes waiting for the update on the other one definitely.

[Daniel Ebers]

Please also review https://jira.atlassian.com/browse/JRASERVER-62838 where you can see the progress of a version 2 implementation for Log4j within Atlassian products.
As of today, version 2 is not available but a special patched version of Log4j is used with Jira, for example.