Does anyone know what the recommended action is for log4shell alert

[Tom Lister]

Hi

Should we be replacing the log4j library on our servers or waiting for an Atlassian release.

Does this even affect Jira and Confluence?

https://nakedsecurity.sophos.com/2021/12/10/log4shell-java-vulnerability-how-to-safeguard-your-servers/

[Nikki Zavadska _Appfire_ · Accepted solution]

Hi, you can find FAQs and Atlassian recommendations and updates related to Log4J here 👉 https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html

[Nikki Zavadska _Appfire_]

"You can check if you are vulnerable by inspecting the Log4j configuration file. If you find a line containing the org.apache.log4j.net.JMSAppender, you may be vulnerable. If you do not find a line containing the org.apache.log4j.net.JMSAppender, you do not have this specific vulnerable configuration."

[Tom Lister]

Just got this update in my inbox

https://community.atlassian.com/t5/Trust-Security-articles/Atlassian-s-Response-to-Log4j-CVE-2021-44228/ba-p/1886598