CVE-2021-44228 Log4j Vulnerable To Remote Code Execution

We do not include our own log4j in our apps. The logging is done by the logging functionality provided by Atlassian.

This means: Our apps would only be affected by the log4j vulnarability if Jira/Confluence was. This - according to Atlassian - is not the case. You can find more information about this in this FAQ: Multiple Products Security Advisory - Log4j Vulnerable To Remote Code Execution - CVE-2021-44228 | Atlassian Support | Atlassian Documentation

We have not implemented the configuration described there: Developer Documentation - Using your own log4j configuration for your plugin . We think apps that have followed this documentation may cause problems.