---
title: "Security Bulletin Update - Log4J"
canonical: "https://docs.getxray.app/space/ProductKB/46268609/Security%20Bulletin%20Update%20-%20Log4J"
format: markdown
---
## Log4J Issue (CVE-2021-44228)

**NOTE:** This incident is no longer considered active, but is being maintained as Monitoring for short-term visibility.

This is an update of Idera's internal review of the Log4J Issue (CVE-2021-44228). Idera has completed its review/investigation on all family of products. The status of products is the following:

- All Xray/Xporter Server/DC and Cloud products and Xray Exploratory Testing (XEA) - Our investigation confirmed there are no exposed instances of the Apache Log4j library within the version range that contains this vulnerability. Therefore, the investigation confidently concludes all product versions are not impacted by the Apache Log4j vulnerability.
- Xray Server/DC and Cloud connectors - The following Xray connectors were found to contain a vulnerable version of the Apache Log4j library. Each has been updated to remove the vulnerability and those updates are now available as follows:
  - Xray Connector for Bamboo  
Available on the Atlassian Marketplace  
Instructions: [https://getxraydocs.atlassian.net/wiki/display/XRAY/Integration+with+Bamboo](https://getxraydocs.atlassian.net/wiki/display/XRAY/Integration+with+Bamboo)
  - Xray TeamCity Plugin  
Available on our documentation  
Instructions: [https://getxraydocs.atlassian.net/wiki/display/XRAY/Integration+with+TeamCity](https://getxraydocs.atlassian.net/wiki/display/XRAY/Integration+with+TeamCity)
  - Xray for JIRA Jenkins Plugin  
Available on the Jenkins Plugin Manager  
Instructions: [https://getxraydocs.atlassian.net/wiki/display/XRAY/Integration+with+Jenkins](https://getxraydocs.atlassian.net/wiki/display/XRAY/Integration+with+Jenkins)
  - Xray Maven Plugin  
Available on the Xray Maven Repository  
Instructions: [https://getxraydocs.atlassian.net/wiki/display/XRAY/Integration+with+Maven](https://getxraydocs.atlassian.net/wiki/display/XRAY/Integration+with+Maven)
- All Other Idera Family Of Products - Our investigation confirmed there are no exposed instances of the Apache Log4j library within the version range that contains this vulnerability. Therefore, the investigation confidently concludes none are impacted by the Apache Log4j vulnerability.  
Although our initial and thorough investigation has concluded, Idera continues to monitor for potential breaches, we will continue actively to monitor this situation and communicate with stakeholders as appropriate.

If you have any questions or concerns please contact us.

Idera Security and Compliance Team.

## Related articles



> Macro (contentbylabel)

> Macro (details)
> 
> | **Related issues** | > Macro (jira) |
> | --- | --- |