Apache Log4j Security Vulnerabilities -- PIM R12.8 and R12.8 SP1
search cancel

Apache Log4j Security Vulnerabilities -- PIM R12.8 and R12.8 SP1


Article ID: 232191


Updated On:


CA Privileged Identity Management Endpoint (PIM)


Log4j vulnerabilities - Do these have an impact on R12.8 and R12.8 SP1


Release : 12.8, 12.8 SP1

Component : CA ControlMinder


If R128 and R12.8 SP1 are impacted, a fix for the same is required.


Please refer to Apache Log4j Security Vulnerabilities

As per Apache, "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2."

Log4j 1.x mitigation
Log4j 1.x is not impacted by this vulnerability.

PIM R12.8 and PIM R12.8 SP1 uses Log4j 1.2.8 version, hence this version of PIM is not impacted.