Log4j vulnerabilities - Do these have an impact on R12.8 and R12.8 SP1
Release : 12.8, 12.8 SP1
Component : CA ControlMinder
If R128 and R12.8 SP1 are impacted, a fix for the same is required.
Please refer to Apache Log4j Security Vulnerabilities
As per Apache, "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2."
Log4j 1.x mitigation
Log4j 1.x is not impacted by this vulnerability.
PIM R12.8 and PIM R12.8 SP1 uses Log4j 1.2.8 version, hence this version of PIM is not impacted.