CVE-2021-4104 Log4j Vulnerability in Service Management

Products

• CA Service Desk Manager

Issue/Introduction

Vulnerability scans may show Service Management Files as vulnerable to CVE-2021-4104

Customers want to know if any Service Management Products are vulnerable.

Environment

Release : 17.3RU11 and up

Component : SDM - Vulnerability

Cause

Scanners can detect the presence of log4j files and their versions, but they can not tell if JMSAppender is used.

Resolution

The engineering team has has confirmed that JMSAppender is not used in Service Management and therefore there is no vulnerability to CVE-2021-4104.