VMware is going to update log4j to version 2.16

Today VMware published update on log4j solution. As per statment on the vendor KB website says that VMware expect to fully address both CVE-2021-44228 and CVE-2021-45046 by updating log4j to version 2.16 in forthcoming releases of vCenter Server, as outlined by our software support policies. VMSA-2021-0028 will be updated when these releases are available. In the interim, VMware will be updating this Knowledge Base article with revised guidance to remove all JndiLookup classes per Apache Software Foundation guidance.

CVE-2021-44228 has been determined to impact vCenter Server 7.0.x, vCenter 6.7.x & vCenter 6.5.x via the Apache Log4j open source component it ships.

Products NOT impacted by CVE-2021-44228

  • VMware vSphere ESXi
  • VMware Cloud Director (VCD)
  • VMware vCloud Availability
  • VMware NSX Advanced Load Balancer (Avi)   
  • VMware Workspace ONE Assist
  • VMware RemoteHelp
  • VMware vCloud Usage Meter
  • VMware Tanzu Kubernetes Grid
  • SaltStack
  • VMware App Volumes 
  • VMware ThinApp
  • ThinApp SDK
  • Dynamic Environment Manager (DEM) 
  • Workspace ONE Unified Endpoint Management (UEM)
  • VMware Postgres
  • VMware Tanzu RabbitMQ
  • VMware Tanzu RabbitMQ for Kubernetes
  • VMware Tanzu RabbitMQ for VMs
  • VMware Tanzu SQL with Postgres for Kubernetes
  • VMware Tanzu SQL with MySQL for Kubernetes
  • Data Management for VMware Tanzu (DMS)
  • VMware Telco Cloud Automation (TCA)
  • VMware Workstation
  • VMware Fusion
  • VMware Skyline Collector virtual appliance
  • Workspace ONE Intelligence
  • MySQL for TAS (Tanzu Application Service)
  • VMware Workstation Player
  • Cloud Director App Launchpad
  • vROps TenantApp
  • AirWatch Cloud Connector
  • VMware NSX Lastline Defender On-Premises
  • VMware NSX Lastline Defender Hosted/SaaS
  • Update Manager Download Service (UMDS)
  • Metrics Store
  • Event Alerts
  • VMware Workspace ONE Assist for Horizon
  • VMware Tools
  • VMware Tanzu Toolkit for Kubernetes
  • Secure Email Gateway
  • VMware Cloud Director App Launchpad
  • Skyline Health Diagnostics 
  • Carbon Black App Control
  • VMware Tanzu Build Service
  • Workspace ONE Tunnel
  • VMware Email Notification Service 2

Source: https://kb.vmware.com/s/article/87068

Please like and share to spread the knowledge in the community.

If you want to chat with me please use Twitter: @AngrySysOps

Visit my FB page: https://www.facebook.com/AngrySysOps

Read my blog: https://angrysysops.com

Subscribe to my channel : https://www.youtube.com/channel/UCRTcKGl0neismSRpDMK_M4A

Please leave the comment