CVE-2021-44228 (Apache Log4j vulnerability)

[Jacques Carriere]

Good day,

Does HP have any updates or patches concerning the CVE-2021-44228 (Apache Log4j vulnerability)?

Jacques

[Stephan G]

I also try to get official statements about that. 
As HPE has many software products basing on *unix - i would say. Many affected.
I would say - they are busy trying to find them

Document - Notice: Apache Software Log4j - Security Vulnerability CVE-2021-44228 | HPE Support

I would suspect that HPE Oneview is vulnerable somehow as the search get some hits

hpe oneview "log4j" - Google Suche

[Sheep1]

We would also be interested in whether OneView or ILO are affected by this in any way.

This github page makes it seem like it might be using log4j but not what version:

GitHub - HewlettPackard/oneview-sdk-java: Java SDK for HPE OneView

[SanjeevGoyal]

Hello,

I would suggest you follow the below customer advisory for more clarification.

Notice: (Revision) Apache Software Log4j - Security Vulnerability CVE-2021-44228
https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-a00120086en_us

If you feel this was helpful please click the KUDOS! thumb below and accept the solution.
Regards,

[techin]

@Sheep1 

This may help:

https://community.hpe.com/t5/HPE-OneView/Is-OneView-vulnerable-to-the-Apache-Software-Log4j-Vulnerability/m-p/7156431#M6733