We have scanned our freeIPA instances and it seems that somehow in PKI
functionality tomcat is being used, which in turn uses log4j.
Does this have an impact?
~]# find / -name \log4j\
/etc/tomcat/log4j.properties
/var/lib/yum/yumdb/l/fcb0a245a2d3b4e92b76136762f22caf2e7fe5f7-log4j-1.2.17-16.el7_4-noarch
/var/lib/pki/pki-tomcat/lib/log4j.properties
/var/lib/pki/pki-tomcat/lib/log4j.jar
/usr/share/doc/log4j-1.2.17
/usr/share/pki/server/conf/log4j.properties
/usr/share/sgml/log4j
/usr/share/sgml/log4j/log4j.dtd
/usr/share/java/log4j.jar
/usr/share/java/tomcat/log4j.jar
/usr/share/java/slf4j/log4j-over-slf4j.jar
/usr/share/java/slf4j/log4j12.jar
/usr/share/java/slf4j/slf4j-log4j12.jar
/usr/share/maven-effective-poms/JPP.slf4j-slf4j-log4j12.pom
/usr/share/maven-effective-poms/JPP-log4j.pom
/usr/share/maven-effective-poms/JPP.slf4j-log4j-over-slf4j.pom
/usr/share/maven-fragments/log4j.xml
/usr/share/maven-poms/JPP-log4j.pom
/usr/share/maven-poms/JPP.slf4j-log4j-over-slf4j.pom
/usr/share/maven-poms/JPP.slf4j-slf4j-log4j12.pom