Hi,
We checked the RHEL advisories, and saw that RHEL 7 and 8 seem not impacted by log4shell
and RedHat IDM is not explicitly mentioned neither as being safe nor as being vulnerable.
Seeing as pki-tomcat is being used, we found these versions of log4j on the CA master
nodes.
log4j 1.2.17 java-archive
log4j-over-slf4j 1.7.4 java-archive
log4j12 1.7.4 java-archive
It would be great if somebody could help shed some light on this.
Thanks
T