The following products have not been demonstrated to be affected but may be affected. Please refer to the following KB article for patch instructions: Symantec VIP Authentication Hub ( separate from Symantec VIP)Īpply the Log4j patch available on Support Downloads. Symantec Privileged Access Manager Server Control Please refer to the following KB article: Symantec Identity Governance and Administration All other customers must upgrade to 4.6.8. The product patch is only supported for versions 4.6.0 and above. Symantec Endpoint Detection and Response (EDR) On-premise

Please refer to the following KB article. If a CVE is not listed, the product or version is not known to be vulnerable to it.

The following products and product versions are vulnerable to the CVEs listed. A remote attacker, who can trigger Log4j to log crafted malicious strings, can execute arbitrary code on the target system. Symantec products may be susceptible to a flaw in the Apache Log4j 2 library JNDI lookup mechanism.

Control Compliance Suite Vulnerability Manager.

Control Compliance Suite Virtualization Security Manager.

Control Compliance Suite Standards Virtual Server.

Control Compliance Suite Standards Server.

Control Compliance Suite Standards Network Devices.

Control Compliance Suite Standards Module.

Control Compliance Suite Standards Middleware.

Control Compliance Suite Standards Database.

Control Compliance Suite Policy Manager.

Control Compliance Suite Directory Services.

Control Compliance Suite Databases Oracle.

Control Compliance Suite Assessment Manager.

CA Single Sign On SOA Security Manager (SiteMinder).

CA Single Sign On Secure Proxy Server (SiteMinder).

CA Single Sign On Federation (SiteMinder).

CA Privileged Identity Management Endpoint (PIM).

CA Privileged Access Manager - Server Control (PAMSC).

CA API Gateway Enterprise Service Manager (Layer 7).

Sepm 14