TIBCO is aware of the recently announced Apache Log4J vulnerabilities (CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105).
TIBCO is also aware of CVE-2021-4104 and this issue was investigated as part of our response to CVE-2021-44228.
It is addressed by Note 1 below.

Products whose current standard support versions either do not use Apache Log4J or are not on an affected version of Log4J:

• TRA 5.11.x / Administrator 5.11.x / BW 5.14.x, all BW5 adapters and plugin ecosystem and its earlier versions. See Notes 1 and 2 below.
• TCI, and all versions of BW6, BWCE, and plugin ecosystems. See Notes 1 and 2 below.

Notes:

1. If a customer has implemented the JMSAppender class for plugins they have written they should check to make sure they don’t expose this vulnerability. For more details see: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723.
2. If a customer has developed their own java code or installed 3rd party libraries they should check to make sure they don't expose this vulnerability. This applies to BW5, BW6, TCI, BWCE, and the plugin ecosystems.

Affected Products with Fixes

•     TIBCO BusinessWorks™ 5.15
•     TIBCO Administrator™ 5.12
•     TIBCO ActiveMatrix® Adapter for Database 7.3
•     TIBCO ActiveMatrix® Adapter for Files for Unix/Win 7.1
•     TIBCO ActiveMatrix® Adapter for SAP 7.3