Indeni’s response to the Log4j vulnerability

Following disclosure of CVE-2021-44228 on December 10, 2021, Indeni immediately identified potential risks to customers and conducted a thorough investigation to determine any exposure within their own environment. They confirmed the specific version of their product, verified whether it used vulnerable Log4j components, located relevant logback.xml configuration files, and communicated findings to stakeholders. The response emphasizes prompt assessment, internal verification, and transparent customer communication as primary actions.

Indeni confirmed that their product is running version 1.12 and does not use a Log4j version vulnerable to CVE-2021-44228. This determination was part of their immediate post-disclosure investigation to assess exposure risk to both customers and their own systems. By identifying the software version in use and verifying the absence of the vulnerable Log4j component, Indeni concluded there is no direct vulnerability related to CVE-2021-44228 in the referenced product version.

The article states that Indeni takes open-source software risk and vulnerabilities seriously and has provided the locations of log4j logback.xml configuration files for reference. Customers with additional questions about the Log4j vulnerability or Indeni’s assessment are encouraged to contact Indeni directly for further information. This outreach option is presented to ensure transparency and to address any remaining concerns about exposure, configuration details, or mitigation steps.