See the discussion here: Log4j CVE-2021-44228 Detection and Mitigation
See the ongoing summary here: Log4j CVE-2021-44228, CVE-2021-45046 Summary Page
We have a fixlet/task to scan for affected JAR files for all operating systems including windows and an analysis to collect the results.
See here:
We have a mitigation for windows for the RCE CVE using environment variables.
See here: https://bigfix.me/fixlet/details/26898 (requires reboot after running)
The fixlet/task I created to address the RCE CVE through Env Vars for non-windows platforms has some gaps because it is not setting the env var in a way that affects system services currently, so that would need solved.
The env var options do not mitigate the newer denial of service CVE in Log4J.
We are working on fixlets/tasks to use utilities to scan for all affected JARs and offer mitigations. This will fix the newer denial of service CVE in Log4J.