List of Qlik products affected by Log4j Vulnerability

Qlik has a wide range of products and it seems some of the products have been affected by Log4j Vulnerability and for those products the patches will come either in December or in late January as per the Qlik Security advisory. Nearly 10 of their products have been affected by Log4j and as of know, customer have been asked to take the mitigation steps mentioned below

List of Products that are not affected by Log4j Vulnerability

• Qlik Sense Enterprise, all supported versions
• Qlik Sense Enterprise SaaS
• QlikView, all supported versions
• Nprinting, all supported versions
• Qlik Alerting, all supported versions
• Qlik Web Connectors, all supported versions
• Qlik RepliWeb and ARC, all supported versions
• AIS, including ARC, all supported version
• Nodegraph
• AutoML
• Qlik Catalog supported versions before May 2021 are not affected
• Blendr
• Qlik Data Transfer
• Salesforce and SAP Connectors are not affected
• Qlik Forts
• ODBC Connector Package
• REST Connectors
• Qlik Sense Business

Mitigation steps are only a temporary measure and the patches won’t be ready till late December 2021 or early January 2022 as per the advisory here – https://community.qlik.com/t5/Support-Updates-Blog/Vulnerability-Testing-Apache-Log4j-reference-CVE-2021-44228-also/ba-p/1869368