Acrobat Reader affected by Apache Log4j Vulnerability, CVE-2021-44228?

[Chris22224658ue4c]

Is anyone aware if Acrobat Reader is affected by the vulnerability below, and if so what the recommendation is to address it? 

https://nvd.nist.gov/vuln/detail/CVE-2021-44228

[Bernd Alheit]

Acrobat Reader is not affected.

[Bryski]

Thanks @Bernd Alheit, is there documentation from Adobe to confirm this? Our IT Security have blocked all Adobe apps until we have written confirmation addressing the vulnerability. 

Could you please point me to where Adobe might update the status of all their apps? I've seen confirmation for Coldfusion and AEM so far.

[Bernd Alheit]

Acrobat Reader doesn't use Java!

[Bryski]

Thanks @Bernd Alheit how about DC? Are all the Acrobat products the same?

[Bernd Alheit]

Yes.

[Peliroja2019]

Hi Bryski - As this investigation is ongoing, I would reach our to Adobe Customer Support directly for confirmation. Please see: https://helpx.adobe.com/security/alertus.html 

Adobe does have a security advisory posted for Log4J: https://helpx.adobe.com/security/products/log4j-2-advisory.html 

[Peliroja2019]

Latest advisory for CVE-2021-44228 is here: https://helpx.adobe.com/security/products/log4j.html