Subject: CVE-2021-44228 Still Present in IFS Remote Cloud 24R2 Files

Hello,

We are currently deploying IFS Remote Cloud 24R2, and we have identified that some files available on lifecycle.ifs.com still contain the Log4j vulnerability CVE-2021-44228.

Since Oracle is distributed by IFS as an OEM, we do not have direct access to Oracle's patching services, which limits our ability to apply standard Oracle CPU patches.

We would appreciate your guidance on the following points:

1. What remediation options are available for environments where direct Oracle patching is not possible?
2. Is it safe to manually remove the vulnerable components, such as JndiLookup.class, from the affected .jar files?
3. Has anyone else encountered this issue during deployment of 24R2, and how was it resolved?
4. Are there updated packages or scripts available from IFS to mitigate this vulnerability?

We are particularly interested in best practices for removing or neutralizing the vulnerable files without impacting system stability.

Thank you in advance for your support and insights.