question

The CVE requires the JMSAppender, which neither Opscenterd nor the agents use. Thus, it is not affected by the vulnerability.

As it states in CVE-2021-4104, Log4j 1.2 is vulnerable when an attacker gains access to modify the Log4j configuration file (log4j.properties). An attacker is able to execute arbitrary code IF they configure Log4j to use the JMSAppender and make it point to the attacker's own JNDI LDAP endpoint.

To be clear, Log4j is only vulnerable to this specific exploit with these two scenarios:

1. Log4j is configured to use the JMSAppender.
2. An attacker gained access to the server to modify configuration files.

OpsCenter is not exposed to scenario #1 because the agent is not configured to use this appender. If scenario #2 is true, then I would suggest that you have bigger problems than just OpsCenter because an attacker has penetrated your environment and circumvented your security measures.

Given that Log4j 1.x has reached it's end of life (EOL), it is being replaced in the next release of OpsCenter. Cheers!