Are H2O.ai products affected by log4shell vulnerability?

Question

My question is if Open Source H2O-3, Open Source Sparkling Water and Driverless AI are affected by CVE-2021-44228 and CVE-2021-45046.

Answer 1

H2O.ai has releases/patches upgraded to the latest log4j version 2.17 to address the various vulnerabilities found. Updates are at:

https://www.h2o.ai/security/bulletins/h2o-2021-001/

Answer 2

H2O.ai is closely tracking the vulnerabilities and publishing updates at https://www.h2o.ai/security/bulletins/h2o-2021-001/.