When can we expect update of log4j to latest version for SAS 9.4 M7 release

[infomevijay]

SAS has stated to check the note https://support.sas.com/kb/68/756.html for anticipated date of hotfix release which doesn't provide any information about the release date. We are currently on SAS 9.4 M7 release and we had followed instructions provided by SAS to patch the vulnerable version. Our security scan check for version of log4j and report as noncompliant. To prevent this, we would like log4j to be updated to latest version, does anyone aware of the when this hot fix will be made available?

[SASKiwi]

If you go to the full LOG4J bulletin you will see this:

At this time, SAS plans to deliver software that includes version 2.17.1+ of Log4j as follows:

• For SAS 9.4M7 - additional updates planned for the end of March 2022 (in the SAS Security Update and additional hot fixes)