Open Spatial products Munsys, enlighten and ACDC are not affected by this vulnerability as neither apache or log4j are used in the products or components

Underlying Oracle database vulnerabilities:

From the Oracle Advisory

Apache Log4j Security Alert CVE-2021-44228 Products and Versions (Doc ID 2827611.1)

5.0 Oracle products not requiring patches

At this point in time, Oracle doesn’t believe the following products to be affected by vulnerability CVE-2021-44228:

…

• Oracle Big Data Spatial and Graph [Product ID 11528]

From a database perspective no action is necessary.  It the database support only open spatial products the log4j.jar component may be renamed or deleted

If you are using SQL Developer there may be a vulnerability

Patch SQL Developer

Open Spatial has succesfully competed the migration of the support site, restoring all support services as of Saturday 21 November 5:30pm (AEDT). 

Open Spatial will be migrating this Support Site from 10am Australian Eastern Daylight Time, Saturday 21/11/20.

The support site will be operational again from 8:00am Australian Eastern Daylight Time, Monday 23/11/20.