I am surprised nobody asked this yet, so putting it here for some easy points.
I'll choose the most complete answer as the correct one next week.
Tridion Sites - core product unaffected but customers may still be affected in a custom web application.
Tridion Docs - core product unaffected but on-site customers should check any DITA-OT/customizations using log4j.
This library is used in some of the other RWS products here you can find the full detailed list of products affected and not affected by Critical Apache Log4J2 CVE-2021-44228 Vulnerability (Log4Shell). and the Mitigation Guidance which was created by RWS Support.