I am surprised nobody asked this yet, so putting it here for some easy points.
I'll choose the most complete answer as the correct one next week.
Tridion Stack Exchange is a question and answer site for Tridion developers and administrators. It only takes a minute to sign up.Sign up to join this community
Tridion Sites - core product unaffected but customers may still be affected in a custom web application.
Tridion Docs - core product unaffected but on-site customers should check any DITA-OT/customizations using log4j.
This library is used in some of the other RWS products here you can find the full detailed list of products affected and not affected by Critical Apache Log4J2 CVE-2021-44228 Vulnerability (Log4Shell). and the Mitigation Guidance which was created by RWS Support.