Also wondering if it will include detections for WebInspect/WebInspect Enterprise as well. 

CyberRes Fortify Software Security Content Update 4 was released last Friday, December 17, 2021. You can view additional information in the product announcement - community.microfocus.com/.../cyberres-fortify-software-security-content-update-4

ebell Thank you for your reply and the link, I appreciate it. The release announcement does not indicate that log4j will be detected. That's good to know as we'll work on an alternate means for detection. Happy Holidays! 

suza and KSKrug

The Fortify solution that currently provides the best detection would be our integration/implementation of Sonatype and SSC.

Regarding detection of log4j, you are correct that WebInspect nor WebInspect Enterprise currently detect this as there are some backend requirements needed (i.e., available LDAP server) to test against.

SCA does not currently check versions of all components or dependencies. 

With all the above in mind...stay tuned!

suza and KSKrug HOT OFF THE PRESS!

We just pushed a new update today, January 15, 2022, (via SmartUpdate in WebInspect) that should be of interest to you:

With this update is a new Policy in WebInspect called OAST:

Containing a new rule for Log4Shell detection:

An official account should be coming out soon; however, as mentioned this is currently available via SmartUpdate.

Here is a link to the announcement - Detect Log4J with Fortify WebInspect - community.microfocus.com/.../detect-log4j-with-fortify-webinspect