Red Hat Security Advisory: Red Hat Data Grid 8.2.2 security update

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products1

• Red Hat Data Grid 8.2.2

✅ Remediation

To install this update, do the following: 1. Download the Data Grid 8.2.2 server patch from the customer portal[²]. 2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on. 3. Install the Data Grid 8.2.2 server patch. Refer to the 8.2.2 Release Notes[³] for patching instructions. 4. Restart Data Grid to ensure the changes take effect. Workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441

🔗 References (7)

• selfhttps://access.redhat.com/errata/RHSA-2021:5132
• externalhttps://access.redhat.com/security/updates/classification/#critical
• externalhttps://access.redhat.com/jbossnetwork/restricted/softwareDetail.html?softwareId=70381&product=data.grid&version=8.2&downloadType=patches
• externalhttps://access.redhat.com/documentation/en-us/red_hat_data_grid/8.2/html-single/red_hat_data_grid_8.2_release_notes/index
• externalhttps://access.redhat.com/security/vulnerabilities/RHSB-2021-009
• externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2030932
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5132.json