Red Hat SummitChapter 1. Upgrade to the latest Data Grid version
Red Hat recommends you upgrade any deployments from 8.1.x to the latest Data Grid 8 version as soon as possible. The Data Grid team regularly patch security vulnerabilities and actively fix issues on the latest version of the software.
1.1. Apache Log4j security vulnerabilities
Data Grid includes Apache Log4j components in:
- Data Grid Server distribution
- Data Grid Server container image for Red Hat OpenShift
Data Grid 8.2.2 fixes CVE-2021-44228 which is a critical security vulnerability. Data Grid 8.2.3 fixes several Log4j CVEs of moderate severity. For more information, see the Data Grid 8.2 release notes or the Data Grid Operator 8.2 release notes. You can find the latest Data Grid documentation at Red Hat Data Grid Product Documentation.
Data Grid Operator version 8.2.7 corresponds to Data Grid 8.2.2.
If you cannot upgrade your Data Grid deployment, you must follow the steps to mitigate the critical vulnerability as outlined in the RHSB-2021-009 Log4Shell - Remote Code Execution security bulletin.
