Lucene search

RedHatRHSA-2022:0430

HistoryFeb 03, 2022 - 1:55 p.m.

(RHSA-2022:0430) Important: Red Hat Data Grid 7.3.9 security update

2022-02-0313:55:10

access.redhat.com

red hat data grid

7.3.9

security update

log4j

sql injection

unsafe deserialization

remote code execution

cve-2022-23305

cve-2022-23307

cve-2021-4104

cve-2022-23302

unix

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.159

Percentile

96.0%

JSON

Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale.

Data Grid 7.3.9 replaces Data Grid 7.3.8 and includes bug fixes and enhancements. Find out more about Data Grid 7.3.8 in the Release Notes [3].

Security Fix(es):

log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)
log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)
log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104)
log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.