We are trying to upgrade Rundeck version from 3.0.27 to the latest version (3.4.7) We got below questions,
What is the approach to upgrade from 3.0.xxxx to 3.4.7? Could we do a direct upgrade or otherwise, if we have to run through multiple intermediary versions, what are those?
Does upgrading from 3.0.xxx to 3.4.7 fix the log4j vulnerability?
Please help to clarify above. Thanks
Due to the big gap between 3.0.X and 3.4.X (and the upcoming 4.0.X) the best way to upgrade your instance is to create a fresh 3.4/4.0 instance and then import your projects and keys (exported previously), as a tip, try this on a non-prod environment first.
Rundeck 3.0.x uses log4j 1, so, even if the vulnerability doesn't affect explicitly the log4j 1.x EOL was in 2015 and isn't supported anymore, so, it's important to move to the latest version (Rundeck 3.4.10 at this moment).