CVE-2021-4125

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-4125
It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2021-4125 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-44228 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-45046 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2033121 Issue Tracking Patch Third Party Advisory
https://github.com/kube-reporting/hive/pull/71 Third Party Advisory
https://github.com/kube-reporting/hive/pull/72 Third Party Advisory
https://github.com/kube-reporting/hive/pull/73 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:openshift:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift:*:*:*:*:*:*:*:*
History

28 Mar 2023, 19:14

Type Values Removed Values Added
CPE cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:*

29 Aug 2022, 14:26

Type Values Removed Values Added
CPE cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1
CWE CWE-502
First Time Redhat
Redhat openshift
Apache
Apache hive
References (MISC) https://github.com/kube-reporting/hive/pull/72 - (MISC) https://github.com/kube-reporting/hive/pull/72 - Third Party Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2033121 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2033121 - Issue Tracking, Patch, Third Party Advisory
References (MISC) https://github.com/kube-reporting/hive/pull/73 - (MISC) https://github.com/kube-reporting/hive/pull/73 - Third Party Advisory
References (MISC) https://access.redhat.com/security/cve/CVE-2021-4125 - (MISC) https://access.redhat.com/security/cve/CVE-2021-4125 - Third Party Advisory
References (MISC) https://access.redhat.com/security/cve/CVE-2021-44228 - (MISC) https://access.redhat.com/security/cve/CVE-2021-44228 - Third Party Advisory
References (MISC) https://access.redhat.com/security/cve/CVE-2021-45046 - (MISC) https://access.redhat.com/security/cve/CVE-2021-45046 - Third Party Advisory
References (MISC) https://github.com/kube-reporting/hive/pull/71 - (MISC) https://github.com/kube-reporting/hive/pull/71 - Third Party Advisory

24 Aug 2022, 16:24

Type Values Removed Values Added
New CVE
Information

Published : 2022-08-24 16:15

Updated : 2023-12-10 14:35

NVD link : CVE-2021-4125

Mitre link : CVE-2021-4125

CVE.ORG link : CVE-2021-4125

JSON object : View

Products Affected

redhat

  • openshift
CWE
CWE-502

Deserialization of Untrusted Data

CWE-20

Improper Input Validation