It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6.

Affected configurations

NVD

Node

redhatopenshiftRange4.6.0–4.6.52

redhatopenshiftRange4.7.0–4.7.40

redhatopenshiftRange4.8.0–4.8.24

References

access.redhat.com/security/cve/CVE-2021-4125

access.redhat.com/security/cve/CVE-2021-44228

access.redhat.com/security/cve/CVE-2021-45046

bugzilla.redhat.com/show_bug.cgi?id=2033121

github.com/kube-reporting/hive/pull/71

github.com/kube-reporting/hive/pull/72

github.com/kube-reporting/hive/pull/73

prion 3

cve 2

cvelist 2

redhatcve 2

redhat 7

thn 4

openvas 23

nvd 1

githubexploit 8

amazon 3

nessus 17

suse 2

ibm 75

veracode 1

vmware 10

github 2

ubuntucve 1

debian 1

attackerkb 1

osv 4

fortinet 1

talosblog 3

checkpoint_advisories 1

nuclei 1

securelist 2

mmpc 1

huawei 1

cisa_kev 1

impervablog 1

mageia 1

malwarebytes 1

rapid7blog 1

kitploit 2

freebsd 1

f5 1

mssecure 1

threatpost 2

intel 1

debiancve 1

ubuntu 1

typo3 1

symantec 1

qualysblog 1

nvidia 1

cisa 1

prion

Authorization

2022-08-24 16:15:00

Default configuration

2021-12-14 19:15:00

Race condition

2022-06-17 13:15:00

cve

CVE-2021-4125

2022-08-24 16:15:09

CVE-2021-45046

2021-12-14 19:15:07

cvelist

CVE-2021-4125

2022-08-24 15:09:17

CVE-2021-45046 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

2021-12-14 16:55:09

redhatcve

CVE-2021-4125

2021-12-16 02:02:08

CVE-2021-45046

2022-05-07 14:27:31

redhat

(RHSA-2021:5184) Critical: OpenShift Container Platform 4.7.40 security update

2021-12-16 21:35:00

(RHSA-2021:5186) Critical: OpenShift Container Platform 4.6.52 security update

2021-12-16 21:25:00

(RHSA-2021:5183) Critical: OpenShift Container Platform 4.8.24 security update

2021-12-16 21:10:20

thn

Researchers Uncover New Drokbk Malware that Uses GitHub as a Dead Drop Resolver

2022-12-09 11:25:00

Second Log4j Vulnerability (CVE-2021-45046) Discovered — New Patch Released

2021-12-15 05:26:00

Hackers Begin Exploiting Second Log4j Vulnerability as a Third Flaw Emerges

2021-12-16 06:24:00

openvas

Apache Log4j 2.0.x Multiple Vulnerabilities (Web Application URL Parameter, Log4Shell) - Active Check

2022-03-30 00:00:00

Apache Log4j 2.0.x Multiple Vulnerabilities (SIP, Log4Shell) - Active Check

2021-12-13 00:00:00

Apache Archiva < 2.2.6 Multiple Log4j Vulnerabilities (Log4Shell) - Version Check

2021-12-23 00:00:00

nvd

CVE-2021-45046

2021-12-14 19:15:07

githubexploit

Exploit for Deserialization of Untrusted Data in Apache Log4J

2021-12-16 17:22:17

Exploit for Deserialization of Untrusted Data in Apache Log4J

2021-12-13 21:57:58

Exploit for Deserialization of Untrusted Data in Apache Log4J

2021-12-14 08:41:18

amazon

Critical: java-17-amazon-corretto, java-11-amazon-corretto, java-1.8.0-openjdk, java-1.7.0-openjdk

2021-12-17 18:12:00

Critical: aws-kinesis-agent

2021-12-16 00:11:00

Critical: java-1.8.0-openjdk, java-1.7.0-openjdk, java-1.6.0-openjdk

2021-12-17 17:39:00

nessus

Amazon Linux 2 : java-17-amazon-corretto, java-11-amazon-corretto, java-1.8.0-openjdk, java-1.7.0-openjdk (ALAS-2021-1731)

2021-12-18 00:00:00

Amazon Linux AMI : java-1.8.0-openjdk, java-1.7.0-openjdk, java-1.6.0-openjdk (ALAS-2021-1553)

2021-12-18 00:00:00

Palo Alto Networks PAN-OS for Panorama < 9.0.15 / 9.1.12-h3 / 10.0.8-h8 Multiple RCE (Log4Shell)

2022-02-10 00:00:00

suse

Security update for log4j (important)

2021-12-20 00:00:00

Security update for log4j (important)

2021-12-17 00:00:00

ibm

Security Bulletin: IBM Cloud Pak for Data System 1.0 is vulnerable to arbitrary code execution due to Apache Log4j ( CVE-2021-45046)

2022-01-27 06:33:28

Security Bulletin: Apache Log4j vulnerability impacts IBM Sterling Global Mailbox (CVE-2021-45046)

2022-02-07 11:17:51

Security Bulletin: IBM MQ Blockchain bridge dependencies are vulnerable to an issue in Apache Log4j (CVE-2021-45046)

2021-12-20 11:51:39

veracode

Denial Of Service (DoS)

2021-12-15 00:30:50

vmware

VMware Response to Apache Log4j Remote Code Execution Vulnerability (CVE-2021-44228, CVE-2021-45046)

2021-12-10 00:00:00

VMware Response to Apache Log4j Remote Code Execution Vulnerabilities (CVE-2021-44228, CVE-2021-45046)

2021-12-10 00:00:00

VMware Response to Apache Log4j Remote Code Execution Vulnerabilities (CVE-2021-44228, CVE-2021-45046)

2021-12-10 00:00:00

github

Incomplete fix for Apache Log4j vulnerability

2021-12-14 18:01:28

Remote code injection in Log4j

2021-12-10 00:40:56

ubuntucve

CVE-2021-45046

2021-12-14 00:00:00

debian

[SECURITY] [DSA 5022-1] apache-log4j2 security update

2021-12-16 10:29:17

attackerkb

CVE-2021-45046

2021-12-14 00:00:00

osv

Remote code injection in Log4j

2021-12-10 00:40:56

apache-log4j2 vulnerability

2021-12-15 19:02:14

Incomplete fix for Apache Log4j vulnerability

2021-12-14 18:01:28

fortinet

Apache log4j2 log messages substitution (CVE-2021-44228)

2021-12-12 00:00:00

talosblog

Quarterly Report: Incident Response Trends in Q2 2022

2022-07-26 14:03:00

Quarterly Report: Incident Response Trends in Q3 2022

2022-10-25 12:00:00

Quarterly Report: Incident Response Trends in Q3 2022

2022-10-25 12:00:00

checkpoint_advisories

Apache Log4j Remote Code Execution (CVE-2021-44228; CVE-2021-45046)

2021-12-10 00:00:00

nuclei

Apache Log4j2 - Remote Code Injection

2021-12-23 15:41:50

securelist

CVE-2021-44228 vulnerability in Apache Log4j library

2021-12-13 14:10:21

Answering Log4Shell-related questions

2021-12-20 15:45:30

mmpc

MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations

2022-08-25 16:00:00

huawei

Security Advisory - Apache log4j2 remote code execution vulnerabilities in some Huawei products

2021-12-15 00:00:00

cisa_kev

Apache Log4j2 Deserialization of Untrusted Data Vulnerability

2023-05-01 00:00:00

impervablog

Log4Shell log4j Remote Code Execution – The COVID of the Internet

2022-01-06 16:41:56

mageia

Updated log4j packages fix security vulnerability

2021-12-19 15:26:08

malwarebytes

[Update: CISA issues Log4j vulnerabilities scanner] Log4j zero-day “Log4Shell” arrives just in time to ruin your weekend

2021-12-10 18:03:28

rapid7blog

How to Protect Your Applications Against Log4Shell With tCell

2021-12-15 14:58:14

kitploit

log4j-scan - A fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts

2021-12-20 11:30:00

Log4J-Detector - Detects Log4J versions on your file-system within any application that are vulnerable to CVE-2021-44228 and CVE-2021-45046

2021-12-20 04:38:00

freebsd

graylog -- remote code execution in log4j from user-controlled log input

2021-11-14 00:00:00

K32171392 : Apache Log4j2 vulnerability CVE-2021-45046

2021-12-16 00:00:00

mssecure

MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations

2022-08-25 16:00:00

threatpost

APT ‘Aquatic Panda’ Targets Universities with Log4Shell Exploit Tools

2021-12-30 16:16:23

Third Log4J Bug Can Trigger DoS; Apache Issues Patch

2021-12-20 16:01:57

intel

Intel® Product Advisory for Apache Log4j2 Vulnerabilities (CVE-2021-44228 & CVE-2021-45046)

2022-01-12 00:00:00

debiancve

CVE-2021-45046

2021-12-14 19:15:07

ubuntu

Apache Log4j 2 vulnerability

2021-12-15 00:00:00

typo3

Statement on Recent log4j/log4shell Vulnerabilities (CVE-2021-44228)

2021-12-16 00:00:00

symantec

Symantec Security Advisory for Log4j Vulnerability

2021-12-11 01:06:47

qualysblog

How to Discover Log4Shell Vulnerabilities in Running Containers & Images

2021-12-27 19:39:34

nvidia

Security Notice: NVIDIA Response to Log4j Vulnerabilities - December 2021

2021-12-13 00:00:00

cisa

Mitigating Log4Shell and Other Log4j-Related Vulnerabilities

2021-12-22 00:00:00

Solutions

Vulnerabilities intelligence
Perimeter control tool
Linux scanner
Windows scanner
Developers SDK
Security Intelligence feeds

Database

Vulnerabilities
Exploits
Security News
BugBounty
Wild Exploited
Top Vulnerabilities
CVE Feed

Resources

Statics & Sources
Plugins
API docs
FAQ
Blog
Glossary

Company

About
Contacts
Pricing
EULA
Privacy Policy
Submission Policy
OpenSource

@2024 Vulners Inc

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

0.975 High

EPSS

Percentile

100.0%

JSON

Related for NVD:CVE-2021-4125

prion3 cve2 cvelist2 redhatcve2 redhat7 thn4 openvas23 nvd1 githubexploit8 amazon3 nessus17 suse2 ibm75 veracode1 vmware10 github2 ubuntucve1 debian1 attackerkb1 osv4 fortinet1 talosblog3 checkpoint_advisories1 nuclei1 securelist2 mmpc1 huawei1 cisa_kev1 impervablog1 mageia1 malwarebytes1 rapid7blog1 kitploit2 freebsd1 f51 mssecure1 threatpost2 intel1 debiancve1 ubuntu1 typo31 symantec1 qualysblog1 nvidia1 cisa1