It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6.

CPENameOperatorVersion
openshiftge4.8.0
openshiftlt4.8.24
openshiftge4.7.0
openshiftlt4.7.40
openshiftge4.6.0
openshiftlt4.6.52

Name	Operator	Version
openshift	ge	4.8.0
openshift	lt	4.8.24
openshift	ge	4.7.0
openshift	lt	4.7.40
openshift	ge	4.6.0
openshift	lt	4.6.52

References

access.redhat.com/security/cve/CVE-2021-4125

access.redhat.com/security/cve/CVE-2021-44228

access.redhat.com/security/cve/CVE-2021-45046

bugzilla.redhat.com/show_bug.cgi?id=2033121

github.com/kube-reporting/hive/pull/71

github.com/kube-reporting/hive/pull/72

github.com/kube-reporting/hive/pull/73

cve 3

redhatcve 2

redhat 8

checkpoint_advisories 1

ibm 73

nessus 17

talosblog 2

fortinet 1

openvas 25

amazon 5

vmware 10

nuclei 1

githubexploit 7

securelist 2

suse 2

thn 3

veracode 1

prion 2

rapid7blog 2

impervablog 1

mmpc 1

osv 4

malwarebytes 1

cisa_kev 1

github 2

huawei 1

mageia 1

kitploit 2

freebsd 1

f5 1

intel 1

typo3 1

ubuntu 1

mssecure 1

threatpost 1

debiancve 1

attackerkb 2

ubuntucve 1

debian 1

fedora 2

avleonov 1

qualysblog 2

symantec 1

cve

CVE-2021-4125

2022-08-24 16:15:00

CVE-2021-45046

2021-12-14 19:15:00

CVE-2022-33915

2022-06-17 13:15:00

redhatcve

CVE-2021-4125

2021-12-16 02:02:08

CVE-2021-45046

2022-05-07 14:27:31

redhat

(RHSA-2021:5184) Critical: OpenShift Container Platform 4.7.40 security update

2021-12-16 21:35:00

(RHSA-2021:5186) Critical: OpenShift Container Platform 4.6.52 security update

2021-12-16 21:25:00

(RHSA-2021:5183) Critical: OpenShift Container Platform 4.8.24 security update

2021-12-16 21:10:20

checkpoint_advisories

Apache Log4j Remote Code Execution (CVE-2021-44228; CVE-2021-45046)

2021-12-10 00:00:00

ibm

Security Bulletin: Apache Log4j Vulnerability Afffects IBM Secure Proxy (CVE-2021-45046)

2021-12-21 21:33:12

Security Bulletin: There are multiple vulnerabilities in the Apache Log4j used in IBM® QRadar Risk Manager that may allow for remote code execution (RCE).

2022-01-07 16:37:57

Security Bulletin: Vulnerability in Apache Log4j affects IBM Cloud Private (CVE-2021-45046)

2022-01-27 12:22:10

nessus

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2021-001)

2022-05-02 00:00:00

Ubuntu 20.04 LTS : Apache Log4j 2 vulnerability (USN-5197-1)

2021-12-15 00:00:00

FreeBSD : graylog -- remote code execution in log4j from user-controlled log input (650734b2-7665-4170-9a0a-eeced5e10a5e)

2021-12-21 00:00:00

talosblog

Quarterly Report: Incident Response Trends in Q2 2022

2022-07-26 14:03:00

Quarterly Report: Incident Response Trends in Q3 2022

2022-10-25 12:00:00

fortinet

Apache log4j2 log messages substitution (CVE-2021-44228)

2021-12-12 00:00:00

openvas

Ubuntu: Security Advisory (USN-5197-1)

2021-12-16 00:00:00

Debian: Security Advisory (DSA-5022-1)

2021-12-17 00:00:00

openSUSE: Security Advisory for log4j (openSUSE-SU-2021:1601-1)

2022-02-01 00:00:00

amazon

Critical: java-1.8.0-openjdk, java-1.7.0-openjdk, java-1.6.0-openjdk

2021-12-17 17:39:00

Critical: java-17-amazon-corretto, java-11-amazon-corretto, java-1.8.0-openjdk, java-1.7.0-openjdk

2021-12-17 18:12:00

Critical: aws-kinesis-agent

2021-12-16 00:11:00

vmware

VMware Response to Apache Log4j Remote Code Execution Vulnerabilities (CVE-2021-44228, CVE-2021-45046)

2021-12-10 00:00:00

VMware Response to Apache Log4j Remote Code Execution Vulnerability (CVE-2021-44228, CVE-2021-45046)

2021-12-10 00:00:00

VMware Response to Apache Log4j Remote Code Execution Vulnerabilities (CVE-2021-44228, CVE-2021-45046)

2021-12-10 00:00:00

nuclei

Apache Log4j2 - Remote Code Injection

2021-12-23 15:41:50

githubexploit

Exploit for Deserialization of Untrusted Data in Apache Log4J

2021-12-13 11:34:54

Exploit for Deserialization of Untrusted Data in Apache Log4J

2021-12-13 21:57:58

Exploit for Deserialization of Untrusted Data in Apache Log4J

2021-12-16 17:22:17

securelist

CVE-2021-44228 vulnerability in Apache Log4j library

2021-12-13 14:10:21

Answering Log4Shell-related questions

2021-12-20 15:45:30

suse

Security update for log4j (important)

2021-12-20 00:00:00

Security update for log4j (important)

2021-12-17 00:00:00

thn

Researchers Uncover New Drokbk Malware that Uses GitHub as a Dead Drop Resolver

2022-12-09 11:25:00

Hackers Begin Exploiting Second Log4j Vulnerability as a Third Flaw Emerges

2021-12-16 06:24:00

Second Log4j Vulnerability (CVE-2021-45046) Discovered — New Patch Released

2021-12-15 05:26:00

veracode

Denial Of Service (DoS)

2021-12-15 00:30:50

prion

Default configuration

2021-12-14 19:15:00

Race condition

2022-06-17 13:15:00

rapid7blog

How to Protect Your Applications Against Log4Shell With tCell

2021-12-15 14:58:14

Active Exploitation of VMware Horizon Servers

2022-01-18 20:00:15

impervablog

Log4Shell log4j Remote Code Execution – The COVID of the Internet

2022-01-06 16:41:56

mmpc

MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations

2022-08-25 16:00:00

osv

apache-log4j2 vulnerability

2021-12-15 19:02:14

Incomplete fix for Apache Log4j vulnerability

2021-12-14 18:01:28

CVE-2021-45046

2021-12-14 19:15:07

malwarebytes

[Update: CISA issues Log4j vulnerabilities scanner] Log4j zero-day “Log4Shell” arrives just in time to ruin your weekend

2021-12-10 18:03:28

cisa_kev

Apache Log4j2 Deserialization of Untrusted Data Vulnerability

2023-05-01 00:00:00

github

Remote code injection in Log4j

2021-12-10 00:40:56

Incomplete fix for Apache Log4j vulnerability

2021-12-14 18:01:28

huawei

Security Advisory - Apache log4j2 remote code execution vulnerabilities in some Huawei products

2021-12-15 00:00:00

mageia

Updated log4j packages fix security vulnerability

2021-12-19 15:26:08

kitploit

log4j-scan - A fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts

2021-12-20 11:30:00

Log4J-Detector - Detects Log4J versions on your file-system within any application that are vulnerable to CVE-2021-44228 and CVE-2021-45046

2021-12-20 04:38:00

freebsd

graylog -- remote code execution in log4j from user-controlled log input

2021-11-14 00:00:00

K32171392 : Apache Log4j2 vulnerability CVE-2021-45046

2021-12-16 00:00:00

intel

Intel® Product Advisory for Apache Log4j2 Vulnerabilities (CVE-2021-44228 & CVE-2021-45046)

2022-01-12 00:00:00

typo3

Statement on Recent log4j/log4shell Vulnerabilities (CVE-2021-44228)

2021-12-16 00:00:00

ubuntu

Apache Log4j 2 vulnerability

2021-12-15 00:00:00

mssecure

MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations

2022-08-25 16:00:00

threatpost

APT ‘Aquatic Panda’ Targets Universities with Log4Shell Exploit Tools

2021-12-30 16:16:23

debiancve

CVE-2021-45046

2021-12-14 19:15:00

attackerkb

CVE-2021-45046

2021-12-14 00:00:00

CVE-2021-44228 (Log4Shell)

2022-02-08 00:00:00

ubuntucve

CVE-2021-45046

2021-12-14 00:00:00

debian

[SECURITY] [DSA 5022-1] apache-log4j2 security update

2021-12-16 10:29:17

fedora

[SECURITY] Fedora 34 Update: log4j-2.17.0-1.fc34

2021-12-27 00:56:30

[SECURITY] Fedora 35 Update: log4j-2.17.0-1.fc35

2021-12-27 00:41:40

avleonov

Log4j “Log4Shell” RCE explained (CVE-2021-44228)

2021-12-26 22:07:17

qualysblog

How to Discover Log4Shell Vulnerabilities in Running Containers & Images

2021-12-27 19:39:34

6 Ways to Quickly Detect a Log4Shell Exploit in Your Environment

2021-12-20 05:41:36

symantec

Symantec Security Advisory for Log4j Vulnerability

2021-12-11 01:06:47

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

75.8%

JSON

Related for PRION:CVE-2021-4125