CVE-2021-4125
Last modified
CVE-2021-4125 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6.. EPSS estimates a 1.19% chance of exploitation in the next 30 days.
Description
It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Openshift | >= 4.6.0, < 4.6.52 |
| Redhat | Openshift | >= 4.7.0, < 4.7.40 |
| Redhat | Openshift | >= 4.8.0, < 4.8.24 |
References
- https://access.redhat.com/security/cve/CVE-2021-4125Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2021-44228Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2021-45046Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2033121Issue Tracking, Patch, Third Party Advisory
- https://github.com/kube-reporting/hive/pull/71Third Party Advisory
- https://github.com/kube-reporting/hive/pull/72Third Party Advisory
- https://github.com/kube-reporting/hive/pull/73Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2021-4125Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2021-44228Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2021-45046Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2033121Issue Tracking, Patch, Third Party Advisory
- https://github.com/kube-reporting/hive/pull/71Third Party Advisory
- https://github.com/kube-reporting/hive/pull/72Third Party Advisory
- https://github.com/kube-reporting/hive/pull/73Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-4125?
How severe is CVE-2021-4125?
How do I fix CVE-2021-4125?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-41244Grafana is an open-source platform for monitoring and observ…7.2
- CVE-2021-41245Combodo iTop is a web based IT Service Management tool. In v…8.1
- CVE-2021-41246Express OpenID Connect is express JS middleware implementing…8.8
- CVE-2021-41247JupyterHub is an open source multi-user server for Jupyter n…7.5
- CVE-2021-41248GraphiQL is the reference implementation of this monorepo, G…4.7
- CVE-2021-41249GraphQL Playground is a GraphQL IDE for development of graph…4.7
- CVE-2021-41250Python discord bot is the community bot for the Python Disco…4.3
- CVE-2021-41251@sap-cloud-sdk/core contains the core functionality of the S…5.9
- CVE-2021-41252Kirby is an open source file structured CMS ### Impact Kirby…5.4
- CVE-2021-41253Zydis is an x86/x86-64 disassembler library. Users of Zydis …8.1
- CVE-2021-41254kustomize-controller is a Kubernetes operator, specialized i…8.8
- CVE-2021-41256nextcloud news-android is an Android client for the Nextclou…7.1
Are you affected by CVE-2021-4125?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST