{"containers": {"cna": {"affected": [{"product": "kube-reporting/hive", "vendor": "n/a", "versions": [{"status": "affected", "version": "Fixed in v4.8, v4.7 and v4.6"}]}], "descriptions": [{"lang": "en", "value": "It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 - Improper Input Validation, CWE-502 - Deserialization of Untrusted Data, CWE-400 - Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-08-24T15:09:17", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2033121"}, {"tags": ["x_refsource_MISC"], "url": "https://access.redhat.com/security/cve/CVE-2021-4125"}, {"tags": ["x_refsource_MISC"], "url": "https://access.redhat.com/security/cve/CVE-2021-44228"}, {"tags": ["x_refsource_MISC"], "url": "https://access.redhat.com/security/cve/CVE-2021-45046"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/kube-reporting/hive/pull/71"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/kube-reporting/hive/pull/72"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/kube-reporting/hive/pull/73"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:16:04.248Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2033121"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://access.redhat.com/security/cve/CVE-2021-4125"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://access.redhat.com/security/cve/CVE-2021-44228"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://access.redhat.com/security/cve/CVE-2021-45046"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kube-reporting/hive/pull/71"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kube-reporting/hive/pull/72"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kube-reporting/hive/pull/73"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2021-4125", "datePublished": "2022-08-24T15:09:17", "dateReserved": "2021-12-16T00:00:00", "dateUpdated": "2024-08-03T17:16:04.248Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift:*:*:*:*:*:*:*:*", "matchCriteriaId": "F788739F-0B28-4751-9A4E-E0C5B7F79613", "versionEndExcluding": "4.6.52", "versionStartIncluding": "4.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C2659CC-7CA5-49B2-901D-DE3E1693C3E3", "versionEndExcluding": "4.7.40", "versionStartIncluding": "4.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE4321F9-4224-47EF-9853-9C891EFB86DD", "versionEndExcluding": "4.8.24", "versionStartIncluding": "4.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6."}, {"lang": "es", "value": "Se ha detectado que la correcci\u00f3n original para log4j CVE-2021-44228 y CVE-2021-45046 en los contenedores hive de medici\u00f3n de OpenShift estaba incompleta, ya que no fueron eliminados todos los archivos JndiLookup.class. Esta CVE s\u00f3lo es aplicada a im\u00e1genes de contenedores hive de OpenShift Metering, enviadas en OpenShift versiones 4.8, 4.7 y 4.6."}], "id": "CVE-2021-4125", "lastModified": "2023-11-07T03:40:13.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-08-24T16:15:09.483", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2021-4125"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2021-44228"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2021-45046"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2033121"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://github.com/kube-reporting/hive/pull/71"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://github.com/kube-reporting/hive/pull/72"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://github.com/kube-reporting/hive/pull/73"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2021:5186", "cpe": "cpe:/a:redhat:openshift:4.6::el8", "package": "openshift4/ose-metering-hive:v4.6.0-202112160147.p0.gf139e12.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.6", "release_date": "2021-12-16T00:00:00Z"}, {"advisory": "RHSA-2021:5184", "cpe": "cpe:/a:redhat:openshift:4.7::el8", "package": "openshift4/ose-metering-hive:v4.7.0-202112160422.p0.g6a2b6aa.assembly.4.7.40", "product_name": "Red Hat OpenShift Container Platform 4.7", "release_date": "2021-12-16T00:00:00Z"}, {"advisory": "RHSA-2021:5183", "cpe": "cpe:/a:redhat:openshift:4.8::el8", "package": "openshift4/ose-metering-hive:v4.8.0-202112160147.p0.g5672016.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.8", "release_date": "2021-12-16T00:00:00Z"}], "bugzilla": {"description": "kube-reporting/hive: Incomplete fix for log4j CVE-2021-44228 and CVE-2021-45046", "id": "2033121", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2033121"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "details": ["It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6.", "It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed."], "mitigation": {"lang": "en:us", "value": "Please follow the Mitigation advice for the original CVEs."}, "name": "CVE-2021-4125", "public_date": "2021-12-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-4125\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-4125\nhttps://access.redhat.com/security/cve/CVE-2021-44228\nhttps://access.redhat.com/security/cve/CVE-2021-45046"], "statement": "This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6. The below previously shipped advisories were incomplete:\nhttps://access.redhat.com/errata/RHSA-2021:5108\nhttps://access.redhat.com/errata/RHSA-2021:5107\nhttps://access.redhat.com/errata/RHSA-2021:5106\nFor the complete fix, customers should upgrade to the images shipped in these advisories:\n4.8.24: https://access.redhat.com/errata/RHSA-2021:5183\n4.7.40: https://access.redhat.com/errata/RHSA-2021:5184\n4.6.52 https://access.redhat.com/errata/RHSA-2021:5186\nThe OpenShift Metering hive container images were deprecated in OpenShift 4.8, and not shipped in 4.9 or later.", "threat_severity": "Critical"}