CVE-2021-4125

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-24 · updated 2026-06-17
Weakness: CWE-20

Description

It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6.

Affected products

Openshift: from 4.6.0 before 4.6.52; from 4.7.0 before 4.7.40; from 4.8.0 before 4.8.24 — fixed in 4.6.52, 4.7.40, 4.8.24

How to fix

Upgrade to a fixed version: Openshift 4.6.52, 4.7.40, 4.8.24. Check the vendor advisory for mitigations.

References

https://access.redhat.com/security/cve/CVE-2021-4125
https://access.redhat.com/security/cve/CVE-2021-44228
https://access.redhat.com/security/cve/CVE-2021-45046
https://bugzilla.redhat.com/show_bug.cgi?id=2033121
https://github.com/kube-reporting/hive/pull/71
https://github.com/kube-reporting/hive/pull/72
https://github.com/kube-reporting/hive/pull/73
https://access.redhat.com/security/cve/CVE-2021-4125
https://access.redhat.com/security/cve/CVE-2021-44228
https://access.redhat.com/security/cve/CVE-2021-45046
https://bugzilla.redhat.com/show_bug.cgi?id=2033121
https://github.com/kube-reporting/hive/pull/71

Get alerted when CVE-2021-4125 or the next vulnerability affects your stack