CVE-2021-4125

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-502

Affected software

Vendor	Product	Versions
n/a	kube-reporting/hive	Fixed in v4.8, v4.7 and v4.6

References

https://access.redhat.com/security/cve/CVE-2021-4125Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-44228Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-45046Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2033121Issue Tracking, Patch, Third Party Advisory
https://github.com/kube-reporting/hive/pull/71Third Party Advisory
https://github.com/kube-reporting/hive/pull/72Third Party Advisory
https://github.com/kube-reporting/hive/pull/73Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-4125Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-44228Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-45046Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2033121Issue Tracking, Patch, Third Party Advisory
https://github.com/kube-reporting/hive/pull/71Third Party Advisory
https://github.com/kube-reporting/hive/pull/72Third Party Advisory
https://github.com/kube-reporting/hive/pull/73Third Party Advisory

Timeline

Published: Aug 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-412504.3Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise t CVE-2021-412515.9@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This CVE-2021-412525.4Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other fie CVE-2021-412538.1Zydis is an x86/x86-64 disassembler library. Users of Zydis versions v3.2.0 and older that use the string functions provided in `zycore` in CVE-2021-412548.8kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined CVE-2021-412567.1nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app CVE-2021-412585.4Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is t CVE-2021-41266.5When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added CVE-2021-412608.8Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do n CVE-2021-412614.8Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are CVE-2021-412628.8Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are CVE-2021-412638.8rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications usi