Red Hat Security Advisory

RHSA-2021:5183

OpenShift Container Platform 4.8.24 security update

Released 2021-12-16 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.8 openshift4/ose-metering-hive

Fixes 2 records

TI-2021-02983 CVE-2021-4104 · GHSA-fp5r-v3w9-4333

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

HIGH 73

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.80599 Published 2021-12-14 Partial fix CWE-502

TI-2021-03001 CVE-2021-4125 · GHSA-jr7q-cc2x-97vj

Improper input validation in kube-reporting/hive

LOW 38

It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01523 Published 2022-08-24 Fixed CWE-20