VDB
RHSA-2021:5107
RHSA-2021:5107
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender and to the attacker's JNDI LDAP endpoint.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-metering-presto@sha256:795baa6f38910a8c35d179b8449cd8df3ad7644b9a0a13dad8407519902037e9_amd64 as a component of Red Hat OpenShift Container Platform 4.7 | openshift4/ose-metering-presto@sha256:795baa6f38910a8c35d179b8449cd8df3ad7644b9a0a13dad8407519902037e9_amd64 |
| Red Hat | openshift4/ose-metering-ansible-operator-bundle@sha256:665d34bc3e69cda3c37699051cfee983cf14f6d5f67d56d949652230937dcc90_amd64 as a component of Red Hat OpenShift Container Platform 4.7 | * |
| Red Hat | openshift4/ose-metering-hive@sha256:3ae0917ca765603722b54a392bc5f1edc6c41b6c7d4c5eca95ed99c1d8af3d1c_amd64 as a component of Red Hat OpenShift Container Platform 4.7 | openshift4/ose-metering-hive@sha256:3ae0917ca765603722b54a392bc5f1edc6c41b6c7d4c5eca95ed99c1d8af3d1c_amd64 |
| Red Hat | openshift4/ose-metering-ansible-operator@sha256:5a2aa59c1c7a1423ec5fa39eabfc0dfa41cea0db82c9fc1f5c2ce9923ee792f4_amd64 as a component of Red Hat OpenShift Container Platform 4.7 | * |
| Red Hat | openshift4/ose-metering-hadoop@sha256:03a4dd392453720b3950efa522682f5d07938c4d36e4269658c5a555afa403e7_amd64 as a component of Red Hat OpenShift Container Platform 4.7 | openshift4/ose-metering-hadoop@sha256:03a4dd392453720b3950efa522682f5d07938c4d36e4269658c5a555afa403e7_amd64 |
Timeline
- Dec 16, 2021 CVE Published
- Apr 28, 2026 CVE Updated
- Apr 28, 2026 Distribution Patch
- Apr 28, 2026 Distribution Patch
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2021:5107 advisory
- https://access.redhat.com/security/updates/classification/#critical advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2021-009 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2030932 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2031667 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2032580 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5107.json advisory
- https://access.redhat.com/security/cve/CVE-2021-4104 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-4104 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-4104 advisory
- https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126 advisory
- https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301 advisory
- https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx advisory
- https://www.openwall.com/lists/oss-security/2021/12/13/1 advisory
- https://access.redhat.com/security/cve/CVE-2021-44228 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-44228 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228 advisory
- https://github.com/advisories/GHSA-jfh8-c2jp-5v3q advisory
- https://logging.apache.org/log4j/2.x/security.html advisory
- https://www.lunasec.io/docs/blog/log4j-zero-day/ advisory
…and 5 more