RHSA-2021:5106CriticalCVSS 9.8

Red Hat Security Advisory: OpenShift Container Platform 4.6.z security update

Published
December 16, 2021
Last Modified
August 2, 2026

🔗 CVE IDs covered (2)

CVE-2021-44228 →CVE-2021-45046 →

📋 Description

CVE-2021-44228 — log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value CVE-2021-45046 — log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)

🎯 Affected products11

  • Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-elasticsearch-operator-bundle@sha256:b0b6c17769c6ec87496d14b2bcfbfbd035782671bbf6e6934dc2f240f1033902_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-elasticsearch-operator@sha256:8db02b3087c2c89bafaf6896d67462af54e77ba3c2fb299a84ab7886f1b92ce1_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-elasticsearch-operator@sha256:d0916cd9a19901ff6c8b24f0f27db9e9f9322f8fc6eb9e773c4b43fe98800416_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-elasticsearch-operator@sha256:dfd7356ce68d9ff2498655c07b7d700872185597c0c2855d6721acb2ae5e6b5c_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-logging-elasticsearch6@sha256:416510e6e489dfb1ab1f0b2091015dcb0adac637ed37f1e18d30f128c45b93d2_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-logging-elasticsearch6@sha256:8b0d423982c960d81f8e1ade8482ba064507863283aec360ac63f31f0ffdb24f_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-logging-elasticsearch6@sha256:ebc6a802dc110dddaae352c3a142fbeae1169d5c35fc0f77ef7e64b810c863af_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-metering-ansible-operator-bundle@sha256:7c67b7bcdc6e35f38905aff84f007a2b77c727836f256a0c038934ab62c7011e_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-metering-ansible-operator@sha256:fc3a7d606162c571647e0a4f6184091eddc1fe360e93d7692d1195559a7a74db_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-metering-hive@sha256:2a8670a968b37e04539c052b399e539d60a006bdf4e46d5066bc04530da8f532_amd64 as a component of Red Hat OpenShift Container Platform 4.6

✅ Remediation

For OpenShift Container Platform 4.6 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html Workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441 Workaround: For Log4j versions up to and including 2.15.0, this issue can be mitigated by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).

🔗 References (6)