RHSA-2021:5148CriticalCVSS 9.8

Red Hat Security Advisory: OpenShift Container Platform 4.8.24 extras security update

Published
December 15, 2021
Last Modified
August 2, 2026

🔗 CVE IDs covered (3)

CVE-2021-4104 →CVE-2021-44228 →CVE-2021-45046 →

📋 Description

CVE-2021-4104 — log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender CVE-2021-44228 — log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value CVE-2021-45046 — log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)

🎯 Affected products5

  • Red Hat OpenShift Container Platform 4.8
  • openshift4/ose-metering-ansible-operator-bundle@sha256:5cc4e959806f4e9cd47b5d8a505b8c6c86775632aee35908a0928bfeede818ad_amd64 as a component of Red Hat OpenShift Container Platform 4.8
  • openshift4/ose-metering-ansible-operator@sha256:d0d3215ab63ee9893806eedf23fbb2b2237683fbe9c20138b1450f89a231092f_amd64 as a component of Red Hat OpenShift Container Platform 4.8
  • openshift4/ose-metering-hadoop@sha256:50ecba62addb91627e4adad209f95fb910cc16584a1437764e1585430fec30a1_amd64 as a component of Red Hat OpenShift Container Platform 4.8
  • openshift4/ose-metering-presto@sha256:2c449bb93534c6dc17961624ff67bd9e7ef07b5799367a4e0467f8dcadeaf35f_amd64 as a component of Red Hat OpenShift Container Platform 4.8

✅ Remediation

For OpenShift Container Platform 4.8 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html Workaround: These are the possible mitigations for this flaw for releases version 1.x: - Comment out or remove JMSAppender in the Log4j configuration if it is used - Remove the JMSAppender class from the classpath. For example: ``` zip -q -d log4j-*.jar org/apache/log4j/net/JMSAppender.class ``` - Restrict access for the OS user on the platform running the application to prevent modifying the Log4j configuration by the attacker. Workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441 Workaround: For Log4j versions up to and including 2.15.0, this issue can be mitigated by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).

🔗 References (7)