CVE-2021-4104

high

Published 2021-12-14 · Modified 2022-01-26

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

7.5

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.5

Description

RHSA-2022:0290: parfait:0.5 security update (Important)

Predictions

Exploit likelihood

83%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact

Fedora Affected 1 release

Version	Status	Fixed in
35	Affected	—

SUSE Affected 1 release

Version	Status	Fixed in
—	Affected	—

Red Hat Mixed 4 releases

Version	Status	Fixed in
8.0	Affected	—
8	Fixed	—
7.0	Affected	—
6.0	Affected	—

AlmaLinux Fixed 1 release

Version	Status	Fixed in
8	Fixed	`uom-lib-1.0.1-6.module_el8.5.0+2610+de2b8c0b.noarch.rpm`

Debian Fixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`1.2.17-11`
sid	Fixed	`1.2.17-11`
forky	Fixed	`1.2.17-11`
bullseye	Fixed	`1.2.17-10+deb11u1`
bookworm	Fixed	`1.2.17-11`

Rocky Linux Fixed 1 release

Version	Status	Fixed in
8	Fixed	—

Package impact

Ecosystem	Package	Vulnerable	Fixed
Maven	log4j:log4j	`>=1.2.0,<=1.2.17`
Maven	org.zenframework.z8.dependencies.commons:log4j-1.2.17	`<=2.0`

Application impact

Vendor	Product	Versions	Fixed
apache	log4j	`1.2`
redhat	codeready_studio	`12.0`
redhat	integration_camel_k	`-`
redhat	integration_camel_quarkus	`-`
redhat	jboss_a-mq	`6.0.0`
redhat	jboss_a-mq	`7`
redhat	jboss_a-mq_streaming	`-`
redhat	jboss_data_grid	`7.0.0`
redhat	jboss_data_virtualization	`6.0.0`
redhat	jboss_enterprise_application_platform	`6.0.0`
redhat	jboss_enterprise_application_platform	`7.0`
redhat	jboss_fuse	`6.0.0`
redhat	jboss_fuse	`7.0.0`
redhat	jboss_fuse_service_works	`6.0`
redhat	jboss_operations_network	`3.0`
redhat	jboss_web_server	`3.0`
redhat	openshift_application_runtimes	`-`
redhat	openshift_container_platform	`4.6`
redhat	openshift_container_platform	`4.7`
redhat	openshift_container_platform	`4.8`
redhat	process_automation	`7.0`
redhat	single_sign-on	`7.0`
redhat	software_collections	`-`
oracle	advanced_supply_chain_planning	`12.1`
oracle	advanced_supply_chain_planning	`12.2`
oracle	business_intelligence	`5.9.0.0.0`
oracle	business_intelligence	`12.2.1.3.0`
oracle	business_intelligence	`12.2.1.4.0`
oracle	business_process_management_suite	`12.2.1.3.0`
oracle	business_process_management_suite	`12.2.1.4.0`
oracle	communications_eagle_ftp_table_base_retrieval	`4.5`
oracle	communications_messaging_server	`8.1`
oracle	communications_network_integrity	`7.3.6`
oracle	communications_offline_mediation_controller	`{"endExcluding":"12.0.0.4.0"}`	`12.0.0.4.0`
oracle	communications_offline_mediation_controller	`12.0.0.5.0`
oracle	communications_unified_inventory_management	`7.3.4`
oracle	communications_unified_inventory_management	`7.3.5`
oracle	communications_unified_inventory_management	`7.4.1`
oracle	communications_unified_inventory_management	`7.4.2`
oracle	e-business_suite_cloud_manager_and_cloud_backup_module	`2.2.1.1.1`
oracle	enterprise_manager_base_platform	`13.4.0.0`
oracle	enterprise_manager_base_platform	`13.5.0.0`
oracle	financial_services_revenue_management_and_billing_analytics	`2.7.0.0`
oracle	financial_services_revenue_management_and_billing_analytics	`2.7.0.1`
oracle	financial_services_revenue_management_and_billing_analytics	`2.8.0.0`
oracle	fusion_middleware_common_libraries_and_tools	`12.2.1.4.0`
oracle	goldengate	`-`
oracle	healthcare_data_repository	`8.1.0`
oracle	hyperion_data_relationship_management	`{"endExcluding":"11.2.8.0"}`	`11.2.8.0`
oracle	hyperion_infrastructure_technology	`{"endExcluding":"11.2.8.0"}`	`11.2.8.0`
oracle	identity_management_suite	`12.2.1.3.0`
oracle	identity_management_suite	`12.2.1.4.0`
oracle	jdeveloper	`12.2.1.3.0`
oracle	mysql_enterprise_monitor	`{"endIncluding":"8.0.29"}`
oracle	retail_allocation	`14.1.3.2`
oracle	retail_allocation	`15.0.3.1`
oracle	retail_allocation	`16.0.3`
oracle	retail_allocation	`19.0.1`
oracle	retail_extract_transform_and_load	`13.2.5`
oracle	stream_analytics	`-`
oracle	timesten_grid	`-`
oracle	tuxedo	`12.2.2.0.0`
oracle	utilities_testing_accelerator	`6.0.0.1.1`
oracle	utilities_testing_accelerator	`6.0.0.2.2`
oracle	utilities_testing_accelerator	`6.0.0.3.1`
oracle	weblogic_server	`12.2.1.3.0`
oracle	weblogic_server	`12.2.1.4.0`
oracle	weblogic_server	`14.1.1.0.0`

References

CWEs

CWE-502

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.