{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_vex", "csaf_version": "2.0", "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "title": "unauthorized access to critical", "tracking": { "current_release_date": "2026-08-11T14:54:13+00:00", "generator": { "date": "2026-08-11T14:54:13+00:00", "engine": { "name": "CSAF Generator", "version": "3.3.0" } }, "id": "CVE-2021-2471", "initial_release_date": "2021-10-20T00:00:00+00:00", "revision_history": [ { "date": "2026-08-11T14:54:13+00:00", "number": "1", "summary": "Last generated version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "category": "vendor", "name": "Red Hat", "branches": [ { "category": "product_name", "name": "OpenShift Container Platform 4.12", "product": { "name": "OpenShift Container Platform 4.12", "product_id": "openshift-4.12.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.12" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.13", "product": { "name": "OpenShift Container Platform 4.13", "product_id": "openshift-4.13.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.13" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.14", "product": { "name": "OpenShift Container Platform 4.14", "product_id": "openshift-4.14.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.14" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.15.z", "product": { "name": "OpenShift Container Platform 4.15.z", "product_id": "openshift-4.15.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.15" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.16.z", "product": { "name": "OpenShift Container Platform 4.16.z", "product_id": "openshift-4.16.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.16" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.17", "product": { "name": "OpenShift Container Platform 4.17", "product_id": "openshift-4.17", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.17" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.18", "product": { "name": "OpenShift Container Platform 4.18", "product_id": "openshift-4.18", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.18" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.19", "product": { "name": "OpenShift Container Platform 4.19", "product_id": "openshift-4.19", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.19" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.20", "product": { "name": "OpenShift Container Platform 4.20", "product_id": "openshift-4.20", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.20" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux 6-els", "product": { "name": "Red Hat Enterprise Linux 6-els", "product_id": "rhel-6-els.els", "product_identification_helper": { "cpe": "cpe:/o:redhat:rhel_els:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux 7-els", "product": { "name": "Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els", "product_identification_helper": { "cpe": "cpe:/o:redhat:rhel_els:7" } } }, { "category": "product_name", "name": "Red Hat Satellite", "product": { "name": "Red Hat Satellite", "product_id": "rhn_satellite_6-default", "product_identification_helper": { "cpe": "cpe:/a:redhat:satellite:6" } } }, { "category": "product_version", "name": "candlepin", "product": { "name": "candlepin", "product_id": "candlepin", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin" } } }, { "category": "product_version", "name": "candlepin-selinux", "product": { "name": "candlepin-selinux", "product_id": "candlepin-selinux", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-selinux" } } }, { "category": "product_version", "name": "candlepin-tomcat", "product": { "name": "candlepin-tomcat", "product_id": "candlepin-tomcat", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-tomcat" } } }, { "category": "product_version", "name": "candlepin-tomcat6", "product": { "name": "candlepin-tomcat6", "product_id": "candlepin-tomcat6", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-tomcat6" } } }, { "category": "product_version", "name": "candlepin", "product": { "name": "candlepin", "product_id": "candlepin.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin?arch=src" } } }, { "category": "product_version", "name": "mysql-connector-java", "product": { "name": "mysql-connector-java", "product_id": "mysql-connector-java", "product_identification_helper": { "purl": "pkg:rpm/redhat/mysql-connector-java" } } }, { "category": "product_version", "name": "mysql-connector-java", "product": { "name": "mysql-connector-java", "product_id": "mysql-connector-java.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/mysql-connector-java?arch=src" } } }, { "category": "product_version", "name": "openshift4/ose-metering-presto", "product": { "name": "openshift4/ose-metering-presto", "product_id": "openshift4/ose-metering-presto", "product_identification_helper": { "purl": "pkg:oci/ose-metering-presto?repository_url=registry.redhat.io/openshift4/ose-metering-presto" } } } ] } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "candlepin as a component of Red Hat Satellite", "product_id": "rhn_satellite_6-default:candlepin" }, "product_reference": "candlepin", "relates_to_product_reference": "rhn_satellite_6-default" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-selinux as a component of Red Hat Satellite", "product_id": "rhn_satellite_6-default:candlepin-selinux" }, "product_reference": "candlepin-selinux", "relates_to_product_reference": "rhn_satellite_6-default" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-tomcat as a component of Red Hat Satellite", "product_id": "rhn_satellite_6-default:candlepin-tomcat" }, "product_reference": "candlepin-tomcat", "relates_to_product_reference": "rhn_satellite_6-default" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-tomcat6 as a component of Red Hat Satellite", "product_id": "rhn_satellite_6-default:candlepin-tomcat6" }, "product_reference": "candlepin-tomcat6", "relates_to_product_reference": "rhn_satellite_6-default" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin.src as a component of Red Hat Satellite", "product_id": "rhn_satellite_6-default:candlepin.src" }, "product_reference": "candlepin.src", "relates_to_product_reference": "rhn_satellite_6-default" }, { "category": "default_component_of", "full_product_name": { "name": "mysql-connector-java as a component of Red Hat Enterprise Linux 6-els", "product_id": "rhel-6-els.els:mysql-connector-java" }, "product_reference": "mysql-connector-java", "relates_to_product_reference": "rhel-6-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "mysql-connector-java as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:mysql-connector-java" }, "product_reference": "mysql-connector-java", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "mysql-connector-java.src as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:mysql-connector-java.src" }, "product_reference": "mysql-connector-java.src", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "mysql-connector-java.src as a component of Red Hat Enterprise Linux 6-els", "product_id": "rhel-6-els.els:mysql-connector-java.src" }, "product_reference": "mysql-connector-java.src", "relates_to_product_reference": "rhel-6-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.12", "product_id": "openshift-4.12.z:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.12.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.15.z", "product_id": "openshift-4.15.z:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.15.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.18", "product_id": "openshift-4.18:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.18" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.16.z", "product_id": "openshift-4.16.z:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.16.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.14", "product_id": "openshift-4.14.z:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.14.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.20", "product_id": "openshift-4.20:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.20" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.19", "product_id": "openshift-4.19:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.19" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.13", "product_id": "openshift-4.13.z:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.13.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.17", "product_id": "openshift-4.17:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.17" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-2471", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2021-11-05T00:00:00+00:00", "notes": [ { "category": "other", "text": "In OpenShift Container Platform (OCP), the Presto component is part of the OCP Metering stack and it ships the vulnerable version of the MySQL Connector/J package. Since the release of OCP 4.6, the Metering product has been deprecated and is removed from OCP starting from 4.9 version [1], hence the affected component is marked as wontfix.\n\n[1] https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html#ocp-4-9-deprecated-removed-features", "title": "Statement" }, { "category": "description", "text": "MySQL Connector/J has no security check when external general entities are included in XML sources, consequently, there exists an XML External Entity(XXE) vulnerability. A successful attack can access critical data and gain full control/access to all MySQL Connectors' accessible data without any authorization.", "title": "Vulnerability description" } ], "product_status": { "known_affected": [ "openshift-4.12.z:openshift4/ose-metering-presto", "openshift-4.13.z:openshift4/ose-metering-presto", "openshift-4.14.z:openshift4/ose-metering-presto", "openshift-4.15.z:openshift4/ose-metering-presto", "openshift-4.16.z:openshift4/ose-metering-presto", "openshift-4.17:openshift4/ose-metering-presto", "openshift-4.18:openshift4/ose-metering-presto", "openshift-4.19:openshift4/ose-metering-presto", "openshift-4.20:openshift4/ose-metering-presto", "rhel-6-els.els:mysql-connector-java", "rhel-6-els.els:mysql-connector-java.src", "rhel-7-els.els:mysql-connector-java", "rhel-7-els.els:mysql-connector-java.src", "rhn_satellite_6-default:candlepin", "rhn_satellite_6-default:candlepin-selinux", "rhn_satellite_6-default:candlepin-tomcat", "rhn_satellite_6-default:candlepin-tomcat6", "rhn_satellite_6-default:candlepin.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-2471" }, { "category": "external", "summary": "nvd.nist.gov", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-2471" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2021-2471" } ], "remediations": [ { "category": "no_fix_planned", "details": "Will not fix", "product_ids": [ "openshift-4.12.z:openshift4/ose-metering-presto", "openshift-4.13.z:openshift4/ose-metering-presto", "openshift-4.14.z:openshift4/ose-metering-presto", "openshift-4.15.z:openshift4/ose-metering-presto", "openshift-4.16.z:openshift4/ose-metering-presto", "openshift-4.17:openshift4/ose-metering-presto", "openshift-4.18:openshift4/ose-metering-presto", "openshift-4.19:openshift4/ose-metering-presto", "openshift-4.20:openshift4/ose-metering-presto", "rhn_satellite_6-default:candlepin", "rhn_satellite_6-default:candlepin-selinux", "rhn_satellite_6-default:candlepin-tomcat", "rhn_satellite_6-default:candlepin-tomcat6", "rhn_satellite_6-default:candlepin.src" ] }, { "category": "no_fix_planned", "details": "Out of support scope", "product_ids": [ "rhel-6-els.els:mysql-connector-java", "rhel-6-els.els:mysql-connector-java.src", "rhel-7-els.els:mysql-connector-java", "rhel-7-els.els:mysql-connector-java.src" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.4, "baseSeverity": "HIGH" }, "products": [ "openshift-4.12.z:openshift4/ose-metering-presto", "openshift-4.13.z:openshift4/ose-metering-presto", "openshift-4.14.z:openshift4/ose-metering-presto", "openshift-4.15.z:openshift4/ose-metering-presto", "openshift-4.16.z:openshift4/ose-metering-presto", "openshift-4.17:openshift4/ose-metering-presto", "openshift-4.18:openshift4/ose-metering-presto", "openshift-4.19:openshift4/ose-metering-presto", "openshift-4.20:openshift4/ose-metering-presto", "rhel-6-els.els:mysql-connector-java", "rhel-6-els.els:mysql-connector-java.src", "rhel-7-els.els:mysql-connector-java", "rhel-7-els.els:mysql-connector-java.src", "rhn_satellite_6-default:candlepin", "rhn_satellite_6-default:candlepin-selinux", "rhn_satellite_6-default:candlepin-tomcat", "rhn_satellite_6-default:candlepin-tomcat6", "rhn_satellite_6-default:candlepin.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate", "product_ids": [ "openshift-4.12.z:openshift4/ose-metering-presto", "openshift-4.13.z:openshift4/ose-metering-presto", "openshift-4.14.z:openshift4/ose-metering-presto", "openshift-4.15.z:openshift4/ose-metering-presto", "openshift-4.16.z:openshift4/ose-metering-presto", "openshift-4.17:openshift4/ose-metering-presto", "openshift-4.18:openshift4/ose-metering-presto", "openshift-4.19:openshift4/ose-metering-presto", "openshift-4.20:openshift4/ose-metering-presto", "rhel-6-els.els:mysql-connector-java", "rhel-6-els.els:mysql-connector-java.src", "rhel-7-els.els:mysql-connector-java", "rhel-7-els.els:mysql-connector-java.src" ] }, { "category": "impact", "details": "Low", "product_ids": [ "rhn_satellite_6-default:candlepin", "rhn_satellite_6-default:candlepin-selinux", "rhn_satellite_6-default:candlepin-tomcat", "rhn_satellite_6-default:candlepin-tomcat6", "rhn_satellite_6-default:candlepin.src" ] } ], "title": "unauthorized access to critical" } ] }