Improper Certificate Validation in Apache Log4j SMTP Appender by Apache
CVE-2020-9488

3.7LOW

Key Information:

Vendor
Apache
Status
Apache Log4j
Vendor
CVE Published:
27 April 2020

Summary

The vulnerability involves improper validation of certificates with host mismatches in the Apache Log4j SMTP appender. This flaw could enable attackers to intercept SMTPS connections, potentially leading to unauthorized access and exposure of sensitive log messages transmitted via that appender. The issue has been addressed and resolved in Apache Log4j versions 2.12.3 and 2.13.1.

Affected Version(s)

Apache Log4j log4j-core 2.13.0

Apache Log4j log4j-core < 2.12.3

References

https://lists.apache.org/thread.html/r8c001b9a95c0bbec06f...
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r2f209d271349bafd915...
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r7641ee788e1eb1be4bb...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.