GitHub Advisoryadvisory · Maven

GHSA-vwqq-5vrc-xw9h Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

LOW Published 2020-06-05 Modified 2026-06-09 Official page ↗
Aliases
CVE-2020-9488
Ecosystem
Maven
Packages
org.apache.logging.log4j:log4j, org.apache.logging.log4j:log4j-core
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-295
Reviewed
2020-06-04

Affected packages

• Maven org.apache.logging.log4j:log4j: >= 2.13.0, < 2.13.2 → fixed in 2.13.2 • Maven org.apache.logging.log4j:log4j-core: >= 2.13.0, < 2.13.2 → fixed in 2.13.2 • Maven org.apache.logging.log4j:log4j: >= 2.4.0, < 2.12.3 → fixed in 2.12.3 • Maven org.apache.logging.log4j:log4j: < 2.3.2 → fixed in 2.3.2 • Maven org.apache.logging.log4j:log4j-core: >= 2.4.0, < 2.12.3 → fixed in 2.12.3 • Maven org.apache.logging.log4j:log4j-core: < 2.3.2 → fixed in 2.3.2

Description

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

Related

Alias · CVE (1)

  • CVE-2020-9488 Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References