~ / search / GHSA-vwqq-5vrc-xw9h

GHSA-vwqq-5vrc-xw9h

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

Source: GitHub Advisory Database (reviewed) Low CVE-2020-9488

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.logging.log4j:log4j >= 2.13.0, < 2.13.2 2.13.2
Maven org.apache.logging.log4j:log4j-core >= 2.13.0, < 2.13.2 2.13.2
Maven org.apache.logging.log4j:log4j >= 2.4.0, < 2.12.3 2.12.3
Maven org.apache.logging.log4j:log4j < 2.3.2 2.3.2
Maven org.apache.logging.log4j:log4j-core >= 2.4.0, < 2.12.3 2.12.3
Maven org.apache.logging.log4j:log4j-core < 2.3.2 2.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

References

External links from the advisory. They lead to third-party sites.