CVE-2020-9488 Security Details

CVE ID

CVE-2020-9488

CWE

CWE-295

CVE Description

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Published

Apr 29, 2020

CVSS Score & Severity

3.7Low

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score

0.037%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/logging/log4j/core/net/SMTPManager.getSMTPManager(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;ILjava/lang/String;Ljava/lang/String;ZLjava/lang/String;I)Lorg/apache/logging/log4j/core/net/SMTPManager;

JVM

org/apache/logging/log4j/core/net/SmtpManager$FactoryData.<init>(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Lorg/apache/logging/log4j/core/layout/AbstractStringLayout$Serializer;Ljava/lang/String;Ljava/lang/String;ILjava/lang/String;Ljava/lang/String;ZI)V

JVM

org/apache/logging/log4j/core/net/SmtpManager$SMTPManagerFactory.createManager(Ljava/lang/String;Lorg/apache/logging/log4j/core/net/SmtpManager$FactoryData;)Lorg/apache/logging/log4j/core/net/SmtpManager;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Apache Jira · LOG4J2-2819PROJECT