PT-2025-52349 · Apache+2 · Apache Log4J Core+2

Samuli Leinonen · Publicado 2025-12-18 · Atualizado 2026-05-18 · CVE-2025-68161

Positive Technologies (AI Summary) · Pt

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N

Nome do Software Vulnerável e Versões Afetadas Apache Log4j Core versões 2.0-beta9 até 2.25.2

Descrição O Socket Appender no Apache Log4j Core não verifica o nome do host do certificado da contraparte durante conexões TLS, mesmo quando configurado para tal. Isso poderia permitir que um atacante do tipo man-in-the-middle interceptasse ou redirecionasse o tráfego de logs se pudesse apresentar um certificado válido confiado pelo sistema. O atacante precisa ser capaz de interceptar o tráfego de rede entre o cliente e o receptor de logs e possuir um certificado emitido por uma autoridade de certificação confiável.

Recomendações Atualize para o Apache Log4j Core versão 2.25.3. Como alternativa, configure o Socket Appender para usar uma raiz de confiança privada ou restrita, a fim de limitar o conjunto de certificados confiáveis.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-297

CWE-295

Identificadores relacionados

BDU:2026-00009

CLEANSTART-2026-CF62516

CLEANSTART-2026-DC73689

CLEANSTART-2026-EZ90321

CLEANSTART-2026-GE08280

CLEANSTART-2026-GM79879

CLEANSTART-2026-GQ14179

CLEANSTART-2026-IA43044

CLEANSTART-2026-JU62349

CLEANSTART-2026-JW30455

CLEANSTART-2026-MM00120

CLEANSTART-2026-SQ91016

CLEANSTART-2026-SV95049

CLEANSTART-2026-WG59699

CLEANSTART-2026-WK99982

CVE-2025-68161

GHSA-VC5P-V9HR-52MJ

OPENSUSE-SU-2026:10009-1

OPENSUSE-SU-2026:20099-1

SUSE-SU-2026:0254-1

Produtos afetados

Apache Log4J Core

Debian

Red Os

Referências · 294

• https://github.com/apache/logging-log4j2 · Nota
• https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578 · Nota
• https://github.com/apache/logging-log4j2/pull/4002 · Correção
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WG59699.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GM79879.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-MM00120.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GE08280.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SQ91016.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SV95049.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JW30455.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IA43044.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CF62516.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JU62349.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WK99982.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GQ14179.json · Nota