PT-2020-3311 · Apache+1 · Apache Log4J+1

Published 2020-04-13 · Updated 2022-05-12 · CVE-2020-9488

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Log4j versions prior to 2.12.3 Apache Log4j versions prior to 2.13.1 Apache Log4j versions prior to 2.13.2

Description The issue is related to improper validation of certificates with host mismatch in the Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack, potentially leaking log messages sent through the appender.

Recommendations For Apache Log4j versions prior to 2.12.3, update to version 2.12.3 or later. For Apache Log4j versions prior to 2.13.1, update to version 2.13.1 or later. For Apache Log4j versions prior to 2.13.2, update to version 2.13.2 or later. As a temporary workaround, consider disabling the SMTP appender until a patch is available. Restrict access to the SMTP appender to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-297

CWE-295

Related Identifiers

BDU:2020-03624

CVE-2020-9488

DLA-2852-1

DSA-5020-1

GHSA-VWQQ-5VRC-XW9H

OPENSUSE-SU-2024:11025-1

RHSA-2020:3817

Affected Products

Apache Log4J

Astra Linux

References · 110

• https://osv.dev/vulnerability/GHSA-vwqq-5vrc-xw9h · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-9488 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-9488 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-9488 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2852-1 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://issues.apache.org/jira/browse/LOG4J2-2819 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9488 · Security Note
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-9488 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-9488 · Vendor Advisory
• https://oracle.com/security-alerts/cpuApr2021.html · Patch
• https://osv.dev/vulnerability/DSA-5020-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03624 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9488 · Vendor Advisory