CVE-2020-9488
Low
Description
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
SeverityLow
CVSS3.7
Exploit probability—
Product
Apache Log4j
PublishedApr 27, 2020
First seenApr 27, 2020
Weakness typeCWE-295CWE-295
How to fix
Update
- apache log4j2.3.2, 2.12.3, 2.13.2 or later
- qos reload4j1.2.18.3 or later
- org.apache.logging.log4j:log4j2.13.2, 2.12.3, 2.3.2 or later
- org.apache.logging.log4j:log4j-core2.13.2, 2.12.3, 2.3.2 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache log4j | 2.0 ≤ v < 2.3.2, 2.4 ≤ v < 2.12.3, 2.13.0 ≤ v < 2.13.2 | 2.3.2, 2.12.3, 2.13.2 |
| oracle communications_application_session_controller | 3.9m0p1 | — |
| oracle communications_billing_and_revenue_management | 7.5.0.23.0, 12.0.0.3.0 | — |
| oracle communications_eagle_ftp_table_base_retrieval | 4.5 | — |
| oracle communications_offline_mediation_controller | 12.0.0.3.0 | — |
| oracle communications_services_gatekeeper | 7.0 | — |
| oracle communications_unified_inventory_management | 7.3.0, 7.4.0 | — |
| oracle data_integrator | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle enterprise_manager_for_peoplesoft | 13.4.1.1 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.6.0.0 ≤ v ≤ 8.1.0.0.0 | — |
| oracle financial_services_institutional_performance_analytics | 8.0.6, 8.1.0, 8.7.0 | — |
| oracle financial_services_market_risk_measurement_and_management | 8.0.6, 8.0.8, 8.1.0 | — |
| oracle financial_services_price_creation_and_discovery | 8.0.6, 8.0.7 | — |
| oracle financial_services_retail_customer_analytics | 8.0.6 | — |
| oracle flexcube_core_banking | 11.5.0 ≤ v ≤ 11.7.0, 5.2.0 | — |
| oracle flexcube_private_banking | 12.0.0, 12.1.0 | — |
| oracle health_sciences_information_manager | 3.0.1 | — |
| oracle insurance_insbridge_rating_and_underwriting | 5.0.0.0 ≤ v ≤ 5.6.0.0, 5.6.1.0 | — |
| oracle insurance_policy_administration_j2ee | 10.2.0.37, 10.2.4.12, 11.0.2.25, 11.1.0.15, 11.2.0.26 | — |
| oracle insurance_rules_palette | 10.2.0.37, 10.2.4.12, 11.0.2.25, 11.1.0.15, 11.2.0.26 | — |
| oracle jd_edwards_world_security | a9.4 | — |
| oracle oracle_goldengate_application_adapters | 19.1.0.0.0 | — |
| oracle peoplesoft_enterprise_peopletools | 8.56, 8.57, 8.58 | — |
| oracle policy_automation | 12.2.0 ≤ v ≤ 12.2.20 | — |
| oracle policy_automation_connector_for_siebel | 10.4.6 | — |
| oracle policy_automation_for_mobile_devices | 12.2.0 ≤ v ≤ 12.2.20 | — |
| oracle primavera_unifier | 18.8, 19.12 | — |
| oracle retail_advanced_inventory_planning | 14.1 | — |
| oracle retail_assortment_planning | 15.0.3.0, 16.0.3.0 | — |
| oracle retail_bulk_data_integration | 15.0.3.0, 16.0.3.0 | — |
| oracle retail_customer_management_and_segmentation_foundation | 16.0, 17.0, 18.0, 19.0 | — |
| oracle retail_eftlink | 15.0.2, 16.0.3, 17.0.2, 18.0.1, 19.0.1 | — |
| oracle retail_insights_cloud_service_suite | 19.0 | — |
| oracle retail_integration_bus | 14.1, 15.0, 16.0 | — |
| oracle retail_order_broker_cloud_service | 16.0, 18.0, 19.0, 19.1, 19.2, 19.3 | — |
| oracle retail_predictive_application_server | 14.1.3.0, 15.0.3.0, 16.0.3.0 | — |
| oracle retail_xstore_point_of_service | 15.0.4, 16.0.6, 17.0.4, 18.0.3, 19.0.2 | — |
| oracle siebel_apps_-_marketing | v ≤ 21.9 | — |
| oracle siebel_ui_framework | v ≤ 21.2 | — |
| oracle spatial_and_graph | 12.2.0.1, 18c, 19c | — |
| oracle storagetek_acsls | 8.5.1 | — |
| oracle storagetek_tape_analytics_sw_tool | 2.3.1 | — |
| oracle utilities_framework | 4.3.0.1.0 ≤ v ≤ 4.3.0.6.0, 2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0, 4.4.0.2.0 | — |
| oracle weblogic_server | 10.3.6.0.0 | — |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| qos reload4j | v < 1.2.18.3 | 1.2.18.3 |
| org.apache.logging.log4j:log4jMaven | 2.13.0 ≤ v < 2.13.2, 2.4.0 ≤ v < 2.12.3, v < 2.3.2 | 2.13.2, 2.12.3, 2.3.2 |
| org.apache.logging.log4j:log4j-coreMaven | 2.13.0 ≤ v < 2.13.2, 2.4.0 ≤ v < 2.12.3, v < 2.3.2 | 2.13.2, 2.12.3, 2.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.