CVE-2020-9488

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 27-04-2020 06:15

Last modified: - 12-05-2022 05:00

Total changes: - 25

Description

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

High

Attack complexity

Network

Attack vector

None

Availability

Low

Confidentiality

None

Integrity

None

Privileges required

Unchanged

Scope

None

User interaction

3.7

Base score

2.2

1.4

Exploitability score

Impact score

Verification logic

vendor=apache AND product=log4j AND versionStartIncluding=2.4 AND versionEndExcluding=2.12.3

vendor=apache AND product=log4j AND versionStartIncluding=2.13.0 AND versionEndExcluding=2.13.2

vendor=apache AND product=log4j AND versionStartIncluding=2.0 AND versionEndExcluding=2.3.2

vendor=oracle AND product=flexcube_private_banking AND version=12.1.0

vendor=oracle AND product=retail_integration_bus AND version=14.1

vendor=oracle AND product=flexcube_private_banking AND version=12.0.0

vendor=oracle AND product=flexcube_core_banking AND version=5.2.0

vendor=oracle AND product=retail_integration_bus AND version=15.0

vendor=oracle AND product=peoplesoft_enterprise_peopletools AND version=8.56

vendor=oracle AND product=weblogic_server AND version=10.3.6.0.0

vendor=oracle AND product=utilities_framework AND version=4.2.0.3.0

vendor=oracle AND product=utilities_framework AND version=4.2.0.2.0

vendor=oracle AND product=utilities_framework AND version=2.2.0.0.0

vendor=oracle AND product=communications_billing_and_revenue_management AND version=12.0.0.3.0

vendor=oracle AND product=communications_unified_inventory_management AND version=7.4.0

vendor=oracle AND product=data_integrator AND version=12.2.1.3.0

vendor=oracle AND product=financial_services_analytical_applications_infrastructure AND versionEndIncluding=8.1.0.0.0 AND versionStartIncluding=8.0.6.0.0

vendor=oracle AND product=financial_services_market_risk_measurement_and_management AND version=8.0.6

vendor=oracle AND product=financial_services_price_creation_and_discovery AND version=8.0.7

vendor=oracle AND product=jd_edwards_world_security AND version=a9.4

vendor=oracle AND product=peoplesoft_enterprise_peopletools AND version=8.57

vendor=oracle AND product=peoplesoft_enterprise_peopletools AND version=8.58

vendor=oracle AND product=policy_automation_connector_for_siebel AND version=10.4.6

vendor=oracle AND product=primavera_unifier AND version=18.8

vendor=oracle AND product=primavera_unifier AND version=19.12

vendor=oracle AND product=retail_customer_management_and_segmentation_foundation AND version=16.0

vendor=oracle AND product=retail_customer_management_and_segmentation_foundation AND version=17.0

vendor=oracle AND product=retail_customer_management_and_segmentation_foundation AND version=18.0

vendor=oracle AND product=retail_customer_management_and_segmentation_foundation AND version=19.0

vendor=oracle AND product=retail_integration_bus AND version=16.0

vendor=oracle AND product=utilities_framework AND versionEndIncluding=4.3.0.6.0 AND versionStartIncluding=4.3.0.1.0

vendor=oracle AND product=utilities_framework AND version=4.4.0.0.0

vendor=oracle AND product=utilities_framework AND version=4.4.0.2.0

vendor=oracle AND product=communications_application_session_controller AND version=3.9m0p1

vendor=oracle AND product=communications_billing_and_revenue_management AND version=7.5.0.23.0

vendor=oracle AND product=communications_offline_mediation_controller AND version=12.0.0.3.0

vendor=oracle AND product=communications_unified_inventory_management AND version=7.3.0

vendor=oracle AND product=enterprise_manager_for_peoplesoft AND version=13.4.1.1

vendor=oracle AND product=financial_services_institutional_performance_analytics AND version=8.0.6

vendor=oracle AND product=financial_services_institutional_performance_analytics AND version=8.1.0

vendor=oracle AND product=financial_services_institutional_performance_analytics AND version=8.7.0

vendor=oracle AND product=financial_services_market_risk_measurement_and_management AND version=8.0.8

vendor=oracle AND product=financial_services_market_risk_measurement_and_management AND version=8.1.0

vendor=oracle AND product=financial_services_price_creation_and_discovery AND version=8.0.6

vendor=oracle AND product=financial_services_retail_customer_analytics AND version=8.0.6

vendor=oracle AND product=flexcube_core_banking AND versionEndIncluding=11.7.0 AND versionStartIncluding=11.5.0

vendor=oracle AND product=insurance_insbridge_rating_and_underwriting AND versionEndIncluding=5.6.0.0 AND versionStartIncluding=5.0.0.0

vendor=oracle AND product=insurance_insbridge_rating_and_underwriting AND version=5.6.1.0

vendor=oracle AND product=insurance_policy_administration_j2ee AND version=10.2.0.37

vendor=oracle AND product=insurance_policy_administration_j2ee AND version=10.2.4.12

vendor=oracle AND product=insurance_policy_administration_j2ee AND version=11.0.2.25

vendor=oracle AND product=insurance_policy_administration_j2ee AND version=11.1.0.15

vendor=oracle AND product=insurance_rules_palette AND version=10.2.0.37

vendor=oracle AND product=insurance_rules_palette AND version=10.2.4.12

vendor=oracle AND product=insurance_rules_palette AND version=11.0.2.25

vendor=oracle AND product=insurance_rules_palette AND version=11.1.0.15

vendor=oracle AND product=insurance_rules_palette AND version=11.2.0.26

vendor=oracle AND product=policy_automation AND versionEndIncluding=12.2.20 AND versionStartIncluding=12.2.0

vendor=oracle AND product=policy_automation_for_mobile_devices AND versionEndIncluding=12.2.20 AND versionStartIncluding=12.2.0

vendor=oracle AND product=retail_advanced_inventory_planning AND version=14.1

vendor=oracle AND product=retail_assortment_planning AND version=15.0.3.0

vendor=oracle AND product=retail_assortment_planning AND version=16.0.3.0

vendor=oracle AND product=retail_bulk_data_integration AND version=15.0.3.0

vendor=oracle AND product=retail_bulk_data_integration AND version=16.0.3.0

vendor=oracle AND product=retail_order_broker_cloud_service AND version=16.0

vendor=oracle AND product=retail_order_broker_cloud_service AND version=18.0

vendor=oracle AND product=retail_order_broker_cloud_service AND version=19.0

vendor=oracle AND product=retail_order_broker_cloud_service AND version=19.1

vendor=oracle AND product=retail_order_broker_cloud_service AND version=19.3

vendor=oracle AND product=retail_predictive_application_server AND version=14.1.3.0

vendor=oracle AND product=retail_predictive_application_server AND version=15.0.3.0

vendor=oracle AND product=spatial_and_graph AND version=18c

vendor=oracle AND product=spatial_and_graph AND version=19c

vendor=oracle AND product=communications_eagle_ftp_table_base_retrieval AND version=4.5

vendor=oracle AND product=communications_services_gatekeeper AND version=7.0

vendor=oracle AND product=data_integrator AND version=12.2.1.4.0

vendor=oracle AND product=health_sciences_information_manager AND version=3.0.1

vendor=oracle AND product=insurance_policy_administration_j2ee AND version=11.2.0.26

vendor=oracle AND product=oracle_goldengate_application_adapters AND version=19.1.0.0.0

vendor=oracle AND product=retail_eftlink AND version=15.0.2

vendor=oracle AND product=retail_eftlink AND version=16.0.3

vendor=oracle AND product=retail_eftlink AND version=17.0.2

vendor=oracle AND product=retail_eftlink AND version=18.0.1

vendor=oracle AND product=retail_eftlink AND version=19.0.1

vendor=oracle AND product=retail_insights_cloud_service_suite AND version=19.0

vendor=oracle AND product=retail_order_broker_cloud_service AND version=19.2

vendor=oracle AND product=retail_predictive_application_server AND version=16.0.3.0

vendor=oracle AND product=retail_xstore_point_of_service AND version=15.0.4

vendor=oracle AND product=retail_xstore_point_of_service AND version=16.0.6

vendor=oracle AND product=retail_xstore_point_of_service AND version=17.0.4

vendor=oracle AND product=retail_xstore_point_of_service AND version=18.0.3

vendor=oracle AND product=retail_xstore_point_of_service AND version=19.0.2

vendor=oracle AND product=siebel_apps_-_marketing AND versionEndIncluding=21.9

vendor=oracle AND product=siebel_ui_framework AND versionEndIncluding=21.2

vendor=oracle AND product=spatial_and_graph AND version=12.2.0.1

vendor=oracle AND product=storagetek_acsls AND version=8.5.1

vendor=oracle AND product=storagetek_tape_analytics_sw_tool AND version=2.3.1

vendor=Debian AND product=debian_linux AND version=9.0

vendor=Debian AND product=debian_linux AND version=10.0

vendor=Debian AND product=debian_linux AND version=11.0

vendor=qos AND product=reload4j AND versionEndExcluding=1.2.18.3

Reference

https://issues.apache.org/jira/browse/LOG4J2-2819
[zookeeper-issues] 20200504 [jira] [Created] (ZOOKEEPER-3817) owasp failing due to CVE-2020-9488-Mailing List, Vendor Advisory
[zookeeper-dev] 20200504 [jira] [Created] (ZOOKEEPER-3817) owasp failing due to CVE-2020-9488-Mailing List, Vendor Advisory
https://security.netapp.com/advisory/ntap-20200504-0003/
[zookeeper-notifications] 20200504 Build failed in Jenkins: zookeeper-master-maven-owasp #489-Mailing List, Vendor Advisory
[zookeeper-issues] 20200504 [jira] [Commented] (ZOOKEEPER-3817) owasp failing due to CVE-2020-9488-Mailing List, Vendor Advisory
[zookeeper-dev] 20200504 log4j SmtpAppender related CVE-Mailing List, Vendor Advisory
[zookeeper-issues] 20200504 [jira] [Assigned] (ZOOKEEPER-3817) owasp failing due to CVE-2020-9488-Mailing List, Vendor Advisory
[zookeeper-notifications] 20200504 [GitHub] [zookeeper] symat opened a new pull request #1346: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488-Mailing List, Vendor Advisory
[zookeeper-issues] 20200504 [jira] [Updated] (ZOOKEEPER-3817) owasp failing due to CVE-2020-9488-Mailing List, Vendor Advisory
[zookeeper-commits] 20200504 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488-Mailing List, Patch, Vendor Advisory
[zookeeper-notifications] 20200504 [GitHub] [zookeeper] symat commented on pull request #1346: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488-Mailing List, Vendor Advisory
[zookeeper-commits] 20200504 [zookeeper] branch master updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488-Mailing List, Patch, Vendor Advisory
[zookeeper-commits] 20200504 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488-Mailing List, Patch, Vendor Advisory
[zookeeper-issues] 20200504 [jira] [Resolved] (ZOOKEEPER-3817) owasp failing due to CVE-2020-9488-Mailing List, Vendor Advisory
[kafka-dev] 20200514 [jira] [Created] (KAFKA-9996) upgrade zookeeper to 3.5.8 to address security vulnerabilities-Mailing List, Vendor Advisory
[kafka-jira] 20200514 [jira] [Created] (KAFKA-9996) upgrade zookeeper to 3.5.8 to address security vulnerabilities-Mailing List, Vendor Advisory
[kafka-dev] 20200514 [jira] [Created] (KAFKA-9997) upgrade log4j lib to address CVE-2020-9488-Mailing List, Vendor Advisory
[kafka-jira] 20200514 [jira] [Created] (KAFKA-9997) upgrade log4j lib to address CVE-2020-9488-Mailing List, Vendor Advisory
[kafka-jira] 20200515 [jira] [Commented] (KAFKA-9997) upgrade log4j lib to address CVE-2020-9488-Mailing List, Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
[db-torque-dev] 20200715 Build failed in Jenkins: Torque4-trunk #685-Mailing List, Vendor Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
[hive-issues] 20201207 [jira] [Updated] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488-Mailing List, Vendor Advisory
[hive-dev] 20201207 [jira] [Created] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488-Mailing List, Vendor Advisory
[hive-issues] 20201207 [jira] [Assigned] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488-Mailing List, Vendor Advisory
[hive-issues] 20201207 [jira] [Work started] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488-Mailing List, Vendor Advisory
[hive-issues] 20201208 [jira] [Work logged] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488-Mailing List, Vendor Advisory
[hive-issues] 20201208 [jira] [Updated] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488-Mailing List, Vendor Advisory
https://lists.apache.org/thread.html/re024d86dffa72ad800f2848d0c77ed93f0b78ee808350b477a6ed987@%3Cgitbox.hive.apache.org%3E
[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list-Mailing List, Vendor Advisory
https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3@%3Ctorque-dev.db.apache.org%3E
https://www.oracle.com/security-alerts/cpujan2021.html
[hive-issues] 20210125 [jira] [Work logged] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488-Issue Tracking, Mailing List, Vendor Advisory
[db-torque-dev] 20210127 Re: Items for our (delayed) quarterly report to the board?-Mailing List, Vendor Advisory
[db-torque-dev] 20210128 Antwort: Re: Items for our (delayed) quarterly report to the board?-Mailing List, Vendor Advisory
[hive-issues] 20210209 [jira] [Resolved] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488-Mailing List, Vendor Advisory
[hive-issues] 20210216 [jira] [Resolved] (HIVE-24787) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488-Mailing List, Vendor Advisory
[hive-dev] 20210216 [jira] [Created] (HIVE-24787) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488-Mailing List, Vendor Advisory
[hive-issues] 20210216 [jira] [Assigned] (HIVE-24787) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488-Mailing List, Vendor Advisory
[hive-issues] 20210218 [jira] [Updated] (HIVE-24787) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488-Mailing List, Vendor Advisory
[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar-Mailing List, Vendor Advisory
[flink-issues] 20210510 [GitHub] [flink] zentol opened a new pull request #15879: [FLINK-22407][build] Bump log4j to 2.24.1-Mailing List, Vendor Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
[kafka-users] 20210617 vulnerabilities-Mailing List, Vendor Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
DSA-5020-Third Party Advisory
[debian-lts-announce] 20211226 [SECURITY] [DLA 2852-1] apache-log4j2 security update-Mailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html

Keywords

CVE-2020-9488

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2020-9488

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures