CVE-2020-9488: Apache Log4j improper certificate validation in SMTP appender

CVE-2020-9488 · Severity: low · CVSS 3.7 · Published 2020-06-05

Apache Log4j is a widely used logging library for Java applications. A security issue in its email notification component (SMTP appender) means it does not properly verify the identity of the mail server it connects to. This could allow an attacker to intercept and read sensitive log messages sent via email, potentially exposing internal system details or user data.

Technologies: Apache Software Foundation Log4j Core, org.apache.logging.log4j:log4j-core (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2020-9488 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-9488 being exploited in the wild.
How severe is CVE-2020-9488?
Low severity, with a CVSS score of 3.7, published 5 June 2020.
Which products and versions are affected?
Apache Software Foundation Log4j Core < 2.3.2, >= 2.4.0, < 2.12.3, >= 2.13.0, < 2.13.2; org.apache.logging.log4j:log4j (Maven) ECOSYSTEM:introduced=2.13.0,fixed=2.13.2; org.apache.logging.log4j:log4j-core (Maven) ECOSYSTEM:introduced=2.13.0,fixed=2.13.2.
Is there a fix for CVE-2020-9488?
Yes. org.apache.logging.log4j:log4j (Maven): upgrade to 2.13.2 or later; org.apache.logging.log4j:log4j-core (Maven): upgrade to 2.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-9488 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2020-9488?
Check whether you run Apache Software Foundation Log4j Core, org.apache.logging.log4j:log4j (Maven) or org.apache.logging.log4j:log4j-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.logging.log4j:log4j (Maven): upgrade to 2.13.2 or later
    # set org.apache.logging.log4j:log4j to 2.13.2 in your pom.xml or build.gradle
  • org.apache.logging.log4j:log4j-core (Maven): upgrade to 2.13.2 or later
    # set org.apache.logging.log4j:log4j-core to 2.13.2 in your pom.xml or build.gradle

Technical details

The SMTP appender in Apache Log4j fails to properly validate TLS certificates when the hostname in the certificate does not match the connected server's hostname. This vulnerability allows for a Man-in-the-Middle (MitM) attack on SMTPS connections. An attacker positioned between the application and the mail server could intercept the encrypted traffic and decrypt log messages. The issue affects multiple version branches and is resolved in versions 2.3.2, 2.12.3, and 2.13.2. Exploitation requires the attacker to have the ability to intercept network traffic.

Affected products

  • Apache Log4j < 2.3.2, >= 2.4.0, < 2.12.3, >= 2.13.0, < 2.13.2
  • Apache Log4j-core < 2.3.2, >= 2.4.0, < 2.12.3, >= 2.13.0, < 2.13.2

Identifiers

  • CVE-2020-9488
  • GHSA-vwqq-5vrc-xw9h

Timeline

  • 2020-06-05: advisory: Initial GHSA publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.