Executive brief
Apache Log4j is a widely used logging library for Java applications. A security issue in its email notification component (SMTP appender) means it does not properly verify the identity of the mail server it connects to. This could allow an attacker to intercept and read sensitive log messages sent via email, potentially exposing internal system details or user data.
Technical details
The SMTP appender in Apache Log4j fails to properly validate TLS certificates when the hostname in the certificate does not match the connected server's hostname. This vulnerability allows for a Man-in-the-Middle (MitM) attack on SMTPS connections. An attacker positioned between the application and the mail server could intercept the encrypted traffic and decrypt log messages. The issue affects multiple version branches and is resolved in versions 2.3.2, 2.12.3, and 2.13.2. Exploitation requires the attacker to have the ability to intercept network traffic.
Affected products
- Apache Log4j < 2.3.2, >= 2.4.0, < 2.12.3, >= 2.13.0, < 2.13.2
- Apache Log4j-core < 2.3.2, >= 2.4.0, < 2.12.3, >= 2.13.0, < 2.13.2
Timeline
- 2020-06-05: advisory: Initial GHSA publication