CVE-2020-9488 Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
Man-in-the-middle attackers can intercept SMTPS connections to leak log messages if the SMTP appender is used with improper certificate validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-9488?
CVE-2020-9488 is a low-severity vulnerability in Debian Debian Linux, published on 27 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
Weakness: CWE-295
Which versions are affected by CVE-2020-9488?
12 open source packages ship an affected version, including org.apache.logging.log4j:log4j and org.apache.logging.log4j:log4j-core. It affects 46 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.logging.log4j:log4j Maven | All versions | 2.3.2 |
org.apache.logging.log4j:log4j Maven | All versions | 2.3.2 |
org.apache.logging.log4j:log4j Maven | From 2.13.0 | 2.13.2 |
org.apache.logging.log4j:log4j Maven | From 2.13.0 | 2.13.2 |
org.apache.logging.log4j:log4j Maven | From 2.4.0 | 2.12.3 |
org.apache.logging.log4j:log4j Maven | From 2.4.0 | 2.12.3 |
6 more packages
org.apache.logging.log4j:log4j-core Maven | All versions | 2.3.2 |
org.apache.logging.log4j:log4j-core Maven | All versions | 2.3.2 |
org.apache.logging.log4j:log4j-core Maven | From 2.13.0 | 2.13.2 |
org.apache.logging.log4j:log4j-core Maven | From 2.13.0 | 2.13.2 |
org.apache.logging.log4j:log4j-core Maven | From 2.4.0 | 2.12.3 |
org.apache.logging.log4j:log4j-core Maven | From 2.4.0 | 2.12.3 |
Products include Apache Log4j, Debian Debian Linux, Oracle Communications Application Session Controller, Oracle Communications Billing and Revenue Management, Oracle Communications Eagle Ftp Table Base Retrieval, Oracle Communications Offline Mediation Controller and 40 more.
How do I fix CVE-2020-9488?
Upgrade org.apache.logging.log4j:log4j to a fixed version for your release line: 2.3.2, 2.13.2 or 2.12.3.
Is CVE-2020-9488 being exploited?
There is no known exploitation of CVE-2020-9488 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
- CVE-2021-44228 Apache Log4j2 Remote Code Execution
- CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted Data
- CVE-2022-23305 SQL injection in JDBC Appender in Apache Log4j V1
- CVE-2017-5645 Deserialization of Untrusted Data in Log4j
- CVE-2022-23302 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x
Sources
Also known as CLEANSTART-2026-HH95708, DEBIAN-CVE-2020-9488, GHSA-vwqq-5vrc-xw9h, UBUNTU-CVE-2020-9488.