Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

GHSA-vwqq-5vrc-xw9h · CVE-2020-9488

Published Jun 5, 2020 · Modified Jun 9, 2026

Description

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

References

3.7 / 10

LOW CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Packages

Maven/org.apache.logging.log4j:log4j

Fix 2.12.3, 2.13.2, 2.3.2

Introduced 0, 2.13.0, 2.4.0

41 affected versions

2.02.0-alpha12.0-alpha22.0-beta12.0-beta22.0-beta32.0-beta42.0-beta52.0-beta62.0-beta72.0-beta82.0-beta92.0-rc12.0-rc22.0.12.0.22.12.10.02.11.02.11.1 +21 more

Maven/org.apache.logging.log4j:log4j-core

Fix 2.12.3, 2.13.2, 2.3.2

Introduced 0, 2.13.0, 2.4.0

41 affected versions

2.02.0-alpha12.0-alpha22.0-beta12.0-beta22.0-beta32.0-beta42.0-beta52.0-beta62.0-beta72.0-beta82.0-beta92.0-rc12.0-rc22.0.12.0.22.12.10.02.11.02.11.1 +21 more

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes