Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

Log4j may let email logs be intercepted

CVE-2020-9488 · published 6 years ago
Summary

The Log4j library’s email‑sending feature can accept a fake security certificate, allowing an attacker to eavesdrop on log messages sent by email. This affects any system using Log4j (including Oracle communications applications that incorporate it). Upgrade Log4j to version 2.12.3 or newer (2.13.1 or later) to fix the issue.

What to do
  • Update apache org.apache.logging.log4j:log4j to version 2.13.2.
  • Update apache org.apache.logging.log4j:log4j-core to version 2.13.2.
  • Update apache org.apache.logging.log4j:log4j to version 2.12.3.
  • Update apache org.apache.logging.log4j:log4j to version 2.3.2.
  • Update apache org.apache.logging.log4j:log4j-core to version 2.12.3.
  • Update apache org.apache.logging.log4j:log4j-core to version 2.3.2.
  • Update canonical apache-log4j2 to version 2.16.0-0.20.04.1.
  • Update debian apache-log4j2 to version 2.13.3-1.
  • Update qos reload4j to version 1.2.18.3 or later.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.logging.log4j:log4j >= 2.13.0, < 2.13.2
>= 2.4.0, < 2.12.3
< 2.3.2
Fix: upgrade to 2.13.2
maven apache org.apache.logging.log4j:log4j-core >= 2.13.0, < 2.13.2
>= 2.4.0, < 2.12.3
< 2.3.2
Fix: upgrade to 2.13.2
– apache log4j >= 2.0, < 2.3.2
>= 2.4, < 2.12.3
>= 2.13.0, < 2.13.2
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
– oracle communications_application_session_controller 3.9m0p1
cpe:2.3:a:oracle:communications_application_session_controller:3.9m0p1:*:*:*:*:*:*:*
– oracle communications_billing_and_revenue_management 7.5.0.23.0
12.0.0.3.0
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*
– oracle communications_eagle_ftp_table_base_retrieval 4.5
cpe:2.3:a:oracle:communications_eagle_ftp_table_base_retrieval:4.5:*:*:*:*:*:*:*
– oracle communications_offline_mediation_controller 12.0.0.3.0
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*
– oracle communications_services_gatekeeper 7.0
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
– oracle communications_unified_inventory_management 7.3.0
7.4.0
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*
– oracle data_integrator 12.2.1.3.0
12.2.1.4.0
cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*
– oracle enterprise_manager_for_peoplesoft 13.4.1.1
cpe:2.3:a:oracle:enterprise_manager_for_peoplesoft:13.4.1.1:*:*:*:*:*:*:*
– oracle financial_services_analytical_applications_infrastructure >= 8.0.6.0.0, <= 8.1.0.0.0
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
– oracle financial_services_institutional_performance_analytics 8.0.6
8.1.0
8.7.0
cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*
– oracle financial_services_market_risk_measurement_and_management 8.0.6
8.0.8
8.1.0
cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*
– oracle financial_services_price_creation_and_discovery 8.0.6
8.0.7
cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*
– oracle financial_services_retail_customer_analytics 8.0.6
cpe:2.3:a:oracle:financial_services_retail_customer_analytics:8.0.6:*:*:*:*:*:*:*
– oracle flexcube_core_banking >= 11.5.0, <= 11.7.0
5.2.0
cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:*
– oracle flexcube_private_banking 12.0.0
12.1.0
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*
– oracle health_sciences_information_manager 3.0.1
cpe:2.3:a:oracle:health_sciences_information_manager:3.0.1:*:*:*:*:*:*:*
– oracle insurance_insbridge_rating_and_underwriting >= 5.0.0.0, <= 5.6.0.0
5.6.1.0
cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:*
– oracle insurance_policy_administration_j2ee 10.2.0.37
10.2.4.12
11.0.2.25
11.1.0.15
11.2.0.26
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.0.37:*:*:*:*:*:*:*
– oracle insurance_rules_palette 10.2.0.37
10.2.4.12
11.0.2.25
11.1.0.15
11.2.0.26
cpe:2.3:a:oracle:insurance_rules_palette:10.2.0.37:*:*:*:*:*:*:*
– oracle jd_edwards_world_security a9.4
cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*
– oracle oracle_goldengate_application_adapters 19.1.0.0.0
cpe:2.3:a:oracle:oracle_goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*
– oracle peoplesoft_enterprise_peopletools 8.56
8.57
8.58
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*
– oracle policy_automation >= 12.2.0, <= 12.2.20
cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*
– oracle policy_automation_connector_for_siebel 10.4.6
cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:*
– oracle policy_automation_for_mobile_devices >= 12.2.0, <= 12.2.20
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:*
– oracle primavera_unifier 18.8
19.12
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
– oracle retail_advanced_inventory_planning 14.1
cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:*
– oracle retail_assortment_planning 15.0.3.0
16.0.3.0
cpe:2.3:a:oracle:retail_assortment_planning:15.0.3.0:*:*:*:*:*:*:*
– oracle retail_bulk_data_integration 15.0.3.0
16.0.3.0
cpe:2.3:a:oracle:retail_bulk_data_integration:15.0.3.0:*:*:*:*:*:*:*
– oracle retail_customer_management_and_segmentation_foundation 16.0
17.0
18.0
19.0
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:16.0:*:*:*:*:*:*:*
– oracle retail_eftlink 15.0.2
16.0.3
17.0.2
18.0.1
19.0.1
cpe:2.3:a:oracle:retail_eftlink:15.0.2:*:*:*:*:*:*:*
– oracle retail_insights_cloud_service_suite 19.0
cpe:2.3:a:oracle:retail_insights_cloud_service_suite:19.0:*:*:*:*:*:*:*
– oracle retail_integration_bus 14.1
15.0
16.0
cpe:2.3:a:oracle:retail_integration_bus:14.1:*:*:*:*:*:*:*
– oracle retail_order_broker_cloud_service 16.0
18.0
19.0
19.1
19.2
19.3
cpe:2.3:a:oracle:retail_order_broker_cloud_service:16.0:*:*:*:*:*:*:*
– oracle retail_predictive_application_server 14.1.3.0
15.0.3.0
16.0.3.0
cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3.0:*:*:*:*:*:*:*
– oracle retail_xstore_point_of_service 15.0.4
16.0.6
17.0.4
18.0.3
19.0.2
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.4:*:*:*:*:*:*:*
– oracle siebel_apps_-_marketing <= 21.9
cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*
– oracle siebel_ui_framework <= 21.2
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*
– oracle spatial_and_graph 12.2.0.1
18c
19c
cpe:2.3:a:oracle:spatial_and_graph:12.2.0.1:*:*:*:*:*:*:*
– oracle storagetek_acsls 8.5.1
cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*
– oracle storagetek_tape_analytics_sw_tool 2.3.1
cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.1:*:*:*:*:*:*:*
– oracle utilities_framework >= 4.3.0.1.0, <= 4.3.0.6.0
2.2.0.0.0
4.2.0.2.0
4.2.0.3.0
4.4.0.0.0
4.4.0.2.0
cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*
– oracle weblogic_server 10.3.6.0.0
cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*
– debian debian_linux 9.0
10.0
11.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
– qos reload4j < 1.2.18.3
cpe:2.3:a:qos:reload4j:*:*:*:*:*:*:*:*
Ubuntu:Pro:16.04:LTS canonical apache-log4j2 All versions
Ubuntu:18.04:LTS canonical apache-log4j2 All versions
Showing 50 of 52. Show the rest
Ecosystem VendorProductAffected versions
Ubuntu:20.04:LTS canonical apache-log4j2 < 2.16.0-0.20.04.1
Fix: upgrade to 2.16.0-0.20.04.1
Debian:12 debian apache-log4j2 < 2.13.3-1
Fix: upgrade to 2.13.3-1
Original advisory text
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log me...
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
8% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published27 Apr 2020
Updated15 Oct 2026
First seen6 Mar 2026
Sources
GHSA-vwqq-5vrc-xw9h · GHSA
CVE-2020-9488 · NVD
UBUNTU-CVE-2020-9488 · OSV
DEBIAN-CVE-2020-9488 · OSV
Track software like this
Free during beta