What’s Vulnerable › Vulnerabilities
CVE-2020-9488
- Severity: low (CVSS 3.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 8.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-04-27 · updated 2026-06-17
- Weakness: CWE-295
Description
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
Affected products
- Apache Log4j: from 2.0 before 2.3.2; from 2.4 before 2.12.3; from 2.13.0 before 2.13.2 — fixed in 2.12.3, 2.13.2, 2.3.2
- Debian Linux: 9.0, 10.0, 11.0
- Oracle Communications Application Session Controller: 3.9m0p1
- Oracle Corporation Communications Billing and Revenue Management: 7.5.0.23.0, 12.0.0.3.0
- Oracle Communications Eagle Ftp Table Base Retrieval: 4.5
- Oracle Communications Offline Mediation Controller: 12.0.0.3.0
- Oracle Communications Services Gatekeeper: 7.0
- Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.0, 7.4.0
- Oracle Corporation Oracle Data Integrator: 12.2.1.3.0, 12.2.1.4.0
- Oracle Enterprise Manager For Peoplesoft: 13.4.1.1
- Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6.0.0 through 8.1.0.0.0
- Oracle Financial Services Institutional Performance Analytics: 8.0.6, 8.1.0, 8.7.0
- Oracle Corporation Financial Services Market Risk Measurement and Management: 8.0.6, 8.0.8, 8.1.0
- Oracle Corporation Financial Services Price Creation and Discovery: 8.0.6, 8.0.7
- Oracle Financial Services Retail Customer Analytics: 8.0.6
- Oracle FLEXCUBE Core Banking: from 11.5.0 through 11.7.0; 5.2.0
- Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
- Oracle Health Sciences Information Manager: 3.0.1
- Oracle Insurance Insbridge Rating And Underwriting: from 5.0.0.0 through 5.6.0.0; 5.6.1.0
- Oracle Insurance Policy Administration J2Ee: 10.2.0.37, 10.2.4.12, 11.0.2.25, 11.1.0.15, 11.2.0.26
- Oracle Insurance Rules Palette: 10.2.0.37, 10.2.4.12, 11.0.2.25, 11.1.0.15, 11.2.0.26
- Oracle Jd Edwards World Security: a9.4
- Oracle Goldengate Application Adapters: 19.1.0.0.0
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.56, 8.57, 8.58
- Oracle Policy Automation: from 12.2.0 through 12.2.20
- Oracle Policy Automation Connector For Siebel: 10.4.6
- Oracle Policy Automation For Mobile Devices: from 12.2.0 through 12.2.20
- Oracle Corporation Primavera Unifier: 18.8, 19.12
- Oracle Retail Advanced Inventory Planning: 14.1
- Oracle Retail Assortment Planning: 15.0.3.0, 16.0.3.0
How to fix
Upgrade to a fixed version: Apache Log4j 2.12.3, 2.13.2, 2.3.2; Qos Reload4J 1.2.18.3. Check the vendor advisory for mitigations.
References
- https://issues.apache.org/jira/browse/LOG4J2-2819
- https://lists.apache.org/thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a%40%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05%40%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881%40%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f%40%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r2f209d271349bafd91537a558a279c08ebcff8fa3e547357d58833e6%40%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r33864a0fc171c1c4bf680645ebb6d4f8057899ab294a43e1e4fe9d04%40%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r393943de452406f0f6f4b3def9f8d3c071f96323c1f6ed1a098f7fe4%40%3Ctorque-dev.db.apache.org%3E
- https://lists.apache.org/thread.html/r3d1d00441c55144a4013adda74b051ae7864128ebcfb6ee9721a2eb3%40%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r4285398e5585a0456d3d9db021a4fce6e6fcf3ec027dfa13a450ec98%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r45916179811a32cbaa500f972de9098e6ee80ee81c7f134fce83e03a%40%3Cissues.flink.apache.org%3E
Get alerted when CVE-2020-9488 or the next vulnerability affects your stack