NetSight
IP …
low3.7

CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender.

Impact

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Affected products

VendorProductAffected versions
ApacheLog4j
from 2.0 before 2.3.2
from 2.4 before 2.12.3
from 2.13.0 before 2.13.2
OracleCommunications Application Session Controller
Version 3.9m0p1
OracleCommunications Billing And Revenue Management
Versions 7.5.0.23.0, 12.0.0.3.0
OracleCommunications Eagle Ftp Table Base Retrieval
Version 4.5
OracleCommunications Offline Mediation Controller
Version 12.0.0.3.0
OracleCommunications Services Gatekeeper
Version 7.0
OracleCommunications Unified Inventory Management
Versions 7.3.0, 7.4.0
OracleData Integrator
Versions 12.2.1.3.0, 12.2.1.4.0
OracleEnterprise Manager For Peoplesoft
Version 13.4.1.1
OracleFinancial Services Analytical Applications Infrastructure
from 8.0.6.0.0 through 8.1.0.0.0
OracleFinancial Services Institutional Performance Analytics
Versions 8.0.6, 8.1.0, 8.7.0
OracleFinancial Services Market Risk Measurement And Management
Versions 8.0.6, 8.0.8, 8.1.0

Weakness classification

CWE-295

References