Published: 27/04/2020 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 3.7 | Impact Score: 1.4 | Exploitability Score: 2.2

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache log4j
oracle flexcube private banking 12.1.0
oracle retail integration bus 14.1
oracle flexcube private banking 12.0.0
oracle flexcube core banking 5.2.0
oracle retail integration bus 15.0
oracle peoplesoft enterprise peopletools 8.56
oracle weblogic server 10.3.6.0.0
oracle utilities framework 4.2.0.3.0
oracle utilities framework 4.2.0.2.0
oracle utilities framework 2.2.0.0.0
oracle peoplesoft enterprise peopletools 8.57
oracle retail integration bus 16.0
oracle primavera unifier 18.8
oracle retail customer management and segmentation foundation 16.0
oracle retail customer management and segmentation foundation 17.0
oracle retail customer management and segmentation foundation 18.0
oracle policy automation connector for siebel 10.4.6
oracle data integrator 12.2.1.3.0
oracle jd edwards world security a9.4
oracle financial services market risk measurement and management 8.0.6
oracle utilities framework 4.4.0.0.0
oracle communications unified inventory management 7.4.0
oracle financial services price creation and discovery 8.0.7
oracle peoplesoft enterprise peopletools 8.58
oracle primavera unifier 19.12
oracle financial services analytical applications infrastructure
oracle utilities framework
oracle utilities framework 4.4.0.2.0
oracle retail customer management and segmentation foundation 19.0
oracle communications billing and revenue management 12.0.0.3.0
oracle communications billing and revenue management 7.5.0.23.0
oracle financial services price creation and discovery 8.0.6
oracle policy automation
oracle financial services institutional performance analytics 8.1.0
oracle financial services institutional performance analytics 8.0.6
oracle insurance insbridge rating and underwriting
oracle policy automation for mobile devices
oracle insurance insbridge rating and underwriting 5.6.1.0
oracle financial services market risk measurement and management 8.0.8
oracle communications unified inventory management 7.3.0
oracle retail order broker cloud service 19.0
oracle retail assortment planning 15.0.3.0
oracle financial services institutional performance analytics 8.7.0
oracle insurance policy administration j2ee 11.0.2.25
oracle retail advanced inventory planning 14.1
oracle retail predictive application server 14.1.3.0
oracle spatial and graph 18c
oracle retail order broker cloud service 16.0
oracle flexcube core banking
oracle financial services market risk measurement and management 8.1.0
oracle insurance rules palette 11.2.0.26
oracle spatial and graph 19c
oracle communications offline mediation controller 12.0.0.3.0
oracle insurance rules palette 10.2.0.37
oracle enterprise manager for peoplesoft 13.4.1.1
oracle insurance rules palette 11.1.0.15
oracle retail bulk data integration 15.0.3.0
oracle insurance policy administration j2ee 10.2.4.12
oracle retail bulk data integration 16.0.3.0
oracle insurance policy administration j2ee 10.2.0.37
oracle retail order broker cloud service 19.3
oracle retail predictive application server 15.0.3.0
oracle insurance policy administration j2ee 11.1.0.15
oracle insurance rules palette 11.0.2.25
oracle retail order broker cloud service 19.1
oracle insurance rules palette 10.2.4.12
oracle retail order broker cloud service 18.0
oracle retail assortment planning 16.0.3.0
oracle communications application session controller 3.9m0p1
oracle financial services retail customer analytics 8.0.6
oracle spatial and graph 12.2.0.1
oracle insurance policy administration j2ee 11.2.0.26
oracle retail predictive application server 16.0.3.0
oracle retail order broker cloud service 19.2
oracle communications services gatekeeper 7.0
oracle data integrator 12.2.1.4.0
oracle storagetek tape analytics sw tool 2.3.1
oracle health sciences information manager 3.0.1
oracle oracle goldengate application adapters 19.1.0.0.0
oracle retail xstore point of service 16.0.6
oracle retail xstore point of service 17.0.4
oracle retail xstore point of service 18.0.3
oracle retail xstore point of service 19.0.2
oracle retail xstore point of service 15.0.4
oracle siebel ui framework
oracle retail insights cloud service suite 19.0
oracle retail eftlink 16.0.3
oracle retail eftlink 17.0.2
oracle retail eftlink 18.0.1
oracle retail eftlink 19.0.1
oracle retail eftlink 15.0.2
oracle siebel apps - marketing
oracle communications eagle ftp table base retrieval 4.5
oracle storagetek acsls 8.5.1
debian debian linux 9.0
debian debian linux 10.0
debian debian linux 11.0
qos reload4j

Debian Bug report logs - #959450 apache-log4j2: CVE-2020-9488 Package: src:apache-log4j2; Maintainer for src:apache-log4j2 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 2 May 2020 14:39:02 UTC Severity: important Tags: secu ...

Chen Zhaojun of Alibaba Cloud Security Team discovered a critical security vulnerability in Apache Log4j, a popular Logging Framework for Java JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints An attacker who can control log messages or log message pa ...

Synopsis Important: Red Hat Decision Manager 7100 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Decision ManagerRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) b ...

Synopsis Important: Red Hat Data Grid 737 security update Type/Severity Security Advisory: Important Topic An update for Red Hat Data Grid is now availableRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, whic ...

Synopsis Moderate: Red Hat Data Grid 810 Security Update Type/Severity Security Advisory: Moderate Topic An update for Red Hat Data Grid is now availableRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which g ...

Synopsis Low: Red Hat build of Eclipse Vertx 391 security update Type/Severity Security Advisory: Low Topic An update is now available for Red Hat build of Eclipse VertxRed Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) base s ...

Synopsis Important: Red Hat JBoss Data Virtualization 648SP1 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Data VirtualizationRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, whic ...

Synopsis Moderate: AMQ Clients 280 Release Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat AMQ Clients 280Red Hat Product Security has rated this update as having a Moderate security impact A Common Vulnerability Scoring System (CVSS) base score, which gives a de ...

Synopsis Important: Red Hat Fuse 780 release and security update Type/Severity Security Advisory: Important Topic A minor version update (from 77 to 78) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Produc ...

Synopsis Important: Red Hat JBoss Data Virtualization 648SP2 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Data VirtualizationRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, whic ...

Sysdig Vuln Package Report - Legacy Engine This script will get a list of images in runtime filtered by cluster & namespace (if specified) and then queries the list of vulnrabilities for those images You can optionally specify a package name such as log4j with the -p command line parameter, this will then only list vulnrabilities relating to that package Output report

Log4j RELP Plugin

Log4j RELP Plugin Creates Log4j appender that uses RELP to ensure no events are lost See log4jexampleproperties for example config Please note Please note that regarding log4j version 1217 following vulnerabilities exist and we recommend not to use these features: CVE-2020-9488 Improper validation of certificate with host mismatch in Apache Log4j SMTP a

Triton malware still a threat to energy sector, FBI warns

The Register • Jessica Lyons Hardcastle • 01 Jan 1970

Get our weekly newsletter Plus: Ransomware gangster sentenced, Dell patches more Log4j bugs, and cartoon apes gone bad

In Brief Triton malware remains a threat to the global energy sector, according to an FBI warning. Triton is the software nasty used in a 2017 cyber attack carried out by a Russian government-backed research institution against a Middle East petrochemical facility. The new FBI warning [PDF] came a day after the US Department of Justice unsealed a pair of indictments that detail alleged Russian government efforts to use supply chain attacks and malware in an attempt to compromise and control crit...

Get Started

CVE-2020-9488

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect