PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2020-9488

CVE-2020-9488

log4j: improper validation of certificate with host mismatch in SMTP appender

Loading…

Severity

Low

Red Hat Product Security

3.7

CVSS 3.1

Review impact separately from score.

Published · April 25, 2020

Updated · August 5, 2026

Description

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Previous versions can set the system property mail.smtp.ssl.checkserveridentity to true to globally enable hostname verification for SMTPS connections.

CVSS / CWE

CVSS 3.1 · 3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-295 · Improper Certificate Validation