CVE-2025-68161

A flaw was found in Apache Log4j Core. The Socket Appender component fails to perform proper TLS (Transport Layer Security) hostname verification of peer certificates. This vulnerability allows a man-in-the-middle (MITM) attacker to intercept or redirect log traffic, potentially leading to information disclosure. Exploitation requires the attacker to intercept network traffic and present a server certificate issued by a trusted certification authority.

This vulnerability is rated Moderate for Red Hat products utilizing Apache Log4j Core versions 2.0-beta9 through 2.25.2 with the Socket Appender configured for TLS. The flaw allows a man-in-the-middle attacker to intercept or redirect log traffic due to missing TLS hostname verification, provided the attacker can intercept network traffic and present a trusted certificate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.