Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade apache-log4j2 | Dec 28, 2021 | Apr 27, 2020 |
| Gentoo Linux | — | Upgrade dev-java/log4j. | Feb 19, 2024 | Apr 27, 2020 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 31641257 for version 10.3.6.0.0. | Oct 22, 2020 | Apr 27, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 27, 2020 |
| Suse | — | Upgrade log4j-slf4jUpgrade log4j-jclUpgrade log4j-javadocUpgrade log4j | Aug 9, 2024 | Apr 27, 2020 |
| Ubuntu | — | Upgrade apache-log4j2 | Nov 19, 2024 | Apr 27, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub