Improper validation of certificate with host mismatch in Apache Log4j SMTP appender.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• apache log4j2.4 and later · before 2.12.3
• apache log4j2.13.0 and later · before 2.13.2
• apache log4j2.0 and later · before 2.3.2
• debian debian linux10.0
• debian debian linux11.0
• debian debian linux9.0
• oracle communications application session controller3.9m0p1
• oracle communications billing and revenue management12.0.0.3.0
• oracle communications billing and revenue management7.5.0.23.0
• oracle communications eagle ftp table base retrieval4.5
• oracle communications offline mediation controller12.0.0.3.0
• oracle communications services gatekeeper7.0
• oracle communications unified inventory management7.3.0
• oracle communications unified inventory management7.4.0
• oracle data integrator12.2.1.3.0
• oracle data integrator12.2.1.4.0
• oracle enterprise manager for peoplesoft13.4.1.1
• oracle financial services analytical applications infrastructure8.0.6.0.0 and later · up to 8.1.0.0.0 inclusive
• oracle financial services institutional performance analytics8.0.6
• oracle financial services institutional performance analytics8.1.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (apache). Independent of NVD's CPE analysis and usually ahead of it.

• Apache Apache Log4j

  • log4j-core 2.13.0affected
  • log4j-core and later · before 2.12.3affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsKEV
  100Now
• CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attackKEV
  96Now
• CVE-2017-5645In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another applic
  66This week

Published before and after this one in the same product

• ← EarlierCVE-2019-17571Dec 20, 2019 · Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exe
  60This week
• Later →CVE-2021-4104Dec 14, 2021 · Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
  54Plan
• Later →CVE-2021-45105Dec 18, 2021 · Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
  53Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A certificate validation error is silently swallowed instead of terminating the connection. Often, code added for a test environment makes its way into production.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1override fun checkServerTrusted(chain: Array<X509Certificate>, type: String) {2  // Left empty for the test environment3}

1val client = OkHttpClient.Builder()2  .certificatePinner(3    CertificatePinner.Builder()4      .add("api.sirius.example", "sha256/…")5      .build()6  ).build()

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.