DEBIAN-CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

Input validation

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

ai.eto:rikai_2.12 (>=0.0.2, <=0.0.12), at.willhaben.willtest:core (3.1.1) +774 more potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j-core (>=2.13.0, <=2.13.1)

org.apache.logging.log4j:log4j-core MAVEN version =2.13.0, =0.0.2, =2.0, =1.4.5, =1.4.5, =1.4.6, =00.01.02, =00.00.01, =00.02.29, =01.01.05 and more Source cves: CVE-2020-9488 Source advisory: MEND:CVE-2020-9488...

CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.4.8), ai.api.libai.web:libai-web-servlet (>=1.4.6, <=1.4.8) +1253 more potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j-core (>=2.0-alpha1, <=2.3.1)

org.apache.logging.log4j:log4j-core MAVEN version =2.0-alpha1, =1.4.6, =1.4.6, =1.1.0, =0.0.1, =1.2.0, =1.0.0, =1.0.1, =3.2.0, =1.3.0, =1.3.2, =1.3.3 - by.next-way:neural.network 1.0 - ca.ace-design-lab:island-arena 3.0 and more Source cves: CVE-2020-9488 Source advisory: MEND:CVE-2020-9488...

CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

ai.aitia:arrowhead-application-library-java-spring (4.4.0.0), ai.api.libai.speech:libai-speech-gcp (1.4.9) +7473 more potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j-core (>=2.4, <=2.12.2)

org.apache.logging.log4j:log4j-core MAVEN version =2.4, =1.0.0, =0.2.0, =0.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2020-9488 Source advisory: MEND:CVE-2020-9488...

CVE-2020-9488

CVE-2020-9488 affects the Apache Log4j2 SMTP appender. The issue is improper validation of the SSL/TLS certificate when the host name does not match, potentially allowing a man-in-the-middle to intercept SMTPS traffic and leak log messages. The concrete remediation is to upgrade to affected relea...

CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

CVE-2020-9488: Improper Certificate Validation

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

Oracle WebLogic Server Multiple Vulnerabilities (Apr 2020 CPU)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the CPUApr2020 advisory. - A remote code execution vulnerability exists in the Log4j SocketServer class due to unsafe deserialization of...

PT-2020-3311

Name of the Vulnerable Software and Affected Versions Apache Log4j versions prior to 2.12.3 Apache Log4j versions prior to 2.13.1 Apache Log4j versions prior to 2.13.2 Description The issue is related to improper validation of certificates with host mismatch in the Apache Log4j SMTP appender. Thi...

CVE-2019-17531

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled either globally or for a specific property for an externally exposed JSON endpoint and the service has the apache-log4j-extra version 1.2.x jar in the classpath, and an...

CVE-2019-17571

A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget. Mitigation Please note that the Log4j upstream strongly recommends...

Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache Log4j vulnerability (CVE-2019-17571)

Summary IBM Tivoli Netcool Impact has addressed the following Apache Log4j vulnerability. Vulnerability Details CVEID: CVE-2019-17571 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization of untrusted data in...

jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...