log4j: improper validation of certificate with host mismatch in SMTP appender

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

Moderate: Red Hat Security Advisory: Red Hat Data Grid 8.1.0 Security Update

An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Security Bulletin: Apache Log4j valunarability found in Network Performance Insight (CVE-2019-17571)

Summary Apache Log4j vulnerability found in Network Performance Insight CVE-2019-17571. Vulnerability Details CVEID: CVE-2019-17571 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization of untrusted data in SocketServer...

jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

Oracle Application Testing Suite (Jul 2020 CPU)

The versions of Application Testing Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory. - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager component: Load Testing for Web Apps Log4j. The...

Oracle Primavera Gateway (Jul 2020 CPU)

The 16.2.0-16.2.11, 17.12.0-17.12.7, 18.8.0-18.8.9, and 19.12.0-19.12.4 versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory. - Vulnerability in the Primavera Gateway product of Oracle Construction and...

log4j: improper validation of certificate with host mismatch in SMTP appender

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

Low: Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 3.9.1 security update

An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

org.apache.james:james-server-app (3.5.0), org.apache.james:james-server-spring (3.5.0) potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j (2.13.1)

org.apache.logging.log4j:log4j MAVEN version 2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.logging.log4j:log4j and may be impacted: - org.apache.james:james-server-app 3.5.0 - org.apache.james:james-server-spring 3.5.0 Source cves:...

com.github.javadev:authenticationsdk (0.0.5) potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j (2.3)

org.apache.logging.log4j:log4j MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.logging.log4j:log4j and may be impacted: - com.github.javadev:authenticationsdk 0.0.5 Source cves: CVE-2020-9488 Source advisory:...

com.github.javadev:authenticationsdk (0.0.5) potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j (2.3)

org.apache.logging.log4j:log4j MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.logging.log4j:log4j and may be impacted: - com.github.javadev:authenticationsdk 0.0.5 Source cves: CVE-2020-9488 Source advisory:...

ch.cern.sparkmeasure:spark-measure_2.11 (0.11), com.cybersource:authenticationsdk (>=0.0.1, <=0.0.12) +17 more potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j (>=2.4.1, <=2.12.0)

org.apache.logging.log4j:log4j MAVEN version =2.4.1, =0.0.1, =0.0.1, =0.9.0, =0.2.3, =0.2.0, =0.6.0, =1.0.0, =0.1.0, =2.9.2.0, =3.2.1.0 - io.github.lyvoc:okta-connector 1.0.7 - org.cloudfoundry.identity:cloudfoundry-identity-statsd 4.30.0 - org.crosslibs:extensible-json-layout 2.9.0 and more Sour...

org.apache.james:james-server-app (3.5.0), org.apache.james:james-server-spring (3.5.0) potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j (2.13.1)

org.apache.logging.log4j:log4j MAVEN version 2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.logging.log4j:log4j and may be impacted: - org.apache.james:james-server-app 3.5.0 - org.apache.james:james-server-spring 3.5.0 Source cves:...

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.4.8), ai.api.libai.web:libai-web-servlet (>=1.4.6, <=1.4.8) +1253 more potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j-core (>=2.0-alpha1, <=2.3.1)

org.apache.logging.log4j:log4j-core MAVEN version =2.0-alpha1, =1.4.6, =1.4.6, =1.1.0, =0.0.1, =1.2.0, =1.0.0, =1.0.1, =3.2.0, =1.3.0, =1.3.2, =1.3.3 - by.next-way:neural.network 1.0 - ca.ace-design-lab:island-arena 3.0 and more Source cves: CVE-2020-9488 Source advisory: OSV:GHSA-VWQQ-5VRC-XW9H...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.4.8), ai.api.libai.web:libai-web-servlet (>=1.4.6, <=1.4.8) +1253 more potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j-core (>=2.0-alpha1, <=2.3.1)

org.apache.logging.log4j:log4j-core MAVEN version =2.0-alpha1, =1.4.6, =1.4.6, =1.1.0, =0.0.1, =1.2.0, =1.0.0, =1.0.1, =3.2.0, =1.3.0, =1.3.2, =1.3.3 - by.next-way:neural.network 1.0 - ca.ace-design-lab:island-arena 3.0 and more Source cves: CVE-2020-9488 Source advisory: GHSA-VWQQ-5VRC-XW9H...

ai.aitia:arrowhead-application-library-java-spring (4.4.0.0), ai.api.libai.speech:libai-speech-gcp (1.4.9) +7473 more potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j-core (>=2.4, <=2.12.2)

org.apache.logging.log4j:log4j-core MAVEN version =2.4, =1.0.0, =0.2.0, =0.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2020-9488 Source advisory: OSV:GHSA-VWQQ-5VRC-XW9H...

ai.eto:rikai_2.12 (>=0.0.2, <=0.0.12), at.willhaben.willtest:core (3.1.1) +774 more potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j-core (>=2.13.0, <=2.13.1)

org.apache.logging.log4j:log4j-core MAVEN version =2.13.0, =0.0.2, =2.0, =1.4.5, =1.4.5, =1.4.6, =00.01.02, =00.00.01, =00.02.29, =01.01.05 and more Source cves: CVE-2020-9488 Source advisory: GHSA-VWQQ-5VRC-XW9H...

ai.aitia:arrowhead-application-library-java-spring (4.4.0.0), ai.api.libai.speech:libai-speech-gcp (1.4.9) +7473 more potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j-core (>=2.4, <=2.12.2)

org.apache.logging.log4j:log4j-core MAVEN version =2.4, =1.0.0, =0.2.0, =0.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2020-9488 Source advisory: GHSA-VWQQ-5VRC-XW9H...

ai.eto:rikai_2.12 (>=0.0.2, <=0.0.12), at.willhaben.willtest:core (3.1.1) +774 more potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j-core (>=2.13.0, <=2.13.1)

org.apache.logging.log4j:log4j-core MAVEN version =2.13.0, =0.0.2, =2.0, =1.4.5, =1.4.5, =1.4.6, =00.01.02, =00.00.01, =00.02.29, =01.01.05 and more Source cves: CVE-2020-9488 Source advisory: OSV:GHSA-VWQQ-5VRC-XW9H...