CVE-2020-9488: Apache LOG4J

Low severity, CVSS 3.7. EPSS: 8.1% chance of exploitation in the next 30 days.

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Affected products

Apache LOG4J: from 2.0, before 2.3.2 (fixed in 2.3.2); from 2.4, before 2.12.3 (fixed in 2.12.3); from 2.13.0, before 2.13.2 (fixed in 2.13.2)
Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
Oracle Communications Application Session Controller: version 3.9m0p1 only
Oracle Communications Billing And Revenue Management: version 7.5.0.23.0 only; version 12.0.0.3.0 only
Oracle Communications Eagle FTP Table Base Retrieval: version 4.5 only
Oracle Communications Offline Mediation Controller: version 12.0.0.3.0 only
Oracle Communications Services Gatekeeper: version 7.0 only
Oracle Communications Unified Inventory Management: version 7.3.0 only; version 7.4.0 only
Oracle Data Integrator: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle Enterprise Manager For PeopleSoft: version 13.4.1.1 only
Oracle Financial Services Analytical Applications Infrastructure: from 8.0.6.0.0, up to and including 8.1.0.0.0
Oracle Financial Services Institutional Performance Analytics: version 8.0.6 only; version 8.1.0 only; version 8.7.0 only
Oracle Financial Services Market Risk Measurement And Management: version 8.0.6 only; version 8.0.8 only; version 8.1.0 only
Oracle Financial Services Price Creation And Discovery: version 8.0.6 only; version 8.0.7 only
Oracle Financial Services Retail Customer Analytics: version 8.0.6 only
Oracle Flexcube Core Banking: from 11.5.0, up to and including 11.7.0; version 5.2.0 only
Oracle Flexcube Private Banking: version 12.0.0 only; version 12.1.0 only
Oracle Health Sciences Information Manager: version 3.0.1 only
Oracle Insurance Insbridge Rating And Underwriting: from 5.0.0.0, up to and including 5.6.0.0; version 5.6.1.0 only
Oracle Insurance Policy Administration j2ee: version 10.2.0.37 only; version 10.2.4.12 only; version 11.0.2.25 only; version 11.1.0.15 only; version 11.2.0.26 only
Oracle Insurance Rules Palette: version 10.2.0.37 only; version 10.2.4.12 only; version 11.0.2.25 only; version 11.1.0.15 only; version 11.2.0.26 only
Oracle Jd Edwards World Security: version a9.4 only
Oracle Oracle Goldengate Application Adapters: version 19.1.0.0.0 only
Oracle PeopleSoft Enterprise PeopleTools: version 8.56 only; version 8.57 only; version 8.58 only
Oracle Policy Automation: from 12.2.0, up to and including 12.2.20
and 21 more

Published 2020-04-27. Last modified 2026-06-17.