Homepage

Improper Certificate Validation The advisory has been revoked - it doesn't affect any version of package rh-maven35-log4j12.src  (opens in a new tab)

Threat Intelligence

EPSS
0.03% (9th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-RHMAVEN35LOG4J12SRC-15352724
  • published26 Feb 2026
  • disclosed25 Apr 2020
Report a new vulnerability Found a mistake?

Introduced: 25 Apr 2020

CVE-2020-9488  (opens in a new tab)
CWE-295  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rh-maven35-log4j12.src package and not the rh-maven35-log4j12.src package as distributed by RHEL.

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

References