Read the docs
TI-2020-07597 Aliases CVE-2020-9488GHSA-vwqq-5vrc-xw9h

Improper certificate validation in Apache Log4j

Priority LOW 29CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 10 fixed, 21 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.08216 94th percentileScored 2026-11-07
Fix Partial Apache Log4j (Apache): 2.12.3org.apache.logging.log4j:log4j (Maven): 2.13.2, 2.12.3, 2.3.2+1 more productRed Hat: 10 advisoriesRed Hat: 10 fixed, 21 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Log4jlog4j-core 2.13.0; log4j-core to before 2.12.32.12.3Patch availableCNA
—org.apache.logging.log4j:log4j (Maven)2.13.0 to before 2.13.22.13.2Patch availableGHSA-vwqq-5vrc-xw9h
—org.apache.logging.log4j:log4j-core (Maven)2.13.0 to before 2.13.22.13.2Patch availableGHSA-vwqq-5vrc-xw9h
—org.apache.logging.log4j:log4j (Maven)2.4.0 to before 2.12.32.12.3Patch availableGHSA-vwqq-5vrc-xw9h
—org.apache.logging.log4j:log4j (Maven)before 2.3.22.3.2Patch availableGHSA-vwqq-5vrc-xw9h
—org.apache.logging.log4j:log4j-core (Maven)2.4.0 to before 2.12.32.12.3Patch availableGHSA-vwqq-5vrc-xw9h
—org.apache.logging.log4j:log4j-core (Maven)before 2.3.22.3.2Patch availableGHSA-vwqq-5vrc-xw9h
  • Apache Log4j VendorApache Affected log4j-core 2.13.0; log4j-core to before 2.12.3 Fixed in 2.12.3 Patch available CNA
  • org.apache.logging.log4j:log4j (Maven) Vendor— Affected 2.13.0 to before 2.13.2 Fixed in 2.13.2 Patch available GHSA-vwqq-5vrc-xw9h
  • org.apache.logging.log4j:log4j-core (Maven) Vendor— Affected 2.13.0 to before 2.13.2 Fixed in 2.13.2 Patch available GHSA-vwqq-5vrc-xw9h
  • org.apache.logging.log4j:log4j (Maven) Vendor— Affected 2.4.0 to before 2.12.3 Fixed in 2.12.3 Patch available GHSA-vwqq-5vrc-xw9h
  • org.apache.logging.log4j:log4j (Maven) Vendor— Affected before 2.3.2 Fixed in 2.3.2 Patch available GHSA-vwqq-5vrc-xw9h
  • org.apache.logging.log4j:log4j-core (Maven) Vendor— Affected 2.4.0 to before 2.12.3 Fixed in 2.12.3 Patch available GHSA-vwqq-5vrc-xw9h
  • org.apache.logging.log4j:log4j-core (Maven) Vendor— Affected before 2.3.2 Fixed in 2.3.2 Patch available GHSA-vwqq-5vrc-xw9h

CPE configurations NVD · 99

CPEVersionsRoleVendor
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*2.0 to before 2.3.2; 2.4 to before 2.12.3; 2.13.0 to before 2.13.2VulnerableApache
cpe:2.3:a:oracle:communications_application_session_controller:3.9m0p1:*:*:*:*:*:*:*3.9m0p1VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*7.5.0.23.0VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_eagle_ftp_table_base_retrieval:4.5:*:*:*:*:*:*:*4.5VulnerableOracle
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*7.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*7.4.0VulnerableOracle
cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
  • cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* Versions 2.0 to before 2.3.2; 2.4 to before 2.12.3; 2.13.0 to before 2.13.2 Vulnerable ·Apache
  • cpe:2.3:a:oracle:communications_application_session_controller:3.9m0p1:*:*:*:*:*:*:* Versions 3.9m0p1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* Versions 7.5.0.23.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_eagle_ftp_table_base_retrieval:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
Show 89 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_peoplesoft:13.4.1.1:*:*:*:*:*:*:*13.4.1.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*8.0.6.0.0 – 8.1.0.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*8.0.6VulnerableOracle
cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.7.0:*:*:*:*:*:*:*8.7.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*8.0.6VulnerableOracle
cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*8.0.8VulnerableOracle
cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*8.0.6VulnerableOracle
cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:*8.0.7VulnerableOracle
cpe:2.3:a:oracle:financial_services_retail_customer_analytics:8.0.6:*:*:*:*:*:*:*8.0.6VulnerableOracle
cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:*11.5.0 – 11.7.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_core_banking:5.2.0:*:*:*:*:*:*:*5.2.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*12.0.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:a:oracle:health_sciences_information_manager:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableOracle
cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:*5.0.0.0 – 5.6.0.0VulnerableOracle
cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:*5.6.1.0VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.0.37:*:*:*:*:*:*:*10.2.0.37VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.4.12:*:*:*:*:*:*:*10.2.4.12VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2.25:*:*:*:*:*:*:*11.0.2.25VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.1.0.15:*:*:*:*:*:*:*11.1.0.15VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.2.0.26:*:*:*:*:*:*:*11.2.0.26VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:10.2.0.37:*:*:*:*:*:*:*10.2.0.37VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:10.2.4.12:*:*:*:*:*:*:*10.2.4.12VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:11.0.2.25:*:*:*:*:*:*:*11.0.2.25VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:11.1.0.15:*:*:*:*:*:*:*11.1.0.15VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:11.2.0.26:*:*:*:*:*:*:*11.2.0.26VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*a9.4VulnerableOracle
cpe:2.3:a:oracle:oracle_goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*19.1.0.0.0VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*8.56VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*12.2.0 – 12.2.20VulnerableOracle
cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:*10.4.6VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:*12.2.0 – 12.2.20VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*19.12VulnerableOracle
cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:retail_assortment_planning:15.0.3.0:*:*:*:*:*:*:*15.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_assortment_planning:16.0.3.0:*:*:*:*:*:*:*16.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_bulk_data_integration:15.0.3.0:*:*:*:*:*:*:*15.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:*16.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*17.0VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*18.0VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*19.0VulnerableOracle
cpe:2.3:a:oracle:retail_eftlink:15.0.2:*:*:*:*:*:*:*15.0.2VulnerableOracle
cpe:2.3:a:oracle:retail_eftlink:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_eftlink:17.0.2:*:*:*:*:*:*:*17.0.2VulnerableOracle
cpe:2.3:a:oracle:retail_eftlink:18.0.1:*:*:*:*:*:*:*18.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:*19.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_insights_cloud_service_suite:19.0:*:*:*:*:*:*:*19.0VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker_cloud_service:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker_cloud_service:18.0:*:*:*:*:*:*:*18.0VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker_cloud_service:19.0:*:*:*:*:*:*:*19.0VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker_cloud_service:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker_cloud_service:19.2:*:*:*:*:*:*:*19.2VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker_cloud_service:19.3:*:*:*:*:*:*:*19.3VulnerableOracle
cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3.0:*:*:*:*:*:*:*14.1.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3.0:*:*:*:*:*:*:*15.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:*16.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.4:*:*:*:*:*:*:*15.0.4VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*16.0.6VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*17.0.4VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*18.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*19.0.2VulnerableOracle
cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*up to 21.9VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*up to 21.2VulnerableOracle
cpe:2.3:a:oracle:spatial_and_graph:12.2.0.1:*:*:*:*:*:*:*12.2.0.1VulnerableOracle
cpe:2.3:a:oracle:spatial_and_graph:18c:*:*:*:*:*:*:*18cVulnerableOracle
cpe:2.3:a:oracle:spatial_and_graph:19c:*:*:*:*:*:*:*19cVulnerableOracle
cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*8.5.1VulnerableOracle
cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*4.3.0.1.0 – 4.3.0.6.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:2.2.0.0.0:*:*:*:*:*:*:*2.2.0.0.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*4.2.0.2.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*4.2.0.3.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*4.4.0.0.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*4.4.0.2.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*10.3.6.0.0VulnerableOracle
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:a:qos:reload4j:*:*:*:*:*:*:*:*before 1.2.18.3VulnerableQos
  • cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_peoplesoft:13.4.1.1:*:*:*:*:*:*:* Versions 13.4.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.6.0.0 – 8.1.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.7.0:*:*:*:*:*:*:* Versions 8.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* Versions 8.0.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:* Versions 8.0.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_retail_customer_analytics:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:* Versions 11.5.0 – 11.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_core_banking:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_information_manager:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:* Versions 5.0.0.0 – 5.6.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:* Versions 5.6.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.0.37:*:*:*:*:*:*:* Versions 10.2.0.37 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.4.12:*:*:*:*:*:*:* Versions 10.2.4.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2.25:*:*:*:*:*:*:* Versions 11.0.2.25 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.1.0.15:*:*:*:*:*:*:* Versions 11.1.0.15 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.2.0.26:*:*:*:*:*:*:* Versions 11.2.0.26 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:10.2.0.37:*:*:*:*:*:*:* Versions 10.2.0.37 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:10.2.4.12:*:*:*:*:*:*:* Versions 10.2.4.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:11.0.2.25:*:*:*:*:*:*:* Versions 11.0.2.25 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:11.1.0.15:*:*:*:*:*:*:* Versions 11.1.0.15 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:11.2.0.26:*:*:*:*:*:*:* Versions 11.2.0.26 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:* Versions a9.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle_goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:* Versions 19.1.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* Versions 12.2.0 – 12.2.20 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:* Versions 10.4.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:* Versions 12.2.0 – 12.2.20 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_assortment_planning:15.0.3.0:*:*:*:*:*:*:* Versions 15.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_assortment_planning:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_bulk_data_integration:15.0.3.0:*:*:*:*:*:*:* Versions 15.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* Versions 19.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_eftlink:15.0.2:*:*:*:*:*:*:* Versions 15.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_eftlink:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_eftlink:17.0.2:*:*:*:*:*:*:* Versions 17.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_eftlink:18.0.1:*:*:*:*:*:*:* Versions 18.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_insights_cloud_service_suite:19.0:*:*:*:*:*:*:* Versions 19.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker_cloud_service:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker_cloud_service:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker_cloud_service:19.0:*:*:*:*:*:*:* Versions 19.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker_cloud_service:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker_cloud_service:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker_cloud_service:19.3:*:*:*:*:*:*:* Versions 19.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3.0:*:*:*:*:*:*:* Versions 14.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3.0:*:*:*:*:*:*:* Versions 15.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.4:*:*:*:*:*:*:* Versions 15.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* Versions 16.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* Versions 17.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* Versions 18.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:* Versions up to 21.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:* Versions up to 21.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:spatial_and_graph:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:spatial_and_graph:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:spatial_and_graph:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* Versions 8.5.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* Versions 4.3.0.1.0 – 4.3.0.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:2.2.0.0.0:*:*:*:*:*:*:* Versions 2.2.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:* Versions 4.2.0.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:* Versions 4.2.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* Versions 4.4.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* Versions 4.4.0.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* Versions 10.3.6.0.0 Vulnerable ·Oracle
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:a:qos:reload4j:*:*:*:*:*:*:*:* Versions before 1.2.18.3 Vulnerable ·Qos

Remediation

  • Fix · CNA Apache Log4j (Apache) Fixed in 2.12.3
  • Fix · GHSA-vwqq-5vrc-xw9h org.apache.logging.log4j:log4j (Maven) Fixed in 2.13.2 Advisory →
  • Fix · GHSA-vwqq-5vrc-xw9h org.apache.logging.log4j:log4j-core (Maven) Fixed in 2.13.2 Advisory →
  • Fix · GHSA-vwqq-5vrc-xw9h org.apache.logging.log4j:log4j (Maven) Fixed in 2.12.3 Advisory →
  • Fix · GHSA-vwqq-5vrc-xw9h org.apache.logging.log4j:log4j (Maven) Fixed in 2.3.2 Advisory →
  • Fix · GHSA-vwqq-5vrc-xw9h org.apache.logging.log4j:log4j-core (Maven) Fixed in 2.12.3 Advisory →
  • Fix · GHSA-vwqq-5vrc-xw9h org.apache.logging.log4j:log4j-core (Maven) Fixed in 2.3.2 Advisory →

Red Hat 10 advisories

  • RHSA-2022:0507 Released 2022-02-10 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.4.8.SP2 security update
    • Red Hat JBoss Data Virtualization 6.4.8.SP2
  • RHSA-2022:0497 Released 2022-02-09 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.4.8.SP1 security update
    • Red Hat JBoss Data Virtualization 6.4.8.SP1
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
Show 7 more Red Hat advisories
  • RHSA-2021:1044 Released 2021-03-30 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.10.1 security update
    • RHPAM 7.10.1
  • RHSA-2021:0603 Released 2021-02-17 · Red Hat rating Important
    Red Hat Decision Manager 7.10.0 security update
    • RHDM 7.10.0
  • RHSA-2020:5568 Released 2020-12-16 · Red Hat rating Important
    Red Hat Fuse 7.8.0 release and security update
    • Red Hat Fuse 7.8.0
  • RHSA-2020:3817 Released 2020-09-23 · Red Hat rating Moderate
    AMQ Clients 2.8.0 Release
    • Red Hat AMQ Clients 2 nodejs-rhea-1.0.24-1.el8, python-qpid-proton-0.32.0-1.el6_10, python-qpid-proton-0.32.0-2.el7 +38
  • RHSA-2020:3779 Released 2020-09-17 · Red Hat rating Important
    Red Hat Data Grid 7.3.7 security update
    • Red Hat Data Grid 7.3.7
  • RHSA-2020:3626 Released 2020-09-03 · Red Hat rating Moderate
    Red Hat Data Grid 8.1.0 Security Update
    • Red Hat Data Grid
  • RHSA-2020:2391 Released 2020-06-17 · Red Hat rating Low
    Red Hat build of Eclipse Vert.x 3.9.1 security update
    • Text-Only RHOAR

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet: Fix deferred
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Web Server 3AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat Satellite 5AffectedNo fix planned: Out of support scope
Red Hat Software CollectionsAffectedNo fix yet: Fix deferred
streams for Apache KafkaAffectedNo fix yet: Fix deferred
RHDM 7.10.0Fixed RHSA-2021:0603
RHPAM 7.10.1Fixed RHSA-2021:1044
Red Hat AMQ Clients 2Fixed RHSA-2020:3817
Red Hat Data GridFixed RHSA-2020:3626
Red Hat Data Grid 7.3.7Fixed RHSA-2020:3779
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat Fuse 7.8.0Fixed RHSA-2020:5568
Red Hat JBoss Data Virtualization 6.4.8.SP1Fixed RHSA-2022:0497
Red Hat JBoss Data Virtualization 6.4.8.SP2Fixed RHSA-2022:0507
Text-Only RHOARFixed RHSA-2020:2391
Not affected: 4 products
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Continuous Delivery
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-9488
  2. 2026-10-03 Alias added: GHSA-vwqq-5vrc-xw9h

References

Patch 4

Advisory 7

Other 79

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-20393 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack KEVCVSS 3.1CRITICAL 9.0
  • TI-2017-03645 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2019-13113 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2022-07428 SQL injection in JDBC Appender in Apache Log4j V1 CVSS 3.1CRITICAL 9.8
  • TI-2022-07425 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences