-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.logging.log4j:log4j-core | maven | >= 2.0-beta9, < 2.25.3 | 2.25.3 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the SslSocketManager class, which is used by the Socket Appender for SSL/TLS connections. The analysis of the provided patch commit 3b93748497e1adbbd027fda8a5e7268ec5d0d578 reveals that the createSocket method within SslSocketManager.java was modified to enforce hostname verification. Previously, the method would establish an SSL connection without verifying that the hostname on the server's certificate matched the configured hostname, creating a man-in-the-middle (MITM) vulnerability. The patch rectifies this by adding logic to enable endpoint identification on the SSLParameters of the socket, using the HTTPS algorithm, and setting the SNIHostName before the TLS handshake. The vulnerable function is org.apache.logging.log4j.core.net.SslSocketManager.createSocket, as it was the function responsible for creating the insecure socket.
org.apache.logging.log4j.core.net.SslSocketManager.createSocketlog4j-core/src/main/java/org/apache/logging/log4j/core/net/SslSocketManager.java
A Semantic Attack on Google Gemini - Read the Latest Research