CVE-2025-68161
Description
A flaw was found in Apache Log4j Core. The Socket Appender component fails to perform proper TLS (Transport Layer Security) hostname verification of peer certificates. This vulnerability allows a man-in-the-middle (MITM) attacker to intercept or redirect log traffic, potentially leading to information disclosure. Exploitation requires the attacker to intercept network traffic and present a server certificate issued by a trusted certification authority.
Statement
This vulnerability is rated Moderate for Red Hat products utilizing Apache Log4j Core versions 2.0-beta9 through 2.25.2 with the Socket Appender configured for TLS. The flaw allows a man-in-the-middle attacker to intercept or redirect log traffic due to missing TLS hostname verification, provided the attacker can intercept network traffic and present a trusted certificate.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | 4.8 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | High | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | Low | N/A |
| Integrity Impact | None | Low | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
The data read from the system vouched for by the certificate may not be from the expected system.
Authentication,Other
Technical Impact: Other
Trust afforded to the system in question - based on the malicious certificate - may allow for spoofing or redirection attacks.
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Other
If the certificate's host-specific data is not properly checked - such as the Common Name (CN) in the Subject or the Subject Alternative Name (SAN) extension of an X.509 certificate - it may be possible for a redirection or spoofing attack to allow a malicious host with a valid certificate to provide data, impersonating a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
