VulnerableCode Package Details - pkg:maven/org.apache.logging.log4j/log4j-core@2.4.0

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/org.apache.logging.log4j/log4j-core@2.4.0

Essentials
History (2)

purl	pkg:maven/org.apache.logging.log4j/log4j-core@2.4.0
Tags	Ghost

Next non-vulnerable version	2.25.3
Latest non-vulnerable version	2.25.4
Risk	4.0

Vulnerabilities affecting this package (2)

Vulnerability	Summary	Fixed by
VCID-mz9r-j78c-dfe3 Aliases: CVE-2020-9488 GHSA-vwqq-5vrc-xw9h	Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.	2.12.3 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 2.13.2 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-sjuz-dd96-sqe3 Aliases: CVE-2021-45105 GHSA-p6xc-xr62-6r2g	Uncontrolled Recursion This advisory has been marked as a false positive.	2.12.3 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 2.17.0 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-mz9r-j78c-dfe3
Aliases:
CVE-2020-9488
GHSA-vwqq-5vrc-xw9h

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

2.12.3
Affected by 2 other vulnerabilities.

2.13.2
Affected by 2 other vulnerabilities.

VCID-sjuz-dd96-sqe3
Aliases:
CVE-2021-45105
GHSA-p6xc-xr62-6r2g

Uncontrolled Recursion This advisory has been marked as a false positive.

2.12.3
Affected by 2 other vulnerabilities.

2.17.0
Affected by 2 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T15:59:12.280912+00:00	GHSA Importer	Affected by	VCID-sjuz-dd96-sqe3	https://github.com/advisories/GHSA-p6xc-xr62-6r2g	38.0.0
2026-04-01T15:58:11.448659+00:00	GHSA Importer	Affected by	VCID-mz9r-j78c-dfe3	https://github.com/advisories/GHSA-vwqq-5vrc-xw9h	38.0.0