Apache Log4j Core Missing TLS Hostname Verification in Socket Appender Vulnerability

A vulnerability exists in the Socket Appender of Apache Log4j Core versions 2.0-beta9 prior to 2.25.3, where TLS hostname verification of the peer certificate is not performed. This issue persists even when the verifyHostName configuration attribute or the log4j2.sslVerifyHostName system property is set to true. As a result, a man-in-the-middle attacker could intercept or redirect log traffic if they can intercept the network traffic and present a trusted server certificate.

Impact

Exploitation of this vulnerability could lead to man-in-the-middle attacks, allowing interception or redirection of log traffic.

Remediation

Users are advised to upgrade to Apache Log4j Core version 2.25.3. For earlier versions, the risk can be reduced by carefully restricting the trust store used by the Socket Appender.