Описание
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
A flaw was found in the Log4j2 AMQP Appender. When configured to ship logs to RabbitMQ over Transport Layer Security (TLS), the appender disables hostname verification by default. This misconfiguration allows a remote attacker to perform a man-in-the-middle (MITM) attack, intercepting sensitive log events. This can lead to unauthorized information disclosure.
Отчет
This vulnerability affects the Log4j2 AmqpAppender, a non-default, opt-in component that routes log events to a RabbitMQ broker over AMQP. No Red Hat product enables this appender by default — it requires explicit configuration by the application deployer, making exposure conditional on a deliberate architectural choice. For Red Hat Enterprise Linux, resteasy packages in RHEL 8 bundle log4j-core as a build-time dependency but do not activate or expose the AMQP Appender at runtime. PKI deployments are not affected unless a custom Log4j2 configuration independently enables the appender. Exploitation requires the attacker to already hold a man-in-the-middle position on the network path between the logging client and the RabbitMQ broker. That prerequisite — combined with the non-default nature of the appender — significantly limits practical exploitability in standard deployments.
Меры по смягчению последствий
Disable the Log4j2 AmqpAppender in log4j2.xml if it is not actively required. Where it must remain in use, ensure RabbitMQ is reachable only over a trusted internal network segment, or terminate the TLS connection through a proxy that enforces full certificate chain and hostname validation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat AI Inference Server | rhaiis/vllm-cuda-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaii/vllm-gaudi-rhel9 | Fix deferred | ||
| Red Hat AMQ Broker 7 | log4j-core | Fix deferred | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | spring-amqp | Fix deferred | ||
| Red Hat build of Apache Camel for Spring Boot 4 | log4j-core | Fix deferred | ||
| Red Hat build of Apicurio Registry 3 | log4j-core | Fix deferred | ||
| Red Hat Ceph Storage 6 | ceph | Out of support scope | ||
| Red Hat Ceph Storage 7 | ceph | Fix deferred | ||
| Red Hat Ceph Storage 8 | ceph | Fix deferred | ||
| Red Hat Data Grid 8 | log4j-core | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.8 Medium
CVSS3
Связанные уязвимости
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
EPSS
6.8 Medium
CVSS3