The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not properly validate the hostname in the TLS peer certificate, ignoring the verifyHostName configuration attribute and the log4j2.sslVerifyHostName system property. This improper validation (CWE-297) may allow attackers who can intercept or redirect network traffic and present a certificate trusted by the configured trust store to intercept or redirect log data. The vulnerability is fixed in Apache Log4j Core version 2.25.3. As an alternative mitigation, restricting the trust root to a private or limited set of certificates can reduce exposure.

An attacker capable of intercepting or redirecting network traffic between the client and log receiver can exploit this vulnerability to intercept or redirect log traffic by presenting a trusted certificate with a hostname mismatch. This compromises the confidentiality and integrity of log data transmitted over TLS. The CVSS 4.0 score is 6.3 (medium severity), reflecting network attack vector, high attack complexity, and limited confidentiality impact.

Upgrade Apache Log4j Core to version 2.25.3, which fixes the hostname verification issue in the Socket Appender. Alternatively, configure the Socket Appender to use a private or restricted trust root to limit trusted certificates and reduce risk. There is no indication that no action is required; therefore, applying the official fix or using the recommended configuration change is advised.