Use of insecure channel - Source code In ceph
Description
A flaw was found in the Log4j2 AMQP Appender. When configured to ship logs to RabbitMQ over Transport Layer Security (TLS), the appender disables hostname verification by default. This misconfiguration allows a remote attacker to perform a man-in-the-middle (MITM) attack, intercepting sensitive log events. This can lead to unauthorized information disclosure.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component |
|---|---|
 rpm rhel10 | |
rpm rhel8 | |
rpm rhel10 | |
rpm rhel9 |
Aliases
1. 2. 3.