CVE-2018-1285

unknown

Published 2021-01-29 · Modified 2024-03-12

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

—

Description

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Predictions

Exploit likelihood

30%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2018-1285 NameCVE-2018-1285 DescriptionApache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files. SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub…

CVE-2018-1285

Name	CVE-2018-1285
Description	Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2211-1
Debian Bugs	977468

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
log4net (PTS)	bullseye	1.2.10+dfsg-8	fixed
	trixie	1.2.10+dfsg-9	fixed
	sid	1.2.10+dfsg-10	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
log4net	source	jessie	1.2.10+dfsg-6+deb8u1		DLA-2211-1
log4net	source	(unstable)	1.2.10+dfsg-8	low		977468

Notes

[buster] - log4net <no-dsa> (Minor issue)
[stretch] - log4net <no-dsa> (Minor issue; requires application to accept arbitrary configuration files)
https://issues.apache.org/jira/browse/LOG4NET-575
https://github.com/apache/logging-log4net/commit/d0b4b0157d4af36b23c24a23739c47925c3bd8d7

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

[buster] - log4net <no-dsa> (Minor issue)[stretch] - log4net <no-dsa> (Minor issue; requires application to accept arbitrary configuration files)https://issues.apache.org/jira/browse/LOG4NET-575https://github.com/apache/logging-log4net/commit/d0b4b0157d4af36b23c24a23739c47925c3bd8d7

OS impact

SUSE Affected 1 release

Version	Status	Fixed in
—	Affected	—

Debian Fixed 3 releases

Version	Status	Fixed in
trixie	Fixed	`1.2.10+dfsg-8`
sid	Fixed	`1.2.10+dfsg-8`
bullseye	Fixed	`1.2.10+dfsg-8`

Package impact

Ecosystem	Package	Vulnerable	Fixed
NuGet	log4net	`<2.0.10`	`2.0.10`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.