CVE-2018-1285 XML External Entity attack in log4net
CriticalCVSS 9.8
EPSS 17.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nuget log4net(NuGet) | < 2.0.10 | 2.0.10 |
| nuget log4net(NuGet) | = 1.2.10 | No fix listed |
| nuget log4net(NuGet) | = 1.2.11 | No fix listed |
| nuget log4net(NuGet) | = 2.0.0 | No fix listed |
| nuget log4net(NuGet) | = 2.0.1 | No fix listed |
| nuget log4net(NuGet) | = 2.0.2 | No fix listed |
| nuget log4net(NuGet) | = 2.0.3 | No fix listed |
| nuget log4net(NuGet) | = 2.0.4 | No fix listed |
| nuget log4net(NuGet) | = 2.0.5 | No fix listed |
| nuget log4net(NuGet) | = 2.0.6 | No fix listed |
| nuget log4net(NuGet) | = 2.0.7 | No fix listed |
| nuget log4net(NuGet) | = 2.0.8 | No fix listed |
| nuget log4net(NuGet) | = 2.0.9 | No fix listed |
| debian/log4net(Debian:13) | < 1.2.10+dfsg-8 | 1.2.10+dfsg-8 |
| debian/log4net(Debian:14) | < 1.2.10+dfsg-8 | 1.2.10+dfsg-8 |
| apache log4net | < 2.0.10 | 2.0.10 |
| fedoraproject fedora | = 30 | No fix listed |
| fedoraproject fedora | = 31 | No fix listed |
| fedoraproject fedora | = 32 | No fix listed |
| oracle application testing suite | = 13.3.0.1 | No fix listed |
| oracle hospitality opera 5 | = 5.5 | No fix listed |
| oracle hospitality opera 5 | = 5.6 | No fix listed |
| oracle hospitality simphony | = 18.2.7.2 | No fix listed |
| oracle hospitality simphony | = 19.1.3 | No fix listed |
| netapp manageability software development kit | All versions | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| netapp snapcenter | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- issues.apache.org issue-tracking vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org mailing-list vendor-advisory
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- snyk.io
- www.nuget.org
- www.oracle.com third-party-advisory
- www.whitesourcesoftware.com
- www.oracle.com third-party-advisory
- lists.apache.org
- www.oracle.com patch third-party-advisory
- security.netapp.com third-party-advisory
- github.com
- github.com product
- Debian Security Tracker CVE-2018-1285 vendor-advisory
- [logging-dev] 20200906 [VOTE] [log4net] Release 2.0.10 mailing-list
- [logging-dev] 20200525 [CVE-2018-1285] XXE vulnerability in Apache log4net mailing-list
- [logging-dev] 20210817 Solution for vulnerability mailing-list
- [logging-dev] 20200617 Re: [CVE-2018-1285] XXE vulnerability in Apache log4net mailing-list
- [logging-dev] 20200730 Re: [CVE-2018-1285] XXE vulnerability in Apache log4net mailing-list
- [logging-dev] 20200525 Re: [CVE-2018-1285] XXE vulnerability in Apache log4net mailing-list
- [logging-dev] 20200826 Re: log4net.dll - does 2.0.9 fix CVE-2018-1285 mailing-list
- [logging-dev] 20200826 log4net.dll - does 2.0.9 fix CVE-2018-1285 mailing-list
- FEDORA-2020-cfc319e067 vendor-advisory
- FEDORA-2020-73d380e9b9 vendor-advisory
- FEDORA-2020-847775bf79 vendor-advisory
- bugs.debian.org issue-tracking