kritisch
CVE-2018-1285
Apache log4net versions before 2.0.10 do not disable XML external enti ...
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Ubuntu (mittel).
Beschreibung
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| nuget::GitHub Security Advisory NuGet | log4net | 2.0.10 |
| debian 10 | log4net | kein Fix angegeben |
| debian 11 | log4net | 1.2.10+dfsg-8 |
| debian 13 | log4net | 1.2.10+dfsg-8 |
| debian 14 | log4net | 1.2.10+dfsg-8 |
| debian 8 | log4net | 1.2.10+dfsg-6+deb8u1 |
| debian 9 | log4net | kein Fix angegeben |
| echo | log4net | 1.2.10+dfsg-8 |
| ubuntu 16.04 | log4net | 1.2.10+dfsg-7ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | log4net | 1.2.10+dfsg-7ubuntu0.16.04.1 |
| ubuntu 18.04 | log4net | 1.2.10+dfsg-7ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | log4net | 1.2.10+dfsg-7ubuntu0.18.04.1 |
Alle 15 Einträge aus 15 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| nuget::GitHub Security Advisory NuGet | log4net | 2.0.10 |
| debian 10 | log4net | kein Fix angegeben |
| debian 11 | log4net | 1.2.10+dfsg-8 |
| debian 13 | log4net | 1.2.10+dfsg-8 |
| debian 14 | log4net | 1.2.10+dfsg-8 |
| debian 8 | log4net | 1.2.10+dfsg-6+deb8u1 |
| debian 9 | log4net | kein Fix angegeben |
| echo | log4net | 1.2.10+dfsg-8 |
| ubuntu 16.04 | log4net | 1.2.10+dfsg-7ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | log4net | 1.2.10+dfsg-7ubuntu0.16.04.1 |
| ubuntu 18.04 | log4net | 1.2.10+dfsg-7ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | log4net | 1.2.10+dfsg-7ubuntu0.18.04.1 |
| ubuntu 20.04 | log4net | 1.2.10+dfsg-7ubuntu0.20.04.1 |
| ubuntu 20.04-ESM | log4net | 1.2.10+dfsg-7ubuntu0.20.04.1 |
| ubuntu 20.10 | log4net | 1.2.10+dfsg-7ubuntu0.20.10.1 |
Referenzen
- https://github.com/apache/logging-log4net
- https://github.com/apache/logging-log4net/commit/d0b4b0157d4af36b23c24a23739c47925c3bd8d7
- https://issues.apache.org/jira/browse/LOG4NET-575
- https://lists.apache.org/thread.html/r00b16ac5e0bbf7009a0d167ed58f3f94d0033b0f4b3e3d5025cc4872@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/r33564de316d4e4ba0fea1d4d079e62cde1ffe64369c1157243d840d9@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/r525cbbd7db0aef4a114cf60de8439aa285decc34904d42a7f14f39c3@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/r6543acafca3e2d24ff4b0c364a91540cb9378977ffa8d37a03ab4b0f@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/r7ab6b6e702f11a6f77b0db2af2d5e5532f56ae4b99b5fe73c5200b6a@%3Cdev.logging.apache.org%3E
Alle 29 Referenzen
- https://lists.apache.org/thread.html/r9de86a185575e6c5f92e2a70a1d2e2e9514dc4341251577aac8e3866@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/rd2d72a017e238d1f345f9d14e075c81be16fc68a41c9e9ad9e29a732@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/rdbac24c945ca5c69cd5348b5ac023bc625768f653335de146e09ae2d@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/reab1c277c95310bad1038255e0757857b2fbe291411b4fa84552028a@%3Cdev.logging.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2U233HVAQDSZ2PRG4XSGDASLY3J6ALH
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2U233HVAQDSZ2PRG4XSGDASLY3J6ALH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKL2LPINAI6BCMXOH4V4HVHGLUXIWOFO
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKL2LPINAI6BCMXOH4V4HVHGLUXIWOFO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT2DNNSW7C7FNK3MA3SLEUHGW5USYZKE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT2DNNSW7C7FNK3MA3SLEUHGW5USYZKE/
- https://nvd.nist.gov/vuln/detail/CVE-2018-1285
- https://security.netapp.com/advisory/ntap-20220909-0001
- https://security.netapp.com/advisory/ntap-20220909-0001/
- https://snyk.io/vuln/SNYK-DOTNET-LOG4NET-568897
- https://ubuntu.com/security/notices/USN-4699-1
- https://www.cve.org/CVERecord?id=CVE-2018-1285
- https://www.nuget.org/packages/log4net
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2018-1285