crítica
CVE-2018-1285
Apache log4net versions before 2.0.10 do not disable XML external enti ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Ubuntu (media).
Descripción
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| nuget::GitHub Security Advisory NuGet | log4net | 2.0.10 |
| debian 10 | log4net | sin corrección indicada |
| debian 11 | log4net | 1.2.10+dfsg-8 |
| debian 13 | log4net | 1.2.10+dfsg-8 |
| debian 14 | log4net | 1.2.10+dfsg-8 |
| debian 8 | log4net | 1.2.10+dfsg-6+deb8u1 |
| debian 9 | log4net | sin corrección indicada |
| echo | log4net | 1.2.10+dfsg-8 |
| ubuntu 16.04 | log4net | 1.2.10+dfsg-7ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | log4net | 1.2.10+dfsg-7ubuntu0.16.04.1 |
| ubuntu 18.04 | log4net | 1.2.10+dfsg-7ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | log4net | 1.2.10+dfsg-7ubuntu0.18.04.1 |
Mostrar las 15 entradas de 15 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| nuget::GitHub Security Advisory NuGet | log4net | 2.0.10 |
| debian 10 | log4net | sin corrección indicada |
| debian 11 | log4net | 1.2.10+dfsg-8 |
| debian 13 | log4net | 1.2.10+dfsg-8 |
| debian 14 | log4net | 1.2.10+dfsg-8 |
| debian 8 | log4net | 1.2.10+dfsg-6+deb8u1 |
| debian 9 | log4net | sin corrección indicada |
| echo | log4net | 1.2.10+dfsg-8 |
| ubuntu 16.04 | log4net | 1.2.10+dfsg-7ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | log4net | 1.2.10+dfsg-7ubuntu0.16.04.1 |
| ubuntu 18.04 | log4net | 1.2.10+dfsg-7ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | log4net | 1.2.10+dfsg-7ubuntu0.18.04.1 |
| ubuntu 20.04 | log4net | 1.2.10+dfsg-7ubuntu0.20.04.1 |
| ubuntu 20.04-ESM | log4net | 1.2.10+dfsg-7ubuntu0.20.04.1 |
| ubuntu 20.10 | log4net | 1.2.10+dfsg-7ubuntu0.20.10.1 |
Referencias
- https://github.com/apache/logging-log4net
- https://github.com/apache/logging-log4net/commit/d0b4b0157d4af36b23c24a23739c47925c3bd8d7
- https://issues.apache.org/jira/browse/LOG4NET-575
- https://lists.apache.org/thread.html/r00b16ac5e0bbf7009a0d167ed58f3f94d0033b0f4b3e3d5025cc4872@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/r33564de316d4e4ba0fea1d4d079e62cde1ffe64369c1157243d840d9@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/r525cbbd7db0aef4a114cf60de8439aa285decc34904d42a7f14f39c3@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/r6543acafca3e2d24ff4b0c364a91540cb9378977ffa8d37a03ab4b0f@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/r7ab6b6e702f11a6f77b0db2af2d5e5532f56ae4b99b5fe73c5200b6a@%3Cdev.logging.apache.org%3E
Las 29 referencias
- https://lists.apache.org/thread.html/r9de86a185575e6c5f92e2a70a1d2e2e9514dc4341251577aac8e3866@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/rd2d72a017e238d1f345f9d14e075c81be16fc68a41c9e9ad9e29a732@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/rdbac24c945ca5c69cd5348b5ac023bc625768f653335de146e09ae2d@%3Cdev.logging.apache.org%3E
- https://lists.apache.org/thread.html/reab1c277c95310bad1038255e0757857b2fbe291411b4fa84552028a@%3Cdev.logging.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2U233HVAQDSZ2PRG4XSGDASLY3J6ALH
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2U233HVAQDSZ2PRG4XSGDASLY3J6ALH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKL2LPINAI6BCMXOH4V4HVHGLUXIWOFO
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKL2LPINAI6BCMXOH4V4HVHGLUXIWOFO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT2DNNSW7C7FNK3MA3SLEUHGW5USYZKE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT2DNNSW7C7FNK3MA3SLEUHGW5USYZKE/
- https://nvd.nist.gov/vuln/detail/CVE-2018-1285
- https://security.netapp.com/advisory/ntap-20220909-0001
- https://security.netapp.com/advisory/ntap-20220909-0001/
- https://snyk.io/vuln/SNYK-DOTNET-LOG4NET-568897
- https://ubuntu.com/security/notices/USN-4699-1
- https://www.cve.org/CVERecord?id=CVE-2018-1285
- https://www.nuget.org/packages/log4net
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2018-1285