Unrated
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks...
CVE-2018-1285
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2018-1285 log4net Fixed in: 1.2.10+dfsg-8
Original description The description as published by the source.
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory lists.apache.org
- advisory security.netapp.com
- advisory oracle.com
- advisory oracle.com
- patch oracle.com
- report issues.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org