CVE-2018-1285
Fixed in a distro release EPSS 18%
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Products: apache log4net, fedoraproject fedora, oracle application_testing_suite, oracle hospitality_opera_5, oracle hospitality_simphony, netapp manageability_software_development_kit, netapp snapcenter
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| NuGet | log4net | 2.0.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | log4net | 1.2.10+dfsg-8 |
| Debian 14 | log4net | 1.2.10+dfsg-8 |
| Debian 8 | log4net | 1.2.10+dfsg-6+deb8u1 |
| Ubuntu 16.04 LTS | log4net | 1.2.10+dfsg-7ubuntu0.16.04.1 |
| Ubuntu 18.04 LTS | log4net | 1.2.10+dfsg-7ubuntu0.18.04.1 |
| Ubuntu 20.04 LTS | log4net | 1.2.10+dfsg-7ubuntu0.20.04.1 |
| openSUSE Tumbleweed | log4net | 1.2.10-78.1 |