CVE-2018-1285
liblog4net1.2-cil: Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files
CVE-2018-1285 is fixed in liblog4net1.2-cil on 1 platform, first by liblog4net1.2-cil 1.2.10+dfsg-7ubuntu0.18.04.1, released May 11, 2020. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.1782
97th percentile
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| liblog4net1.2-cil · Ubuntu 18.04.6 LTS (bionic) | 1.2.10+dfsg-7ubuntu0.18.04.1 | liblog4net1.2-cil 1.2.10+dfsg-7ubuntu0.18.04.1 | May 11, 2020 |
| liblog4net1.2-cil · Ubuntu 20.04 LTS (focal) | 1.2.10+dfsg-7ubuntu0.20.04.1 | liblog4net1.2-cil 1.2.10+dfsg-7ubuntu0.20.04.1 | May 11, 2020 |