CVE-2018-1285: XEE
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-1285?
CVE-2018-1285 is a vulnerability in Apache log4net versions before 2.0.10 that allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
What is the severity of CVE-2018-1285?
CVE-2018-1285 has a severity rating of 9.8 (critical).
Which software versions are affected by CVE-2018-1285?
CVE-2018-1285 affects Apache log4net versions before 2.0.10, Fedoraproject Fedora versions 30, 31, and 32, Oracle Application Testing Suite 13.3.0.1, Oracle Hospitality Opera 5 versions 5.5 and 5.6, Oracle Hospitality Simphony versions 18.2.7.2 and 19.1.3, Netapp Manageability Software Development Kit, and Netapp Snapcenter.
How can I fix CVE-2018-1285?
To fix CVE-2018-1285, upgrade to Apache log4net version 2.0.10 or later.
Where can I find more information about CVE-2018-1285?
More information about CVE-2018-1285 can be found on the Apache JIRA page (https://issues.apache.org/jira/browse/LOG4NET-575) and the Apache mailing list archives (https://lists.apache.org/thread.html/r00b16ac5e0bbf7009a0d167ed58f3f94d0033b0f4b3e3d5025cc4872@%3Cdev.logging.apache.org%3E, https://lists.apache.org/thread.html/r33564de316d4e4ba0fea1d4d079e62cde1ffe64369c1157243d840d9@%3Cdev.logging.apache.org%3E).