Bugzilla – Bug 1172193
VUL-0: CVE-2018-1285: log4net: XXE in applications that accept arbitrary configuration files from users
Last modified: 2022-10-19 03:51:19 UTC
CVE-2018-1285 Apache log4net before 2.0.8 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users. References: https://issues.apache.org/jira/browse/LOG4NET-575 https://github.com/apache/logging-log4net/commit/d0b4b0157d4af36b23c24a23739c47925c3bd8d7
Tracked SLE11, Leap 15.1 and Factory as affected
This is an autogenerated message for OBS integration: This bug (1172193) was mentioned in https://build.opensuse.org/request/show/1001652 15.4 / log4net
The version deviation is huge nowadays compared to what we have in our projects. So it would be better if anyone could take a technical review of the backport in the comments right above (which I think it is safe :-)).
(In reply to Yifan Jiang from comment #7) > The version deviation is huge nowadays compared to what we have in our > projects. So it would be better if anyone could take a technical review of > the backport in the comments right above (which I think it is safe :-)). ProhibitDtd seems deprecated for new .NET versions. Are you sure DtdProcessing couldn't be used here? Otherwise, it's fine from a security side. Feel free to add a technical reviewer to this ticket if you want further review :)
Cleaning up GNOME CVE backlog. The fix has been submitted and accepted. Assign back to security team.