Debian/log4net: critical 9.8
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled l
Action: Upgrade log4net to 1.2.10+dfsg-8 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.2.10+dfsg-8 | - |
Fixed versions
| 1.2.10+dfsg-8 |
Sources
- osv: DEBIAN-CVE-2018-1285#Debian:14/log4net
- https://security-tracker.debian.org/tracker/CVE-2018-1285
published · modified · JSON