Advisories » MGASA-2020-0233

Updated log4net packages fix security vulnerability

Publication date: 27 May 2020
Modification date: 27 May 2020
Type: security
Affected Mageia releases : 7
CVE: CVE-2018-1285

Description

Updated log4net packages fix security vulnerability
This patch fixes a security vulnerabiliy reported by Karthik
Balasundaram. The security vulnerability was found in the way
how log4net parses xml configuration files where it allowed to
process XML External Entity Processing. An attacker could use 
this as an attack vector if he could modify the XML configuration file.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=26608
• https://www.debian.org/lts/security/2020/dla-2211
• https://github.com/apache/logging-log4net/commit/d0b4b0157d4af36b23c24a23739c47925c3bd8d7
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1285

SRPMS

7/core

• log4net-2.0.8-2.1.mga7