CVE-2018-1285 - 漏洞详情

CVE-2018-1285 (CNNVD-202005-442)

CRITICAL

中文标题:

Apache log4net 代码问题漏洞

英文标题:

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net conf...

CVSS分数: 9.8

发布时间: 2020-05-11 16:41:28

漏洞类型: 代码问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

Apache log4net是美国阿帕奇（Apache）基金会的一款日志输出工具。 Apache log4net 2.0.8之前版本中log4net配置文件的解析过程存在代码问题漏洞。攻击者可借助特制XML内容利用该漏洞迫使系统接受任意配置文件。

英文描述:

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

CWE类型:

CWE-611

受影响产品

厂商	产品	版本	版本范围	平台	CPE
apache	log4net	*	-	-	`cpe:2.3:a:apache:log4net::::::::`
fedoraproject	fedora	30	-	-	`cpe:2.3:o:fedoraproject:fedora:30:::::::*`
fedoraproject	fedora	31	-	-	`cpe:2.3:o:fedoraproject:fedora:31:::::::*`
fedoraproject	fedora	32	-	-	`cpe:2.3:o:fedoraproject:fedora:32:::::::*`
oracle	application_testing_suite	13.3.0.1	-	-	`cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:::::::*`
oracle	hospitality_opera_5	5.5	-	-	`cpe:2.3:a:oracle:hospitality_opera_5:5.5:::::::*`
oracle	hospitality_opera_5	5.6	-	-	`cpe:2.3:a:oracle:hospitality_opera_5:5.6:::::::*`
oracle	hospitality_simphony	18.2.7.2	-	-	`cpe:2.3:a:oracle:hospitality_simphony:18.2.7.2:::::::*`
oracle	hospitality_simphony	19.1.3	-	-	`cpe:2.3:a:oracle:hospitality_simphony:19.1.3:::::::*`
netapp	manageability_software_development_kit	-	-	-	`cpe:2.3:a:netapp:manageability_software_development_kit:-:::::::*`
netapp	snapcenter	-	-	-	`cpe:2.3:a:netapp:snapcenter:-:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

FEDORA-2020-cfc319e067 vendor-advisory
cve.org

访问

FEDORA-2020-73d380e9b9 vendor-advisory
cve.org

访问

FEDORA-2020-847775bf79 vendor-advisory
cve.org

访问

[logging-dev] 20200525 [CVE-2018-1285] XXE vulnerability in Apache log4net mailing-list
cve.org

访问

[logging-dev] 20200525 Re: [CVE-2018-1285] XXE vulnerability in Apache log4net mailing-list
cve.org

访问

[logging-dev] 20200617 Re: [CVE-2018-1285] XXE vulnerability in Apache log4net mailing-list
cve.org

访问

[logging-dev] 20200730 Re: [CVE-2018-1285] XXE vulnerability in Apache log4net mailing-list
cve.org

访问

[logging-dev] 20200826 log4net.dll - does 2.0.9 fix CVE-2018-1285 mailing-list
cve.org

访问

[logging-dev] 20200826 Re: log4net.dll - does 2.0.9 fix CVE-2018-1285 mailing-list
cve.org

访问

[logging-dev] 20200906 [VOTE] [log4net] Release 2.0.10 mailing-list
cve.org

访问