Skip to content
OpenAdvisories
Critical USN-4699-1 1 CVE

log4net vulnerability

Published Jan 19, 2021 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Apache Log4net incorrectly handled certain configuration files.
An attacker could possibly use this issue to expose sensitive information.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS log4net 1.2.10+dfsg-7ubuntu0.16.04.1
Ubuntu · 18.04 LTS 18.04:LTS log4net 1.2.10+dfsg-7ubuntu0.18.04.1
Ubuntu · 20.04 LTS 20.04:LTS log4net 1.2.10+dfsg-7ubuntu0.20.04.1

Vulnerabilities 1

  • Critical 9.8
    CVE-2018-1285 Public exploit EPSS 18%

    XML External Entity attack in log4net

    Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

    log4net log4net log4net Debian Ubuntu NuGet

References

  • report
    https://ubuntu.com/security/CVE-2018-1285