Bug 1835982 (CVE-2018-1285)

Summary:	CVE-2018-1285 log4net: XXE in applications that accept arbitrary configuration files from users
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	claudiorodrigo, mailinglists, tcallawa
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-15 15:15:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1836221, 1836222
Bug Blocks:

Description Guilherme de Almeida Suckevicz 2020-05-14 20:29:56 UTC

Apache log4net before 2.0.8 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.

References:
https://issues.apache.org/jira/browse/LOG4NET-575
https://lists.apache.org/thread.html/reab1c277c95310bad1038255e0757857b2fbe291411b4fa84552028a%40%3Cdev.logging.apache.org%3E

Comment 1 Timotheus Pokorra 2020-05-15 05:13:30 UTC

As far as I can see, we are using version 2.0.8 in all supported Fedora releases and in Epel 7 and 8:
We don't have a package in Epel 6.
https://apps.fedoraproject.org/packages/log4net

Comment 2 Timotheus Pokorra 2020-05-15 05:25:56 UTC

@Guilherme: you wrote "before 2.0.8", but the Apache issue says "Affected: log4net up to 2.0.8"

Here is the patch that fixes it: https://github.com/apache/logging-log4net/commit/d0b4b01

I will apply this to the packages.

Comment 3 Guilherme de Almeida Suckevicz 2020-05-15 12:53:07 UTC

In reply to comment #2:
> @Guilherme: you wrote "before 2.0.8", but the Apache issue says "Affected:
> log4net up to 2.0.8"
> 
> Here is the patch that fixes it:
> https://github.com/apache/logging-log4net/commit/d0b4b01
> 
> I will apply this to the packages.

This is the way it was reported to Mitre[1]. Since the package is affected by this issue I will create Fedora and EPEL trackers for it.
Thanks.

[1]. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1285

Comment 4 Guilherme de Almeida Suckevicz 2020-05-15 12:53:25 UTC

Created log4net tracking bugs for this issue:

Affects: epel-all [bug 1836222]
Affects: fedora-all [bug 1836221]

Comment 5 Product Security DevOps Team 2020-05-15 15:15:21 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.