Bug 2390429 (CVE-2025-54812)

Summary: CVE-2025-54812 log4cxx: Log4cxx HTMLLayout XSS Vulnerability
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in log4cxx. When using HTMLLayout, logger names are not properly escaped. This vulnerability allows an attacker to provide untrusted data as a logger name to inject arbitrary HTML content into log output files. This issue can lead to cross-site scripting vulnerabilities if the HTML log files are subsequently viewed in a web browser.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2393059, 2393058, 2393060, 2393061, 2393062    
Bug Blocks:    

Description OSIDB Bzimport 2025-08-22 19:01:28 UTC 
Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.


When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file.
If untrusted data is used to retrieve the name of a logger, an attacker could theoretically inject HTML or Javascript in order to hide information from logs or steal data from the user.
In order to activate this, the following sequence must occur:



  *  Log4cxx is configured to use HTMLLayout.

  *  Logger name comes from an untrusted string

  *  Logger with compromised name logs a message

  *  User opens the generated HTML log file in their browser, leading to potential XSS


Because logger names are generally constant strings, we assess the impact to users as LOW


This issue affects Apache Log4cxx: before 1.5.0.


Users are recommended to upgrade to version 1.5.0, which fixes the issue.