<html>
<head>
<base href="https://bugzilla.rosalinux.ru/">
</head>
<body><span class="vcard"><a class="email" href="mailto:s.matveev@rosalinux.ru" title="Svyatoslav Matveev <s.matveev@rosalinux.ru>"> <span class="fn">Svyatoslav Matveev</span></a>
</span> changed
<a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - [CVE 21] log4net 1.2.15 CVEs found"
href="https://bugzilla.rosalinux.ru/show_bug.cgi?id=13270">bug 13270</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Status</td>
<td>CONFIRMED
</td>
<td>RESOLVED
</td>
</tr>
<tr>
<td style="text-align:right;">Resolution</td>
<td>---
</td>
<td>FIXED
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - [CVE 21] log4net 1.2.15 CVEs found"
href="https://bugzilla.rosalinux.ru/show_bug.cgi?id=13270#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - [CVE 21] log4net 1.2.15 CVEs found"
href="https://bugzilla.rosalinux.ru/show_bug.cgi?id=13270">bug 13270</a>
from <span class="vcard"><a class="email" href="mailto:s.matveev@rosalinux.ru" title="Svyatoslav Matveev <s.matveev@rosalinux.ru>"> <span class="fn">Svyatoslav Matveev</span></a>
</span></b>
<pre>
(In reply to Yury from <a href="show_bug.cgi?id=13270#c0">comment #0</a>)
<span class="quote">> Please patch CVEs for package log4net version 1.2.15
>
> INFO (CVEs are): log4net 1.2.15
> cves found
> CVE-2018-1285
> Desc: Apache log4net versions before 2.0.10 do not disable XML external
> entities when parsing log4net configuration files. This allows for XXE-based
> attacks in applications that accept attacker-controlled log4net
> configuration files.
> Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-1285">https://nvd.nist.gov/vuln/detail/CVE-2018-1285</a>
> Severity: CRITICAL</span >
Уязвимость закрыта патчем.
Данный проект не подлежит проверки QA т.к.
лежит в репозитории contrib.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>