Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN544
_____________________________________________________________________

DATE                : 25/08/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Log4cxx versions prior
                                      to 1.5.0.

=====================================================================
https://lists.apache.org/thread/nl7dggjfcqmy4nkmgdb5244bnvdcfo8q
https://lists.apache.org/thread/dxst0j3yr4rtcrmh5k3t04m3433v3mhk
_____________________________________________________________________

CVE-2025-54813: Apache Log4cxx: Improper escaping with JSONLayout
Severity: moderate 

Affected versions:

- Apache Log4cxx 0.11.0 before 1.5.0

Description:

Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.

When using JSONLayout, not all payload bytes are properly escaped. If
an attacker-supplied message contains certain non-printable characters,
these will be passed along in the message and written out as part of
the JSON message. This may prevent applications that consume these
logs from correctly interpreting the information within them.

This issue affects Apache Log4cxx: before 1.5.0.

Users are recommended to upgrade to version 1.5.0, which fixes the
issue.


Credit:

Sovereign Tech Agency (sponsor)


References:

https://logging.apache.org/security.html#CVE-2025-54813
https://github.com/apache/logging-log4cxx/pull/512
https://logging.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-54813

_____________________________________________________________________

CVE-2025-54812: Apache Log4cxx: Improper HTML escaping in HTMLLayout
Severity: low 

Affected versions:

- Apache Log4cxx before 1.5.0

Description:

Improper Output Neutralization for Logs vulnerability in Apache
Log4cxx.


When using HTMLLayout, logger names are not properly escaped when
writing out to the HTML file.
If untrusted data is used to retrieve the name of a logger, an
attacker could theoretically inject HTML or Javascript in order to
hide information from logs or steal data from the user.

In order to activate this, the following sequence must occur:



  *  Log4cxx is configured to use HTMLLayout.

  *  Logger name comes from an untrusted string

  *  Logger with compromised name logs a message

  *  User opens the generated HTML log file in their browser, leading
to potential XSS


Because logger names are generally constant strings, we assess the
impact to users as LOW


This issue affects Apache Log4cxx: before 1.5.0.


Users are recommended to upgrade to version 1.5.0, which fixes the
issue.


Credit:

Sovereign Tech Agency (sponsor)


References:

https://logging.apache.org/security.html#CVE-2025-54812
https://github.com/apache/logging-log4cxx/pull/509
https://github.com/apache/logging-log4cxx/pull/514
https://logging.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-54812




=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================