Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1269342 > unrolled thread

Bug#1120278: trixie-pu: package log4cxx/1.4.0-1+deb13u1

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1120278: trixie-pu: package log4cxx/1.4.0-1+deb13u1 Tobias Frost <tobi@debian.org> - 2025-11-06 22:20 +0100
    Bug#1120278: log4cxx 1.4.0-1+deb13u1 flagged for acceptance Adam D Barratt <adam@adam-barratt.org.uk> - 2025-11-07 20:40 +0100

#1269342 — Bug#1120278: trixie-pu: package log4cxx/1.4.0-1+deb13u1

[Multipart message — attachments visible in raw view] — view raw

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: log4cxx@packages.debian.org, Lukas Märdian <slyon@debian.org>
Control: affects -1 + src:log4cxx
User: release.debian.org@packages.debian.org
Usertags: pu

After Lukas Märdian has prepared updated fixing CVE-2025-54812 and CVE-2025-54813
for unstable and bookworm, this is the backport for trixie, so that
there won't be a regression for people updating from a LTS release to
trixie.

(An update for bookworm will be prepared after this one)

[ Reason ]
For log4cxx those vulnerabilities have been reported:
CVE-2025-54812 and CVE-2025-54813, both are improper sanitatation
vulnerabilities (quoted from DLA-4322-1):

CVE-2025-54812

    When using HTMLLayout, logger names are not properly escaped when
    writing out to the HTML file. If untrusted data is used to retrieve
    the name of a logger, an attacker could theoretically inject HTML or
    Javascript in order to hide information from logs or steal data from
    the user.

CVE-2025-54813

    When using JSONLayout, not all payload bytes are properly escaped.
    If an attacker-supplied message contains certain non-printable
    characters, these will be passed along in the message and written out
    as part of the JSON message. This may prevent applications that
    consume these logs from correctly interpreting the information within
    them.

[ Impact ]
Regression when updating from older Debian releaeses.

[ Tests ]
There are upstream unit tests for the CVEs.

[ Risks ]
The patches are cherry-picked from upstream and applied cleanly without
modifications (the affected code paths have not changed much since the
version in trixie.) The patches are also not very complex.
And. due to the tests, I think the risk of regressions is quite low.


[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable


Cheers,

-- 
tobi

[toc] | [next] | [standalone]

#1269454 — Bug#1120278: log4cxx 1.4.0-1+deb13u1 flagged for acceptance

package release.debian.org
tags 1120278 = trixie pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian trixie.

Thanks for your contribution!

Upload details
==============

Package: log4cxx
Version: 1.4.0-1+deb13u1

Explanation: fix improper escaping issues [CVE-2025-54812 CVE-2025-54813]

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web