Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1269342

Bug#1120278: trixie-pu: package log4cxx/1.4.0-1+deb13u1

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: log4cxx@packages.debian.org, Lukas Märdian <slyon@debian.org>
Control: affects -1 + src:log4cxx
User: release.debian.org@packages.debian.org
Usertags: pu

After Lukas Märdian has prepared updated fixing CVE-2025-54812 and CVE-2025-54813
for unstable and bookworm, this is the backport for trixie, so that
there won't be a regression for people updating from a LTS release to
trixie.

(An update for bookworm will be prepared after this one)

[ Reason ]
For log4cxx those vulnerabilities have been reported:
CVE-2025-54812 and CVE-2025-54813, both are improper sanitatation
vulnerabilities (quoted from DLA-4322-1):

CVE-2025-54812

    When using HTMLLayout, logger names are not properly escaped when
    writing out to the HTML file. If untrusted data is used to retrieve
    the name of a logger, an attacker could theoretically inject HTML or
    Javascript in order to hide information from logs or steal data from
    the user.

CVE-2025-54813

    When using JSONLayout, not all payload bytes are properly escaped.
    If an attacker-supplied message contains certain non-printable
    characters, these will be passed along in the message and written out
    as part of the JSON message. This may prevent applications that
    consume these logs from correctly interpreting the information within
    them.

[ Impact ]
Regression when updating from older Debian releaeses.

[ Tests ]
There are upstream unit tests for the CVEs.

[ Risks ]
The patches are cherry-picked from upstream and applied cleanly without
modifications (the affected code paths have not changed much since the
version in trixie.) The patches are also not very complex.
And. due to the tests, I think the risk of regressions is quite low.


[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable


Cheers,

-- 
tobi

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1120278: trixie-pu: package log4cxx/1.4.0-1+deb13u1 Tobias Frost <tobi@debian.org> - 2025-11-06 22:20 +0100
  Bug#1120278: log4cxx 1.4.0-1+deb13u1 flagged for acceptance Adam D Barratt <adam@adam-barratt.org.uk> - 2025-11-07 20:40 +0100

csiph-web