[Git][security-tracker-team/security-tracker][master] Add new log4net issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2ac37e07 by Salvatore Bonaccorso at 2026-10-07T10:54:23+02:00
Add new log4net issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -388,17 +388,37 @@ CVE-2026-105268 (The Gitea API routes for issue attachments (`/api/v1/repos/{own
 CVE-2026-105267 (The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/dele ...)
 	NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
 CVE-2026-105244 (Improper Encoding or Escaping of Output vulnerability in the RemoteSys ...)
-	TODO: check
+	- log4net <undetermined>
+	NOTE: https://github.com/apache/logging-log4net/pull/315
+	NOTE: Fixed by: https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7 (rc/3.5.0-rc1)
+	NOTE: https://lists.apache.org/thread/q7649hhdodthoqw8jsjgtnb4m8qfy6d6
+	TODO: check, might not affect our old version and upstream claims 1.2.12 onwards
 CVE-2026-105243 (Insufficient Logging vulnerability in the EventLogAppender of Apache l ...)
-	TODO: check
+	- log4net <unfixed>
+	NOTE: https://github.com/apache/logging-log4net/pull/315
+	NOTE: Fixed by: https://github.com/apache/logging-log4net/commit/28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed (rc/3.5.0-rc1)
+	NOTE: https://lists.apache.org/thread/jr6fj5skv1vnjbc9jmt8bp151p8ow1rp
 CVE-2026-105242 (Improper Handling of Exceptional Conditions vulnerability in the aspne ...)
-	TODO: check
+	- log4net <undetermined>
+	NOTE: https://github.com/apache/logging-log4net/pull/316
+	NOTE: Fixed by: https://github.com/apache/logging-log4net/commit/145203420c579a703008b4b723b6a080757f4964 (rc/3.5.0-rc1)
+	NOTE: https://lists.apache.org/thread/zg6dbqm4ztm7j3c21nfsqj0yxm5yrpdx
+	TODO: check, might not affect our old version, upstream claims 12.11 onwards
 CVE-2026-105241 (Improper Handling of Unicode Encoding vulnerability in the SmtpPickupD ...)
-	TODO: check
+	- log4net <unfixed>
+	NOTE: https://github.com/apache/logging-log4net/pull/315
+	NOTE: Fixed by: https://github.com/apache/logging-log4net/commit/4d2e10f0908199604b4326f9df6d0b43b871e333 (rc/3.5.0-rc1)
+	NOTE: https://lists.apache.org/thread/hg8dgh3oy8bp3dhb8nsygk9kw2o401ws
 CVE-2026-105240 (Improper Neutralization of Null Byte or NUL Character vulnerability in ...)
-	TODO: check
+	- log4net <unfixed>
+	NOTE: https://github.com/apache/logging-log4net/pull/315
+	NOTE: Fixed by: https://github.com/apache/logging-log4net/commit/6046fe9d7f353b49fe995361c071ec2eea8f7ef6 (rc/3.5.0-rc1)
+	NOTE: https://lists.apache.org/thread/gyw2d4ppy82t1vlpdknkfd1nmzp21z17
 CVE-2026-105239 (Improper Neutralization of Null Byte or NUL Character vulnerability in ...)
-	TODO: check
+	- log4net <unfixed>
+	NOTE: https://github.com/apache/logging-log4net/pull/315
+	NOTE: Fixed by: https://github.com/apache/logging-log4net/commit/dc5855a0720c91590fd7a81d729ea01fdd69e000 (rc/3.5.0-rc1)
+	NOTE: https://lists.apache.org/thread/9fx1qo5hc0tg8ym0t6p9gt1zpb2qlxpq
 CVE-2026-105111 (Improper neutralization of input during web page generation ('cross-si ...)
 	- bcel <unfixed>
 	NOTE: https://www.openwall.com/lists/oss-security/2026/10/07/13



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2ac37e07af4e07b584b6f35c6fb2686790a932e3

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2ac37e07af4e07b584b6f35c6fb2686790a932e3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/d3f28024/attachment-0001.htm>