XML External Entity attack in log4net (CVE-2018-1285)

[gep13]

Enhancement Information

We need to update to the latest log4net package version in all Chocolatey code bases, including this one. This is due to an:

XML External Entity attack in log4net

which can:

Apache log4net before 2.0.10 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.

The recommendation is to update to at least 2.0.10, however, we have decided to go straight to 2.0.12.

References

• GitHub Advisory

Notes

It's important to point out to exploit this with Chocolatey, someone would need administrative access to the machine due to the folder locations where the log4net config file would need to be placed. With administrative privileges already, it's unlikely that they would need to exploit this vulnerability. Thus why a longer lead time for this. While the exploit was highly critical in other applications, due to Chocolatey's security on the file system, the criticality was reduced to patch during next release cycle.