Log4Net
Monthly
Log-integrity tampering in the RemoteSyslogAppender of Apache log4net affects versions from 1.2.12 up to but not including 3.5.0, where characters outside the visible ASCII range are silently deleted from syslog records instead of being escaped. An unauthenticated remote party who can influence a value that reaches a log message (for example, a username containing a zero-width space) can make a distinct value appear identical to another in the audit record, such as a user name being logged as 'admin'. Only applications that explicitly configure RemoteSyslogAppender are affected; deployments using file, console, or other appenders are not. Impact is limited to integrity of the log record (CVSS I:L) with no confidentiality or availability effect, and no public exploit has been identified at time of analysis.
Silent suppression of Windows event-log records in Apache log4net's EventLogAppender lets a party that can influence logged content erase a whole event record without any error being raised. Applications on Windows that use EventLogAppender in log4net 1.2.9 through versions before 3.5.0 are affected: messages are truncated to a hard-coded 31,837-character ceiling that exceeds the real Event Log record budget once the log name, source name, and machine name are counted, so the service silently stores and reports nothing for the oversized record. No public exploit identified at time of analysis, and the independent assessment rates this a genuine but low-priority, niche-configuration issue (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), since an attacker must be able to push a single logged message into the tens-of-kilobytes range.
Log-record suppression in the %aspnet-request pattern converter of Apache log4net lets an unauthenticated remote sender erase the log entry for their own request by placing markup such as <script> in a parameter, because reading HttpRequest.Params triggers ASP.NET request validation, throws HttpRequestValidationException inside the layout, and causes the appender to discard the entire event. Only applications running on ASP.NET for .NET Framework (the converter depends on System.Web, which netstandard/.NET Core lacks) with log4net 1.2.11 through 3.4.x and a layout that explicitly uses %aspnet-request are affected; versions from 3.5.0 onward are fixed. Impact is confined to the attacker suppressing logging of their own request - it cannot read data, delete other users' records, or crash the service - and there is no public exploit identified at time of analysis, no CISA KEV listing, and the assessed vector is AV:N/AC:L/PR:N/UI:N with only a low integrity impact (CVSS 5.3), making this a real but low-priority issue whose practical value is helping an attacker evade audit trails for a separate attack.
Improper handling of Unicode encoding in Apache log4net's SmtpPickupDirAppender lets an attacker who can place unencodable content - such as an unpaired UTF-16 surrogate like U+D800 - into a logged message break the appender's file writer, causing the entire buffered batch of logging events to be discarded rather than just the offending event, and leaving a truncated mail file in the pickup directory for the mail service to send. Only applications configured to use SmtpPickupDirAppender (the SMTP pickup-directory appender) with event buffering are affected; versions from 1.2.9 before 3.5.0 are impacted. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - remote and unauthenticated once attacker data reaches a rendered log field - but impact is confined to integrity of log output (suppression/truncation of audit records), with no confidentiality or availability loss; no public exploit code was identified at time of analysis and it is not confirmed actively exploited (not in CISA KEV).
A NUL character (U+0000) embedded in content that reaches a log message causes Apache log4net's OutputDebugStringAppender to truncate the emitted debug record at that point, silently discarding everything the layout rendered afterwards, including exception text and trailing fields. Only Windows applications that explicitly configure the non-default OutputDebugStringAppender are affected, across log4net versions from 1.2.9 up to (but excluding) 3.5.0. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) the flaw is unauthenticated and remotely reachable where attacker-controlled data is logged, but it is limited to log-record integrity with no confidentiality, availability, or code-execution impact; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so overall real-world risk is low-to-moderate.
Log-record truncation in Apache log4net's EventLogAppender silently drops everything a layout renders after a NUL (\0) character, so a party whose data reaches a log message can hide the remainder of that Windows Event Log record - including exception text and trailing fields - with no error raised. The flaw (CWE-158, CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) affects Apache log4net from 1.2.9 before 3.5.0 and only Windows applications configured to use EventLogAppender; non-Windows hosts and any other appender are unaffected. Impact is limited to integrity of a single log entry (no code execution, confidentiality or availability loss), and no public exploit code was identified at time of analysis - this is a medium/low-priority log-suppression issue rather than an urgent compromise vector. The upstream fix escapes NUL characters before the message-size limit is applied and is shipped in log4net 3.5.0.
Log-integrity tampering in the RemoteSyslogAppender of Apache log4net affects versions from 1.2.12 up to but not including 3.5.0, where characters outside the visible ASCII range are silently deleted from syslog records instead of being escaped. An unauthenticated remote party who can influence a value that reaches a log message (for example, a username containing a zero-width space) can make a distinct value appear identical to another in the audit record, such as a user name being logged as 'admin'. Only applications that explicitly configure RemoteSyslogAppender are affected; deployments using file, console, or other appenders are not. Impact is limited to integrity of the log record (CVSS I:L) with no confidentiality or availability effect, and no public exploit has been identified at time of analysis.
Silent suppression of Windows event-log records in Apache log4net's EventLogAppender lets a party that can influence logged content erase a whole event record without any error being raised. Applications on Windows that use EventLogAppender in log4net 1.2.9 through versions before 3.5.0 are affected: messages are truncated to a hard-coded 31,837-character ceiling that exceeds the real Event Log record budget once the log name, source name, and machine name are counted, so the service silently stores and reports nothing for the oversized record. No public exploit identified at time of analysis, and the independent assessment rates this a genuine but low-priority, niche-configuration issue (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), since an attacker must be able to push a single logged message into the tens-of-kilobytes range.
Log-record suppression in the %aspnet-request pattern converter of Apache log4net lets an unauthenticated remote sender erase the log entry for their own request by placing markup such as <script> in a parameter, because reading HttpRequest.Params triggers ASP.NET request validation, throws HttpRequestValidationException inside the layout, and causes the appender to discard the entire event. Only applications running on ASP.NET for .NET Framework (the converter depends on System.Web, which netstandard/.NET Core lacks) with log4net 1.2.11 through 3.4.x and a layout that explicitly uses %aspnet-request are affected; versions from 3.5.0 onward are fixed. Impact is confined to the attacker suppressing logging of their own request - it cannot read data, delete other users' records, or crash the service - and there is no public exploit identified at time of analysis, no CISA KEV listing, and the assessed vector is AV:N/AC:L/PR:N/UI:N with only a low integrity impact (CVSS 5.3), making this a real but low-priority issue whose practical value is helping an attacker evade audit trails for a separate attack.
Improper handling of Unicode encoding in Apache log4net's SmtpPickupDirAppender lets an attacker who can place unencodable content - such as an unpaired UTF-16 surrogate like U+D800 - into a logged message break the appender's file writer, causing the entire buffered batch of logging events to be discarded rather than just the offending event, and leaving a truncated mail file in the pickup directory for the mail service to send. Only applications configured to use SmtpPickupDirAppender (the SMTP pickup-directory appender) with event buffering are affected; versions from 1.2.9 before 3.5.0 are impacted. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - remote and unauthenticated once attacker data reaches a rendered log field - but impact is confined to integrity of log output (suppression/truncation of audit records), with no confidentiality or availability loss; no public exploit code was identified at time of analysis and it is not confirmed actively exploited (not in CISA KEV).
A NUL character (U+0000) embedded in content that reaches a log message causes Apache log4net's OutputDebugStringAppender to truncate the emitted debug record at that point, silently discarding everything the layout rendered afterwards, including exception text and trailing fields. Only Windows applications that explicitly configure the non-default OutputDebugStringAppender are affected, across log4net versions from 1.2.9 up to (but excluding) 3.5.0. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) the flaw is unauthenticated and remotely reachable where attacker-controlled data is logged, but it is limited to log-record integrity with no confidentiality, availability, or code-execution impact; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so overall real-world risk is low-to-moderate.
Log-record truncation in Apache log4net's EventLogAppender silently drops everything a layout renders after a NUL (\0) character, so a party whose data reaches a log message can hide the remainder of that Windows Event Log record - including exception text and trailing fields - with no error raised. The flaw (CWE-158, CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) affects Apache log4net from 1.2.9 before 3.5.0 and only Windows applications configured to use EventLogAppender; non-Windows hosts and any other appender are unaffected. Impact is limited to integrity of a single log entry (no code execution, confidentiality or availability loss), and no public exploit code was identified at time of analysis - this is a medium/low-priority log-suppression issue rather than an urgent compromise vector. The upstream fix escapes NUL characters before the message-size limit is applied and is shipped in log4net 3.5.0.