PT-2025-34482 · Apache+2 · Apache Log4Cxx+2

Published 2025-01-01 · Updated 2025-11-05 · CVE-2025-54813

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Apache Log4cxx versions prior to 1.5.0

Description: The software contains an improper output neutralization issue for logs. When using JSONLayout, not all payload bytes are properly escaped. Attackers can supply messages containing non-printable characters that will be passed along and written as part of the JSON message, potentially preventing applications consuming these logs from correctly interpreting the information.

Recommendations: Upgrade to version 1.5.0.

Fix

Weakness Enumeration

CWE-117

Related Identifiers

BDU:2025-13812

CVE-2025-54813

DLA-4322-1

Affected Products

Apache Log4Cxx

Debian

Red Os

References · 19

• https://github.com/apache/logging-log4cxx/pull/512 · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-54813 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13812 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-54813 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-54813 · Vendor Advisory
• https://logging.apache.org/security.html#CVE-2025-54813 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-54813 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54813 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4322-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-54813 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54813 · Security Note
• https://twitter.com/CVEnew/status/1958974281561555129 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-log4cxx-cve-2025-54812-cve-2025-54813-cve-2023-31038 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-log4cxx-cve-2025-54812-cve-2025-54813-cve-2023-31038/?sphrase_id=1339040 · Note
• https://lists.debian.org/debian-lts-announce/2025/10/msg00002.html · Note