mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 08:30:47 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/log4cxx: security bump to v1.7.0

Browse Source 
For change log, see:
https://logging.apache.org/log4cxx/1.7.0/changelog.html

This fixes the following vulnerability:
- CVE-2026-40023:
    Apache Log4cxx's XMLLayout
    https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html,
    in versions before 1.7.0, fails to sanitize characters forbidden
    by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets
    in log messages, NDC, and MDC property keys and values, producing
    invalid XML output. Conforming XML parsers must reject such
    documents with a fatal error, which may cause downstream log
    processing systems to drop or fail to index affected records.
    An attacker who can influence logged data can exploit this
    to suppress individual log records, impairing audit trails and
    detection of malicious activity.  Users are advised to upgrade to
    Apache Log4cxx 1.7.0, which fixes this issue.
    https://www.cve.org/CVERecord?id=CVE-2026-40023

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add link to change log in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1d5c6d18da)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Titouan Christophe
2026-04-22 15:54:56 +02:00
committed by Thomas Perale
parent 2887dd91cc
commit a2c0cd7ec4
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
package/log4cxx/log4cxx.hash
View File

@@ -1,4 +1,4 @@
# From https://downloads.apache.org/logging/log4cxx/1.6.1/apache-log4cxx-1.6.1.tar.gz.sha512
sha512 6ee406314bd7ab02a46c98cc8a0d5ad5aec8928a23716a81a152775ca315cd3b950d600b2e221d5b4a88416ae9bbda1215fae43626107feea4df2f3e074303ad apache-log4cxx-1.6.1.tar.gz
# From https://downloads.apache.org/logging/log4cxx/1.7.0/apache-log4cxx-1.7.0.tar.gz.sha512
sha512 0e94946457423689af6d85074ab97b717e0cec85a4f548e6650b060e8f98b780f980b7d4a7780410fa64681376fb4bc62fab6ed9068fc944e07f9f32ac0413af apache-log4cxx-1.7.0.tar.gz
# Locally computed
sha256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30 LICENSE

2
package/log4cxx/log4cxx.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
LOG4CXX_VERSION = 1.6.1
LOG4CXX_VERSION = 1.7.0
LOG4CXX_SITE = https://archive.apache.org/dist/logging/log4cxx/$(LOG4CXX_VERSION)
LOG4CXX_SOURCE = apache-log4cxx-$(LOG4CXX_VERSION).tar.gz
LOG4CXX_INSTALL_STAGING = YES