{"id":"UBUNTU-CVE-2025-54813","details":"Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them. This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.","modified":"2026-05-20T16:23:36.622487767Z","published":"2025-08-22T19:15:00Z","upstream":["CVE-2025-54813"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2025-54813"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2025-54813"},{"type":"REPORT","url":"https://logging.apache.org/security.html#CVE-2025-54813"},{"type":"REPORT","url":"https://github.com/apache/logging-log4cxx/pull/512"}],"affected":[{"package":{"name":"log4cxx","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/log4cxx?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-1.2ubuntu3"],"ecosystem_specific":{"binaries":[{"binary_name":"liblog4cxx10","binary_version":"0.10.0-1.2ubuntu3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-54813.json"}},{"package":{"name":"log4cxx","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/log4cxx?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-9ubuntu1","0.10.0-9ubuntu2","0.10.0-10ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"liblog4cxx10v5","binary_version":"0.10.0-10ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-54813.json"}},{"package":{"name":"log4cxx","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/log4cxx?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-12ubuntu1","0.10.0-13ubuntu1","0.10.0-13ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_version":"0.10.0-13ubuntu2","binary_name":"liblog4cxx10v5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-54813.json"}},{"package":{"name":"log4cxx","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/log4cxx?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-15ubuntu1","0.10.0-15ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_name":"liblog4cxx10v5","binary_version":"0.10.0-15ubuntu2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-54813.json"}},{"package":{"name":"log4cxx","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/log4cxx?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.0-2ubuntu1","0.11.0-3ubuntu2","0.12.1-4"],"ecosystem_specific":{"binaries":[{"binary_version":"0.12.1-4","binary_name":"liblog4cxx12"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-54813.json"}},{"package":{"name":"log4cxx","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/log4cxx?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-1","1.1.0-1build1","1.1.0-1build2","1.1.0-1build3"],"ecosystem_specific":{"binaries":[{"binary_name":"liblog4cxx15","binary_version":"1.1.0-1build3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-54813.json"}},{"package":{"name":"log4cxx","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/log4cxx?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.1-1","1.4.0-1"],"ecosystem_specific":{"binaries":[{"binary_name":"liblog4cxx15","binary_version":"1.4.0-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-54813.json"}},{"package":{"name":"log4cxx","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/log4cxx?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-1","1.5.0-1"],"ecosystem_specific":{"binaries":[{"binary_name":"liblog4cxx15","binary_version":"1.5.0-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-54813.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"Ubuntu","score":"medium"}]}