Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them. This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1b48c1a920 advisory.

    Update to 1.5.0, fix CVE-2025-54813, CVE-2025-22838

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4322 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4322-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Lukas Mrdian     October 05, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : log4cxx     Version        : 0.11.0-2+deb11u1     CVE ID         : CVE-2025-54812 CVE-2025-54813     Debian Bug     : 1111879 1111881

    Multiple vulnerabilities were discovered in log4cxx, a logging library     for C++ that is compatible with the JAVA log4j framework.

    CVE-2025-54812

        When using HTMLLayout, logger names are not properly escaped when         writing out to the HTML file. If untrusted data is used to retrieve         the name of a logger, an attacker could theoretically inject HTML or         Javascript in order to hide information from logs or steal data from         the user.

    CVE-2025-54813

        When using JSONLayout, not all payload bytes are properly escaped.
        If an attacker-supplied message contains certain non-printable         characters, these will be passed along in the message and written out         as part of the JSON message. This may prevent applications that         consume these logs from correctly interpreting the information within         them.

    For Debian 11 bullseye, these problems have been fixed in version     0.11.0-2+deb11u1.

    We recommend that you upgrade your log4cxx packages.

    For the detailed security status of log4cxx please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/log4cxx

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all     payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable     characters, these will be passed along in the message and written out as part of the JSON message. This     may prevent applications that consume these logs from correctly interpreting the information within them.
    This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which     fixes the issue. (CVE-2025-54813)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
270101	Fedora 41 : log4cxx (2025-1b48c1a920)	Nessus	Fedora Local Security Checks	medium
266592	Debian dla-4322 : liblog4cxx-dev - security update	Nessus	Debian Local Security Checks	medium
260302	Linux Distros Unpatched Vulnerability : CVE-2025-54813	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-54813

medium

Tenable Plugins

medium

medium

medium