NMU 1.4.0-1.1: Security fixes for CVE-2025-54812 & CVE-2025-54813

Lukas Märdianrequested to merge
slyon/log4cxx:cve-2025-54812-cve-2025-54813 into debian/unstable

Security fixes cherry-picked from upstream

  • d/p/{04,05}-cve-2025-54812*:
    • Escape any logger name '&' or '"' in html attribute data (PR#509)
    • Escape any thread name '&' or '"' in html attribute data (PR#514)
  • d/p/06-cve-2025-54813*: Escape control characters in JSONLayout data (PR#512)

This is part of the 1.5.0 upstream release, and can be dropped once we have that in unstable.

Edited by Lukas Märdian

Merge request reports