CVE-2018-1285 Log4Net

[bbuck2]

Is Business Objects 4.2 or 4.3 affected by CVE-2018-1285 (Log4Net) vulnerability?

[DellSC · Accepted solution]

No, they're not. Unless you've written code using the .NET SDK, all of the "standard" code for the web applications in 4.x is written in Java, which doesn't use .NET or Log4Net. The .NET SDK install includes a version of Log4Net that is vulnerable, but I don't think any of the SDK actually uses it as that version is specifically for .NET 1, which doesn't work with the current SDK.

-Dell

[EricFenollosa]

Thank you Dell, you're absolutely right.

More details here.

[VenkateswaraGupthaY]

Here is the Note https://launchpad.support.sap.com/#/notes/2914574, which is to be referred for this kind of questions.