{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2ca42ef1-89d5-5eb4-b2d0-60e669ed50f4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "logback-core", "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.11-tuxcare.3", "type": "library", "group": "ch.qos.logback", "bom-ref": "pkg:maven/ch.qos.logback/logback-core@1.2.11-tuxcare.3", "version": "1.2.11-tuxcare.3", "pedigree": { "ancestors": [ { "name": "logback-core", "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.11", "type": "library", "group": "ch.qos.logback", "version": "1.2.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5929", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:81b372be-fec0-5e07-bde7-962a5f47fc86", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5929 does not affect version 1.2.11-tuxcare.3 of ch.qos.logback:logback-core. Target repository Logback 1.2.11-tuxcare.2 is NOT AFFECTED by CVE-2017-5929. The vulnerability (unsafe deserialization allowing arbitrary code execution) was fixed in upstream Logback 1.2.0 (released Feb 2017). The fix commit f46044b8 by ceki@qos.ch introduced HardenedObjectInputStream with whitelist-based class validation, and this fix was already present in the upstream 1.2.11 release that TuxCare onboarded (commit 5a1815826). All vulnerable components (SocketNode in logback-classic/access, RemoteAppenderStreamClient, ServerSocketReceiver) use the hardened deserialization streams in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11).", "justification": "code_not_present" } }, { "id": "CVE-2021-42550", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:0a425a80-c5e1-5ec7-a582-3810b9504507", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42550 does not affect version 1.2.11-tuxcare.3 of ch.qos.logback:logback-core. not_affected \u2014 CVE-2021-42550 is not present in logback 1.2.11-tuxcare.2. The vulnerability (unrestricted JNDI lookups allowing remote code execution via ldap://, rmi://, etc.) was fixed by upstream commit e612536f8 which added namespace validation to restrict JNDI lookups to only the \"java:\" namespace. This fix was already included in the upstream logback 1.2.11 release that TuxCare onboarded, authored by Mi...", "justification": "code_not_present" } }, { "id": "CVE-2023-6378", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:54488beb-8531-51a4-9be7-09ba2efffa00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-6378 affects version 1.2.11-tuxcare.3 of ch.qos.logback:logback-core." } }, { "id": "CVE-2023-6481", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:124d5b46-77d5-5a49-a066-51e9ea4acec5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-6481 affects version 1.2.11-tuxcare.3 of ch.qos.logback:logback-core." } }, { "id": "CVE-2024-12798", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:014c3dcc-6563-5327-b7e1-30ca65231e5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-12798 is fixed in version 1.2.11-tuxcare.3 of ch.qos.logback:logback-core." } }, { "id": "CVE-2024-12801", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:862de65c-4734-563d-8be7-487e14899983", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-12801 is fixed in version 1.2.11-tuxcare.3 of ch.qos.logback:logback-core." } }, { "id": "CVE-2025-11226", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:7a2de42d-b602-55d6-8816-c2b17fea3e23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11226 is fixed in version 1.2.11-tuxcare.3 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-10532", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:910a176e-7e09-56d3-8303-a8cb8deacac5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10532 is fixed in version 1.2.11-tuxcare.3 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-1225", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:167c75f6-f7bc-50c6-b932-8269754a7c3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-1225 is fixed in version 1.2.11-tuxcare.3 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-9828", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:16a71f3f-b900-5c1e-b0c7-343f7e9892c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-9828 affects version 1.2.11-tuxcare.3 of ch.qos.logback:logback-core." } } ], "dependencies": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.11-tuxcare.3" } ] }