{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0ca7fbae-79aa-562b-86c5-18433c2f1b62", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "logback-core", "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.13-tuxcare.2", "type": "library", "group": "ch.qos.logback", "bom-ref": "pkg:maven/ch.qos.logback/logback-core@1.2.13-tuxcare.2", "version": "1.2.13-tuxcare.2", "pedigree": { "ancestors": [ { "name": "logback-core", "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.13", "type": "library", "group": "ch.qos.logback", "version": "1.2.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5929", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.13-tuxcare.2" } ], "bom-ref": "urn:uuid:0c826f3c-34f8-58eb-b399-cb7b6fbaae83", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5929 does not affect version 1.2.13-tuxcare.2 of ch.qos.logback:logback-core. CVE-2017-5929 deserialization vulnerability is NOT present in logback 1.2.13. The fix (HardenedObjectInputStream with class whitelisting) was introduced in upstream release 1.2.0 by ceki@qos.ch and is present in the target. All vulnerable deserialization entry points (SocketNode in logback-classic and logback-access, RemoteAppenderStreamClient) use hardened streams instead of plain ObjectInputStream. No plain ObjectInputStream usage remains in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11).", "justification": "code_not_present" } }, { "id": "CVE-2021-42550", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.13-tuxcare.2" } ], "bom-ref": "urn:uuid:a141b04a-acf7-5f33-8b55-a72cad1abe09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42550 does not affect version 1.2.13-tuxcare.2 of ch.qos.logback:logback-core. not_affected \u2014 CVE-2021-42550 is NOT present in logback 1.2.13-tuxcare.2. The target contains an upstream fix (commit e612536f8 by Michael Osipov) that restricts JNDI lookups to the \"java:\" namespace only, preventing connections to attacker-controlled LDAP/RMI servers. This fix was already present in the upstream release that TuxCare onboarded, making the vulnerable pattern absent from the shipped version. Al...", "justification": "code_not_present" } }, { "id": "CVE-2023-6378", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.13-tuxcare.2" } ], "bom-ref": "urn:uuid:a89085e1-9996-5233-b5d4-26d2a8170e0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-6378 does not affect version 1.2.13-tuxcare.2 of ch.qos.logback:logback-core. CVE-2023-6378 is not present in target version 1.2.13. The upstream fix commit bb095154be011267b64e37a1d401546e7cc2b7c3 (authored by ceki@qos.ch) was already included in the upstream release before TuxCare onboarding. Both defense mechanisms are present: (1) LoggingEventVO.readObject() validates array lengths before allocation, rejecting negative or oversized values, and (2) HardenedObjectInputStream installs JVM-level deserialization filters limiting array size (10000) and object graph depth (16). The vulnerable pattern (unbounded array allocation during deserialization) has been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; < 1.2.13), NVD (>= 1.2.0, < 1.2.13; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12), Snyk (< 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12).", "justification": "code_not_present" } }, { "id": "CVE-2023-6481", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.13-tuxcare.2" } ], "bom-ref": "urn:uuid:d9f739cc-8423-5a18-873c-458d903b03a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-6481 does not affect version 1.2.13-tuxcare.2 of ch.qos.logback:logback-core. CVE-2023-6481 affects logback 1.2.12 and earlier. The target is version 1.2.13-tuxcare.2, which already contains the upstream fix from commit bb095154b (2023-12-01, \"fix CVE-2023-6378\"). This commit added ObjectInputFilter with depth=16 and array=10000 limits to both HardenedObjectInputStream constructors, preventing DoS attacks via deeply nested or oversized serialized objects. The fix was included in the upstream v_1.2.13 release (2023-12-01 15:19:53) before TuxCare onboarded it (first TuxCare commit 2025-03-31). All receiver component deserialization flows through HardenedLoggingEventInputStream\u2192HardenedObjectInputStream, ensuring the protection is applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.4.13, < 1.4.14; >= 1.3.13, < 1.3.14; >= 1.2.12, < 1.2.13), NVD (= 1.2.12; = 1.3.13; = 1.4.13), Snyk (< 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14; < 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14).", "justification": "code_not_present" } }, { "id": "CVE-2024-12798", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.13-tuxcare.2" } ], "bom-ref": "urn:uuid:ad8ef1eb-78a5-511f-b9d2-981fffd5e7ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-12798 is fixed in version 1.2.13-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2024-12801", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.13-tuxcare.2" } ], "bom-ref": "urn:uuid:f0759692-6dab-5e40-8260-7e9555f97e6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-12801 is fixed in version 1.2.13-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2025-11226", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.13-tuxcare.2" } ], "bom-ref": "urn:uuid:ddd4ef27-0489-572e-9a5f-4af119cf9d25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11226 is fixed in version 1.2.13-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-10532", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.13-tuxcare.2" } ], "bom-ref": "urn:uuid:c5c4a917-0cf1-5b5b-9fb5-e96afdc62c35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10532 is fixed in version 1.2.13-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-1225", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.13-tuxcare.2" } ], "bom-ref": "urn:uuid:b0391322-aa30-5938-87b1-2a99a3572cf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-1225 is fixed in version 1.2.13-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-9828", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.13-tuxcare.2" } ], "bom-ref": "urn:uuid:f1cd4605-aaee-5014-9c0c-77fdec0aa988", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-9828 affects version 1.2.13-tuxcare.2 of ch.qos.logback:logback-core." } } ], "dependencies": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.13-tuxcare.2" } ] }