{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:23a192b7-c814-555f-a152-9bab2926fb2a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "logback-core", "purl": "pkg:maven/ch.qos.logback/logback-core@1.4.11-tuxcare.2", "type": "library", "group": "ch.qos.logback", "bom-ref": "pkg:maven/ch.qos.logback/logback-core@1.4.11-tuxcare.2", "version": "1.4.11-tuxcare.2", "pedigree": { "ancestors": [ { "name": "logback-core", "purl": "pkg:maven/ch.qos.logback/logback-core@1.4.11", "type": "library", "group": "ch.qos.logback", "version": "1.4.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5929", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:4885e688-eb58-527e-ac2d-9e72a71faa8d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5929 does not affect version 1.4.11-tuxcare.2 of ch.qos.logback:logback-core. The target repository (Logback 1.4.11) is not vulnerable to CVE-2017-5929. The unsafe Java deserialization vulnerability was fixed in upstream Logback 1.2.0 (February 2017) by introducing HardenedObjectInputStream with whitelist-based class validation. This fix was already present in upstream version 1.4.11 when TuxCare onboarded it. Both SocketNode classes (logback-classic and logback-access) use the hardened stream implementations that validate incoming serialized objects against explicit whitelists, preventing arbitrary code execution via malicious deserialization. The fix commit f46044b805bca91efe5fd6afe52257cd02f775f8 was authored by upstream maintainer ceki@qos.ch, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11).", "justification": "code_not_present" } }, { "id": "CVE-2021-42550", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:af106c62-6a45-58b0-8f5a-ccc3fa2e62ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42550 does not affect version 1.4.11-tuxcare.2 of ch.qos.logback:logback-core. not_affected \u2014 The target repository (logback 1.4.11-tuxcare.2) is not affected by CVE-2021-42550. The vulnerability allowing arbitrary code execution via unrestricted JNDI lookups to attacker-controlled LDAP/RMI servers was fixed by upstream commit ef4fc4186b74b45ce80d86833820106ff27edd42 authored by Ceki G\u00fclc\u00fc (ceki@qos.ch) on December 16, 2021. This fix was included in the upstream 1.4.11 release that TuxC...", "justification": "code_not_present" } }, { "id": "CVE-2023-6378", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:277d788e-3b5f-540a-8b1d-f1540bfd63e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-6378 affects version 1.4.11-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2023-6481", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:9b407ba4-56c6-58ca-b02b-4d177f2d5da1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-6481 affects version 1.4.11-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2024-12798", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:d0f9afa7-2168-55d6-95c6-f1e93d416a4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-12798 is fixed in version 1.4.11-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2024-12801", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:caf10f8a-f65e-5964-9d12-5a8a7b8cf469", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-12801 is fixed in version 1.4.11-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2025-11226", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:db58fd31-aee0-5735-afb4-815e6aa77caf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11226 is fixed in version 1.4.11-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-10532", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:56a37d82-fbb9-57bb-92ea-94275494d2d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10532 is fixed in version 1.4.11-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-1225", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:a287dd93-d30b-5178-b5e6-76a80af3b3cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-1225 is fixed in version 1.4.11-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-9828", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:355d5e9b-c335-5dbb-b83f-a53fd8102be7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-9828 affects version 1.4.11-tuxcare.2 of ch.qos.logback:logback-core." } } ], "dependencies": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.11-tuxcare.2" } ] }