{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ab7cf5b9-3d0d-5837-83cc-5703056b193d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "logback-core", "purl": "pkg:maven/ch.qos.logback/logback-core@1.5.22-tuxcare.1", "type": "library", "group": "ch.qos.logback", "bom-ref": "pkg:maven/ch.qos.logback/logback-core@1.5.22-tuxcare.1", "version": "1.5.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "logback-core", "purl": "pkg:maven/ch.qos.logback/logback-core@1.5.22", "type": "library", "group": "ch.qos.logback", "version": "1.5.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5929", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.5.22-tuxcare.1" } ], "bom-ref": "urn:uuid:90bfdccb-a5ce-5cce-a663-e077a981b1f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5929 does not affect version 1.5.22-tuxcare.1 of ch.qos.logback:logback-core. CVE-2017-5929 affects Logback versions before 1.2.0 due to unsafe deserialization in SocketNode and RemoteAppenderStreamClient classes that used raw ObjectInputStream without validation, allowing arbitrary code execution via malicious serialized objects. The upstream fix (commit 7fbea6127) replaced ObjectInputStream with HardenedObjectInputStream, which implements whitelist-based class validation in resolveClass(). This fix shipped in Logback 1.2.0 and is present in version 1.5.22. All vulnerable components now use HardenedLoggingEventInputStream with a whitelist limited to legitimate Logback event classes. No raw ObjectInputStream usage found in socket-receiving code. Verdict: not_affected because the vulnerable pattern is not present - the upstream fix was already in the release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11).", "justification": "code_not_present" } }, { "id": "CVE-2021-42550", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.5.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c30eee0c-8b93-5a5b-9b66-b307b901f7d8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42550 does not affect version 1.5.22-tuxcare.1 of ch.qos.logback:logback-core. not_affected \u2014 CVE-2021-42550 (JNDI injection allowing arbitrary code execution) is NOT present in logback 1.5.22-tuxcare.1. The vulnerability was fixed in upstream logback in December 2021 (commit 8fb44ca67 by Ceki Gulcu). The fix restricts all JNDI lookups to the \"java:\" namespace, preventing connections to attacker-controlled LDAP/RMI/DNS servers. This fix was already present in upstream logback 1.5.22 whe...", "justification": "code_not_present" } }, { "id": "CVE-2023-6378", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.5.22-tuxcare.1" } ], "bom-ref": "urn:uuid:aa0d084b-f34c-5522-91fd-58546bcf2e9b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-6378 does not affect version 1.5.22-tuxcare.1 of ch.qos.logback:logback-core. CVE-2023-6378 is not present in logback 1.5.22-tuxcare.1. The vulnerability concerns a denial-of-service attack via malicious serialized data in the logback receiver component. The upstream vendor (QOS.ch) fixed this vulnerability in November 2023 by adding (1) array length validation in LoggingEventVO.readObject() to reject negative or excessively large array allocations, and (2) global deserialization limits (max depth 16, max array size 10000) via ObjectInputFilter in HardenedObjectInputStream. These defenses are present in the target at LoggingEventVO.java:46,210-213 and HardenedObjectInputStream.java:43-44,57-61. The fix commit (9c782b45b) was authored by upstream maintainer Ceki Gulcu and was already included in upstream logback 1.5.22 before TuxCare onboarded this version. Therefore, the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; < 1.2.13), NVD (>= 1.2.0, < 1.2.13; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12), Snyk (< 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12).", "justification": "code_not_present" } }, { "id": "CVE-2023-6481", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.5.22-tuxcare.1" } ], "bom-ref": "urn:uuid:eca31041-7fe9-5e2d-8c84-224e053a72da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-6481 does not affect version 1.5.22-tuxcare.1 of ch.qos.logback:logback-core. CVE-2023-6481 is NOT present in logback 1.5.22-tuxcare.1. The vulnerability involved missing deserialization filter initialization in HardenedObjectInputStream constructors, which allowed DoS attacks via deeply nested or large array structures in serialized data. The upstream fix (commit 7018a3609 by ceki@qos.ch) was already included in the upstream release 1.5.22 that TuxCare onboarded. Both constructors at lines 48 and 64 properly call initObjectFilter(), which sets up ObjectInputFilter with maxarray=10000 and maxdepth=16 limits to prevent resource exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.4.13, < 1.4.14; >= 1.3.13, < 1.3.14; >= 1.2.12, < 1.2.13), NVD (= 1.2.12; = 1.3.13; = 1.4.13), Snyk (< 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14; < 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14).", "justification": "code_not_present" } }, { "id": "CVE-2024-12798", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.5.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b0673b39-61c3-563b-bf70-eafa82ef4da9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-12798 does not affect version 1.5.22-tuxcare.1 of ch.qos.logback:logback-core. not_affected \u2014 CVE-2024-12798 targets JaninoEventEvaluator, which allowed arbitrary code execution via malicious logback configuration files. The vulnerable classes (JaninoEventEvaluator.java and JaninoEventEvaluatorBase.java) were completely removed by the upstream vendor (ceki@qos.ch) in commit 2cb6d520 on December 18, 2024. This fix was already present in upstream version 1.5.22 (released December 11, 2025...", "justification": "code_not_present" } }, { "id": "CVE-2024-12801", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.5.22-tuxcare.1" } ], "bom-ref": "urn:uuid:766d8e29-4c5c-5728-80f3-189a481bcd3f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-12801 does not affect version 1.5.22-tuxcare.1 of ch.qos.logback:logback-core. not_affected \u2014 Target version 1.5.22 is NOT affected by CVE-2024-12801 (SSRF via DOCTYPE external DTD). The upstream fix (commit 5f05041cba4c4ac0a62748c5c527a2da48999f2d by ceki@qos.ch) was already included in the upstream release version 1.5.22 that TuxCare onboarded. The fix adds a resolveEntity() override in SaxEventRecorder that blocks external DTD resolution by returning a blank InputSource, preventing t...", "justification": "code_not_present" } }, { "id": "CVE-2025-11226", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.5.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2e38f0b5-3231-5ac3-b0f5-52ef155ff29e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-11226 does not affect version 1.5.22-tuxcare.1 of ch.qos.logback:logback-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 1.5.19, and version 1.5.22 is a later release of the same line. Advisories: GitHub GHSA-25qh-j22f-pwp8 (fixed in 1.5.19), CVE record (last affected 1.5.18), Snyk (fixed in 1.5.19).", "justification": "code_not_present" } }, { "id": "CVE-2026-10532", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.5.22-tuxcare.1" } ], "bom-ref": "urn:uuid:60f7d5e2-145a-5118-8119-465bd88146c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10532 is fixed in version 1.5.22-tuxcare.1 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-1225", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.5.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f7381252-6a79-589b-9cd5-cd75de227540", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1225 affects version 1.5.22-tuxcare.1 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-9828", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.5.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f31837e3-7b98-5c17-9561-01d32ef0d309", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-9828 affects version 1.5.22-tuxcare.1 of ch.qos.logback:logback-core." } } ], "dependencies": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.5.22-tuxcare.1" } ] }