{ "@id": "urn:uuid:cbfa2216-82bc-410f-96ea-55261be1d1f9", "role": "Document Creator", "author": "https://tuxcare.com", "version": 10, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:04:11.456857+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2017-5929 does not affect version 1.5.18-tuxcare.2 of ch.qos.logback:logback-core. CVE-2017-5929 is NOT present in logback 1.5.18-tuxcare.2. The vulnerability (unsafe Java deserialization in SocketNode and RemoteAppenderStreamClient) was fixed by upstream vendor (Ceki Gulcu, ceki@qos.ch) in commits leading to logback 1.2.0. The target version 1.5.18 already contains the complete fix: all socket deserialization entry points use HardenedLoggingEventInputStream/HardenedObjectInputStream with whitelist-based class validation. The fix was part of the upstream 1.5.18 release that TuxCare onboarded (commit 2df59eed, 992 commits after the fix). No TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5929" }, "impact_statement": "CVE-2017-5929 is NOT present in logback 1.5.18-tuxcare.2. The vulnerability (unsafe Java deserialization in SocketNode and RemoteAppenderStreamClient) was fixed by upstream vendor (Ceki Gulcu, ceki@qos.ch) in commits leading to logback 1.2.0. The target version 1.5.18 already contains the complete fix: all socket deserialization entry points use HardenedLoggingEventInputStream/HardenedObjectInputStream with whitelist-based class validation. The fix was part of the upstream 1.5.18 release that TuxCare onboarded (commit 2df59eed, 992 commits after the fix). No TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2" } } ], "timestamp": "2026-11-02T18:02:00.135074+00:00", "status_notes": "Vulnerability CVE-2021-42550 does not affect version 1.5.18-tuxcare.2 of ch.qos.logback:logback-core. not_affected \u2014 CVE-2021-42550 is NOT PRESENT in logback 1.5.18-tuxcare.2. The vulnerable JNDI lookup pattern was fixed by upstream vendor Ceki Gulcu in commit c43bd30e1 (2021-12-16), which was included in upstream logback 1.5.18 before TuxCare onboarded it. All JNDI lookups now go through JNDIUtil.jndiNameSecurityCheck() which enforces that names must start with \"java:\" namespace, blocking malicious LDAP/RMI/...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-42550" }, "impact_statement": "not_affected \u2014 CVE-2021-42550 is NOT PRESENT in logback 1.5.18-tuxcare.2. The vulnerable JNDI lookup pattern was fixed by upstream vendor Ceki Gulcu in commit c43bd30e1 (2021-12-16), which was included in upstream logback 1.5.18 before TuxCare onboarded it. All JNDI lookups now go through JNDIUtil.jndiNameSecurityCheck() which enforces that names must start with \"java:\" namespace, blocking malicious LDAP/RMI/..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2" } } ], "timestamp": "2026-11-03T11:58:46.516698+00:00", "status_notes": "Vulnerability CVE-2023-6378 does not affect version 1.5.18-tuxcare.2 of ch.qos.logback:logback-core. CVE-2023-6378 is not present in logback 1.5.18-tuxcare.2. The vulnerability affects the logback receiver component's deserialization of malicious data causing DoS via resource exhaustion. The upstream vendor (Ceki Gulcu) fixed this in commit 9c782b45b by adding two defense layers: (1) ObjectInputFilter with maxdepth=16 and maxarray=10000 in HardenedObjectInputStream, and (2) array length validation (limit 128) in LoggingEventVO.readObject(). This fix shipped in upstream release v_1.5.18, which TuxCare onboarded via commit 2df59eed9. Both defense layers are present and active in HEAD at the receiver's entry point (RemoteAppenderStreamClient uses HardenedLoggingEventInputStream).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; < 1.2.13), NVD (>= 1.2.0, < 1.2.13; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12), Snyk (< 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-6378" }, "impact_statement": "CVE-2023-6378 is not present in logback 1.5.18-tuxcare.2. The vulnerability affects the logback receiver component's deserialization of malicious data causing DoS via resource exhaustion. The upstream vendor (Ceki Gulcu) fixed this in commit 9c782b45b by adding two defense layers: (1) ObjectInputFilter with maxdepth=16 and maxarray=10000 in HardenedObjectInputStream, and (2) array length validation (limit 128) in LoggingEventVO.readObject(). This fix shipped in upstream release v_1.5.18, which TuxCare onboarded via commit 2df59eed9. Both defense layers are present and active in HEAD at the receiver's entry point (RemoteAppenderStreamClient uses HardenedLoggingEventInputStream).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; < 1.2.13), NVD (>= 1.2.0, < 1.2.13; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12), Snyk (< 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2023-6481 does not affect version 1.5.18-tuxcare.2 of ch.qos.logback:logback-core. CVE-2023-6481 affects logback's HardenedObjectInputStream class, which was missing initialization of deserialization filters in one or both constructors, allowing deeply nested serialized structures to cause DoS. The target (logback 1.5.18-tuxcare.2) contains the complete fix: both constructors properly call initObjectFilter() which sets ObjectInputFilter limits (maxdepth=16, maxarray=10000). The fix was authored by upstream maintainer Ceki Gulcu (ceki@qos.ch) in commit 7018a3609 on 2023-12-01 and shipped in upstream release 1.5.18, which TuxCare onboarded on 2026-07-08. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.4.13, < 1.4.14; >= 1.3.13, < 1.3.14; >= 1.2.12, < 1.2.13), NVD (= 1.2.12; = 1.3.13; = 1.4.13), Snyk (< 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14; < 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-6481" }, "impact_statement": "CVE-2023-6481 affects logback's HardenedObjectInputStream class, which was missing initialization of deserialization filters in one or both constructors, allowing deeply nested serialized structures to cause DoS. The target (logback 1.5.18-tuxcare.2) contains the complete fix: both constructors properly call initObjectFilter() which sets ObjectInputFilter limits (maxdepth=16, maxarray=10000). The fix was authored by upstream maintainer Ceki Gulcu (ceki@qos.ch) in commit 7018a3609 on 2023-12-01 and shipped in upstream release 1.5.18, which TuxCare onboarded on 2026-07-08. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.4.13, < 1.4.14; >= 1.3.13, < 1.3.14; >= 1.2.12, < 1.2.13), NVD (= 1.2.12; = 1.3.13; = 1.4.13), Snyk (< 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14; < 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2" } } ], "timestamp": "2026-10-31T14:23:30.606086+00:00", "status_notes": "Vulnerability CVE-2024-12798 does not affect version 1.5.18-tuxcare.2 of ch.qos.logback:logback-core. not_affected \u2014 CVE-2024-12798 affects JaninoEventEvaluator in logback-core, which allowed arbitrary code execution via malicious configuration files. The target version 1.5.18-tuxcare.2 is NOT AFFECTED because the vulnerable code was already removed in the upstream 1.5.18 release before TuxCare onboarding. All three vulnerable source files (JaninoEventEvaluator.java, JaninoEventEvaluatorBase.java, ClassicEval...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12798" }, "impact_statement": "not_affected \u2014 CVE-2024-12798 affects JaninoEventEvaluator in logback-core, which allowed arbitrary code execution via malicious configuration files. The target version 1.5.18-tuxcare.2 is NOT AFFECTED because the vulnerable code was already removed in the upstream 1.5.18 release before TuxCare onboarding. All three vulnerable source files (JaninoEventEvaluator.java, JaninoEventEvaluatorBase.java, ClassicEval..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2" } } ], "timestamp": "2026-10-31T14:05:04.998415+00:00", "status_notes": "Vulnerability CVE-2024-12801 does not affect version 1.5.18-tuxcare.2 of ch.qos.logback:logback-core. not_affected \u2014 Target version 1.5.18 is not affected by CVE-2024-12801 (SSRF via DOCTYPE external entity). The fix (resolveEntity() method that blocks external DTD resolution) was already present in upstream release 1.5.13, authored by upstream maintainer Ceki Gulcu (ceki@qos.ch) on 2024-12-17. When TuxCare onboarded version 1.5.18 on 2025-03-18, the fix was already included in the upstream codebase. The vuln...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12801" }, "impact_statement": "not_affected \u2014 Target version 1.5.18 is not affected by CVE-2024-12801 (SSRF via DOCTYPE external entity). The fix (resolveEntity() method that blocks external DTD resolution) was already present in upstream release 1.5.13, authored by upstream maintainer Ceki Gulcu (ceki@qos.ch) on 2024-12-17. When TuxCare onboarded version 1.5.18 on 2025-03-18, the fix was already included in the upstream codebase. The vuln..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11226 is fixed in version 1.5.18-tuxcare.2 of ch.qos.logback:logback-core.", "vulnerability": { "name": "CVE-2025-11226" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10532 is fixed in version 1.5.18-tuxcare.2 of ch.qos.logback:logback-core.", "vulnerability": { "name": "CVE-2026-10532" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1225 is fixed in version 1.5.18-tuxcare.2 of ch.qos.logback:logback-core.", "vulnerability": { "name": "CVE-2026-1225" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.5.18-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9828 affects version 1.5.18-tuxcare.2 of ch.qos.logback:logback-core.", "vulnerability": { "name": "CVE-2026-9828" }, "action_statement": "Vulnerability CVE-2026-9828 affects version 1.5.18-tuxcare.2 of ch.qos.logback:logback-core." } ] }