{
  "@id": "urn:uuid:565efda6-b6b7-44d1-8f49-2451c98f7372",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T08:03:00.133854+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T04:41:00.175184+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver. not_affected \u2014 The target repository (version 2.12.4-tuxcare.3, SHA 8621950d2b) is NOT vulnerable to CVE-2020-9488. The fix for hostname verification in SMTPS connections was already present in the upstream Apache Log4j 2.12.4 release that TuxCare onboarded. The defense code (verifyHostName parameter and mail.smtps.ssl.checkserveridentity property) exists in both SslConfiguration.java and SmtpManager.java, pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 The target repository (version 2.12.4-tuxcare.3, SHA 8621950d2b) is NOT vulnerable to CVE-2020-9488. The fix for hostname verification in SMTPS connections was already present in the upstream Apache Log4j 2.12.4 release that TuxCare onboarded. The defense code (verifyHostName parameter and mail.smtps.ssl.checkserveridentity property) exists in both SslConfiguration.java and SmtpManager.java, pr..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:49:12.061475+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver. not_affected \u2014 Target version 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2021-44832. The security fix was already present in Apache's upstream 2.12.4 release (December 2021), which TuxCare onboarded in August 2026. Both defense layers are in place: (1) JNDI JDBC feature disabled by default (requires log4j2.enableJndiJdbc=true), and (2) JNDI URI validation restricting lookups to java: protocol only, blocking mali...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 Target version 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2021-44832. The security fix was already present in Apache's upstream 2.12.4 release (December 2021), which TuxCare onboarded in August 2026. Both defense layers are in place: (1) JNDI JDBC feature disabled by default (requires log4j2.enableJndiJdbc=true), and (2) JNDI URI validation restricting lookups to java: protocol only, blocking mali..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:30:58.876712+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver. not_affected \u2014 CVE-2021-45105 is NOT present in this target. The vulnerability was fixed in the upstream Apache Log4j 2.12.4 release before TuxCare onboarded it. The fix commit bf7e916df6 (authored by Carter Kozak <ckozak@apache.org> on 2021-12-19) introduced RuntimeStrSubstitutor and ConfigurationStrSubstitutor classes to control recursive evaluation of lookups. RuntimeStrSubstitutor disables recursive evalu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-45105 is NOT present in this target. The vulnerability was fixed in the upstream Apache Log4j 2.12.4 release before TuxCare onboarded it. The fix commit bf7e916df6 (authored by Carter Kozak <ckozak@apache.org> on 2021-12-19) introduced RuntimeStrSubstitutor and ConfigurationStrSubstitutor classes to control recursive evaluation of lookups. RuntimeStrSubstitutor disables recursive evalu..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T12:02:31.437247+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T12:02:38.903929+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T08:03:00.133854+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver. not_affected \u2014 Version 2.12.4 is not affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from the @PluginFactory pattern to the @PluginBuilderFactory pattern, during which configuration attribute names were unintentionally changed. Version 2.12.4 predates this migration and uses the documented attribute names (newLine, newLineEscape, useTlsMessageForm...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Version 2.12.4 is not affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from the @PluginFactory pattern to the @PluginBuilderFactory pattern, during which configuration attribute names were unintentionally changed. Version 2.12.4 predates this migration and uses the documented attribute names (newLine, newLineEscape, useTlsMessageForm..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T12:03:00.106827+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T12:02:38.903929+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-appserver@2.12.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T11:51:00.169047+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 does not affect version 2.12.4-tuxcare.2 of org.apache.logging.log4j:log4j-appserver. not_affected \u2014 Version 2.12.4 is NOT AFFECTED by CVE-2026-49844. The target uses a fundamentally different JSON serialization architecture than the affected versions (2.13.1+). In 2.12.4, MapMessage.asJson() wraps ALL values (including numbers) in double quotes, producing valid JSON strings like {\"key\":\"NaN\"} for non-finite doubles. The vulnerable pattern \u2014 MapMessageJsonFormatter with type-aware formatting t...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "impact_statement": "not_affected \u2014 Version 2.12.4 is NOT AFFECTED by CVE-2026-49844. The target uses a fundamentally different JSON serialization architecture than the affected versions (2.13.1+). In 2.12.4, MapMessage.asJson() wraps ALL values (including numbers) in double quotes, producing valid JSON strings like {\"key\":\"NaN\"} for non-finite doubles. The vulnerable pattern \u2014 MapMessageJsonFormatter with type-aware formatting t..."
    }
  ]
}