{ "@id": "urn:uuid:679393e1-a5c6-4343-a179-e1d59935b900", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T13:33:50.206184+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2" } } ], "timestamp": "2026-11-05T13:33:22.185843+00:00", "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. Target version 2.17.0-tuxcare.1 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accept serialized log events do not exist in this version. The upstream vendor applied the fix in commit 5dcc192158 (March 2017, version 2.8.2), then removed the entire socket server module in commit 8865124fb1 (April 2017). Both changes were shipped in the upstream release 2.17.0 that TuxCare onboarded. The attack vector requires \"serialized binary data sent to TCP or UDP socket server\" but these servers are absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5645" }, "impact_statement": "Target version 2.17.0-tuxcare.1 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accept serialized log events do not exist in this version. The upstream vendor applied the fix in commit 5dcc192158 (March 2017, version 2.8.2), then removed the entire socket server module in commit 8865124fb1 (April 2017). Both changes were shipped in the upstream release 2.17.0 that TuxCare onboarded. The attack vector requires \"serialized binary data sent to TCP or UDP socket server\" but these servers are absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2" } } ], "timestamp": "2026-11-05T13:33:22.185843+00:00", "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 The target Apache Log4j 2.17.0-tuxcare.1 is NOT AFFECTED by CVE-2020-9488. The upstream vendor fix for hostname verification in SMTP appender was already present in Apache Log4j 2.17.0 before TuxCare onboarded it. The fix (commit 6851b5083ef9610bae320bf07e1f24d2aa08851b by Matt Sicker) adds SSL configuration support to SmtpAppender with the ability to enable TLS hostname verification via the ve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9488" }, "impact_statement": "not_affected \u2014 The target Apache Log4j 2.17.0-tuxcare.1 is NOT AFFECTED by CVE-2020-9488. The upstream vendor fix for hostname verification in SMTP appender was already present in Apache Log4j 2.17.0 before TuxCare onboarded it. The fix (commit 6851b5083ef9610bae320bf07e1f24d2aa08851b by Matt Sicker) adds SSL configuration support to SmtpAppender with the ability to enable TLS hostname verification via the ve..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2" } } ], "timestamp": "2026-11-05T13:33:22.185843+00:00", "status_notes": "Vulnerability CVE-2021-44228 does not affect version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2021-44228 (Log4Shell) does not affect this target. The repository contains Apache Log4j 2.17.0, which shipped with comprehensive JNDI protections from upstream: (1) JNDI lookups are disabled by default and require explicit enablement via log4j2.enableJndiLookup=true, and (2) even when enabled, only the java: URI scheme is permitted, blocking the LDAP-based attack vector. Version 2.17.0 was released December 17, 2021, after the vulnerability was fixed in 2.16.0. The fix was part of the upstream release onboarded by TuxCare, not a backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44228" }, "impact_statement": "CVE-2021-44228 (Log4Shell) does not affect this target. The repository contains Apache Log4j 2.17.0, which shipped with comprehensive JNDI protections from upstream: (1) JNDI lookups are disabled by default and require explicit enablement via log4j2.enableJndiLookup=true, and (2) even when enabled, only the java: URI scheme is permitted, blocking the LDAP-based attack vector. Version 2.17.0 was released December 17, 2021, after the vulnerability was fixed in 2.16.0. The fix was part of the upstream release onboarded by TuxCare, not a backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2" } } ], "timestamp": "2026-11-05T13:33:22.185843+00:00", "status_notes": "Vulnerability CVE-2021-44832 affects version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2021-44832" }, "action_statement": "Vulnerability CVE-2021-44832 affects version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2" } } ], "timestamp": "2026-11-05T13:33:22.185843+00:00", "status_notes": "Vulnerability CVE-2021-45046 does not affect version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2021-45046 is not present in Apache Log4j 2.17.0. The vulnerability, which allowed attackers to craft malicious JNDI lookup patterns via Thread Context Map (MDC) data in non-default configurations, was fixed by upstream Apache in version 2.16.0 and further hardened in 2.17.0. The target version 2.17.0-tuxcare.1 contains the upstream fix that disables JNDI functionality by default, requiring explicit opt-in via system properties (log4j2.enableJndiLookup, log4j2.enableJndiJms, log4j2.enableJndiContextSelector - all default to false). This fix was shipped in the upstream release that TuxCare onboarded, not applied as a separate backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45046" }, "impact_statement": "CVE-2021-45046 is not present in Apache Log4j 2.17.0. The vulnerability, which allowed attackers to craft malicious JNDI lookup patterns via Thread Context Map (MDC) data in non-default configurations, was fixed by upstream Apache in version 2.16.0 and further hardened in 2.17.0. The target version 2.17.0-tuxcare.1 contains the upstream fix that disables JNDI functionality by default, requiring explicit opt-in via system properties (log4j2.enableJndiLookup, log4j2.enableJndiJms, log4j2.enableJndiContextSelector - all default to false). This fix was shipped in the upstream release that TuxCare onboarded, not applied as a separate backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2" } } ], "timestamp": "2026-11-05T13:33:22.185843+00:00", "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2021-45105 is NOT present in log4j2 version 2.17.0-tuxcare.1. The vulnerability was fixed in upstream version 2.17.0, which is the exact version TuxCare onboarded. The fix introduces separate string substitutor classes: ConfigurationStrSubstitutor (allows recursion for trusted config data) and RuntimeStrSubstitutor (blocks recursion for runtime user data like Thread Context Map). This preve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45105" }, "impact_statement": "not_affected \u2014 CVE-2021-45105 is NOT present in log4j2 version 2.17.0-tuxcare.1. The vulnerability was fixed in upstream version 2.17.0, which is the exact version TuxCare onboarded. The fix introduces separate string substitutor classes: ConfigurationStrSubstitutor (allows recursion for trusted config data) and RuntimeStrSubstitutor (blocks recursion for runtime user data like Thread Context Map). This preve..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2" } } ], "timestamp": "2026-11-05T13:33:22.185843+00:00", "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Log4j 1.x only and is explicitly marked as unsupported. The target repository is Apache Log4j 2.17.0-tuxcare.1, which is a complete architectural rewrite of Log4j 1.x. The vulnerable components (SocketAppender receiver and Chainsaw deserialization components) from Log4j 1.x do not exist in Log4j 2. Additionally, the CVE targets JRE < 1.7, but the target requires Java 8. Log4j 2 employs FilteredObjectInputStream for deserialization filtering, fundamentally preventing the unbounded nested collection deserialization attack. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26464" }, "impact_statement": "CVE-2023-26464 affects Log4j 1.x only and is explicitly marked as unsupported. The target repository is Apache Log4j 2.17.0-tuxcare.1, which is a complete architectural rewrite of Log4j 1.x. The vulnerable components (SocketAppender receiver and Chainsaw deserialization components) from Log4j 1.x do not exist in Log4j 2. Additionally, the CVE targets JRE < 1.7, but the target requires Java 8. Log4j 2 employs FilteredObjectInputStream for deserialization filtering, fundamentally preventing the unbounded nested collection deserialization attack. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2" } } ], "timestamp": "2026-11-05T13:33:22.185843+00:00", "status_notes": "Vulnerability CVE-2025-68161 affects version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2025-68161" }, "action_statement": "Vulnerability CVE-2025-68161 affects version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2" } } ], "timestamp": "2026-11-05T13:33:22.185843+00:00", "status_notes": "Vulnerability CVE-2026-34477 affects version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34477" }, "action_statement": "Vulnerability CVE-2026-34477 affects version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2" } } ], "timestamp": "2026-11-05T13:33:22.185843+00:00", "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.17.0 is NOT affected by CVE-2026-34478. This CVE describes a regression vulnerability introduced in version 2.21.0 where configuration attributes (newLineEscape, useTlsMessageFormat) were silently renamed, breaking newline escaping and enabling CRLF log injection. Version 2.17.0 predates this regression and retains the original, functional attribute names. The vulnerable code pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34478" }, "impact_statement": "not_affected \u2014 Version 2.17.0 is NOT affected by CVE-2026-34478. This CVE describes a regression vulnerability introduced in version 2.21.0 where configuration attributes (newLineEscape, useTlsMessageFormat) were silently renamed, breaking newline escaping and enabling CRLF log injection. Version 2.17.0 predates this regression and retains the original, functional attribute names. The vulnerable code pattern ..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2" } } ], "timestamp": "2026-11-05T13:33:50.206184+00:00", "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34479" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0-tuxcare.2" } } ], "timestamp": "2026-11-05T13:33:22.185843+00:00", "status_notes": "Vulnerability CVE-2026-34480 affects version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34480" }, "action_statement": "Vulnerability CVE-2026-34480 affects version 2.17.0-tuxcare.2 of org.apache.logging.log4j:log4j-core." } ] }