{ "@id": "urn:uuid:df03024a-cf97-476d-ac94-68deee6eb6e3", "role": "Document Creator", "author": "https://tuxcare.com", "version": 14, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:03:00.104314+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1" } } ], "timestamp": "2026-11-03T12:13:29.842653+00:00", "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core. Version 2.17.1 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that receive and deserialize log events from remote clients do not exist in this version. Upstream removed these components entirely in April 2017 (commit 8865124fb1), years before version 2.17.1 was released in December 2021. The fix (FilteredObjectInputStream for deserialization class whitelisting) was applied by upstream in March 2017 (commit 5dcc192158), and both changes were already in the upstream 2.17.1 release before TuxCare onboarded it (commit 655616ca35).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5645" }, "impact_statement": "Version 2.17.1 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that receive and deserialize log events from remote clients do not exist in this version. Upstream removed these components entirely in April 2017 (commit 8865124fb1), years before version 2.17.1 was released in December 2021. The fix (FilteredObjectInputStream for deserialization class whitelisting) was applied by upstream in March 2017 (commit 5dcc192158), and both changes were already in the upstream 2.17.1 release before TuxCare onboarded it (commit 655616ca35).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1" } } ], "timestamp": "2026-11-01T04:43:00.112738+00:00", "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2020-9488 concerns improper hostname verification in Log4j's SMTP appender when using SMTPS, allowing MITM attacks to intercept log messages. The fix adds SSL configuration support with a verifyHostName attribute that enables JavaMail's hostname verification via the mail.smtps.ssl.checkserveridentity property. The target repository (version 2.17.1-tuxcare.4, SHA 7fab1fe26e) already contains...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9488" }, "impact_statement": "not_affected \u2014 CVE-2020-9488 concerns improper hostname verification in Log4j's SMTP appender when using SMTPS, allowing MITM attacks to intercept log messages. The fix adds SSL configuration support with a verifyHostName attribute that enables JavaMail's hostname verification via the mail.smtps.ssl.checkserveridentity property. The target repository (version 2.17.1-tuxcare.4, SHA 7fab1fe26e) already contains..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2021-44228 does not affect version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core. CVE-2021-44228 (Log4Shell) is not present in logging-log4j2 2.17.1. The vulnerability was fixed in upstream versions 2.15.0 (partial) and 2.16.0+ (complete), and version 2.17.1 includes all fixes. The target contains three layers of defense: (1) JndiLookup is not registered in the Interpolator by default, (2) JndiLookup constructor throws IllegalStateException unless explicitly enabled via log4j2.enableJndiLookup=true, and (3) JndiManager.lookup() restricts JNDI to java: scheme only, blocking ldap:/ldaps: URIs. The fix was authored by Apache developers and shipped in the upstream 2.17.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44228" }, "impact_statement": "CVE-2021-44228 (Log4Shell) is not present in logging-log4j2 2.17.1. The vulnerability was fixed in upstream versions 2.15.0 (partial) and 2.16.0+ (complete), and version 2.17.1 includes all fixes. The target contains three layers of defense: (1) JndiLookup is not registered in the Interpolator by default, (2) JndiLookup constructor throws IllegalStateException unless explicitly enabled via log4j2.enableJndiLookup=true, and (3) JndiManager.lookup() restricts JNDI to java: scheme only, blocking ldap:/ldaps: URIs. The fix was authored by Apache developers and shipped in the upstream 2.17.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1" } } ], "timestamp": "2026-10-31T12:46:08.848861+00:00", "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 The target repository (Apache Log4j2 version 2.17.1) is NOT AFFECTED by CVE-2021-44832. The vulnerability pattern described in the CVE\u2014where a JDBC Appender with a JNDI datasource URI can be exploited for remote code execution\u2014is not present in this version. The upstream Apache fix (commit 05db5f9527) that addresses this vulnerability was already included in the upstream 2.17.1 release, which T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44832" }, "impact_statement": "not_affected \u2014 The target repository (Apache Log4j2 version 2.17.1) is NOT AFFECTED by CVE-2021-44832. The vulnerability pattern described in the CVE\u2014where a JDBC Appender with a JNDI datasource URI can be exploited for remote code execution\u2014is not present in this version. The upstream Apache fix (commit 05db5f9527) that addresses this vulnerability was already included in the upstream 2.17.1 release, which T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2021-45046 does not affect version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core. CVE-2021-45046 is NOT present in Log4j 2.17.1. The vulnerability allowed attackers to inject JNDI lookup patterns through Thread Context Map (MDC) data when used with Pattern Layout, resulting in RCE. The fix (commit c362aff473) was implemented by Apache in version 2.16.0 and is present in this 2.17.1 target. The fix disables JNDI lookup functionality by default via the log4j2.enableJndiLookup property (defaults to false), preventing the attack vector. This is an upstream fix that shipped in the Apache 2.17.1 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45046" }, "impact_statement": "CVE-2021-45046 is NOT present in Log4j 2.17.1. The vulnerability allowed attackers to inject JNDI lookup patterns through Thread Context Map (MDC) data when used with Pattern Layout, resulting in RCE. The fix (commit c362aff473) was implemented by Apache in version 2.16.0 and is present in this 2.17.1 target. The fix disables JNDI lookup functionality by default via the log4j2.enableJndiLookup property (defaults to false), preventing the attack vector. This is an upstream fix that shipped in the Apache 2.17.1 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1" } } ], "timestamp": "2026-10-31T12:32:16.664374+00:00", "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2021-45105 affects Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) and was fixed in 2.17.0 and 2.12.3. The target version is 2.17.1-tuxcare.4, which already contains the upstream fix. The fix introduces two StrSubstitutor subclasses: ConfigurationStrSubstitutor (allows recursive lookup evaluation for config parsing) and RuntimeStrSubstitutor (blocks recursive evaluation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45105" }, "impact_statement": "not_affected \u2014 CVE-2021-45105 affects Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) and was fixed in 2.17.0 and 2.12.3. The target version is 2.17.1-tuxcare.4, which already contains the upstream fix. The fix introduces two StrSubstitutor subclasses: ConfigurationStrSubstitutor (allows recursive lookup evaluation for config parsing) and RuntimeStrSubstitutor (blocks recursive evaluation ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Apache Log4j 1.x only (CVE explicitly states \"affects Apache Log4j before 2\"). This repository is Apache Log4j 2.17.1-tuxcare.4. The vulnerable components (Chainsaw, Log4j 1.x SocketAppender receiver with deserialization) are not present. Log4j 2 uses a fundamentally different architecture with protections against deserialization attacks (FilteredObjectInputStream since 2.8.2, readObject guards in core event classes). The log4j-1.2-api module is a compatibility bridge providing Log4j 1.x API on top of Log4j 2.x internals, not a vendored copy of vulnerable Log4j 1.x code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26464" }, "impact_statement": "CVE-2023-26464 affects Apache Log4j 1.x only (CVE explicitly states \"affects Apache Log4j before 2\"). This repository is Apache Log4j 2.17.1-tuxcare.4. The vulnerable components (Chainsaw, Log4j 1.x SocketAppender receiver with deserialization) are not present. Log4j 2 uses a fundamentally different architecture with protections against deserialization attacks (FilteredObjectInputStream since 2.8.2, readObject guards in core event classes). The log4j-1.2-api module is a compatibility bridge providing Log4j 1.x API on top of Log4j 2.x internals, not a vendored copy of vulnerable Log4j 1.x code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2025-68161" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34477 affects version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.17.1-tuxcare.2.", "vulnerability": { "name": "CVE-2026-34477" }, "action_statement": "Vulnerability CVE-2026-34477 affects version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.17.1-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1" } } ], "timestamp": "2026-11-01T07:59:00.096696+00:00", "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Target version 2.17.1 is NOT AFFECTED by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 during a builder pattern migration that accidentally renamed security-relevant configuration attributes (newLineEscape\u2192escapeNL, useTlsMessageFormat\u2192useTLSMessageFormat). Version 2.17.1 predates this refactoring, uses the factory method pattern, and has the correct documented attribute na...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34478" }, "impact_statement": "not_affected \u2014 Target version 2.17.1 is NOT AFFECTED by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 during a builder pattern migration that accidentally renamed security-relevant configuration attributes (newLineEscape\u2192escapeNL, useTlsMessageFormat\u2192useTLSMessageFormat). Version 2.17.1 predates this refactoring, uses the factory method pattern, and has the correct documented attribute na..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34479 affects version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.17.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-34479" }, "action_statement": "Vulnerability CVE-2026-34479 affects version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.17.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34480 affects version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.17.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-34480" }, "action_statement": "Vulnerability CVE-2026-34480 affects version 2.17.1-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.17.1-tuxcare.4." } ] }