{
  "@id": "urn:uuid:f662eb19-04c5-4f18-9451-bc71ebbdb10f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T14:02:43.121421+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T14:02:43.121421+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.20.0-tuxcare.4 of org.apache.logging.log4j:log4j-core. The target Apache Log4j 2.20.0 is NOT AFFECTED by CVE-2017-5645. The vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accept and deserialize log events over TCP/UDP network connections were removed from the main Log4j repository in April 2017 (commit 8865124fb1) and moved to a separate Tools repository. Version 2.20.0 does not contain any server components that receive serialized log events over network. The fix commit (5dcc192158) that added FilteredObjectInputStream was already in the upstream Apache Log4j 2.20.0 release before TuxCare onboarded it. Rule 5 Type A1 applies: the Brief's INPUT (serialized Java objects received over TCP/UDP socket) is not received anywhere in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "The target Apache Log4j 2.20.0 is NOT AFFECTED by CVE-2017-5645. The vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accept and deserialize log events over TCP/UDP network connections were removed from the main Log4j repository in April 2017 (commit 8865124fb1) and moved to a separate Tools repository. Version 2.20.0 does not contain any server components that receive serialized log events over network. The fix commit (5dcc192158) that added FilteredObjectInputStream was already in the upstream Apache Log4j 2.20.0 release before TuxCare onboarded it. Rule 5 Type A1 applies: the Brief's INPUT (serialized Java objects received over TCP/UDP socket) is not received anywhere in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T14:02:43.121421+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.20.0-tuxcare.4 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2020-9488 is not present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability concerning improper SSL/TLS hostname verification in the SMTP appender was fixed by upstream commit 6851b5083e (LOG4J2-2819) authored by Matt Sicker, which was already included in the upstream Apache Log4j 2.20.0 release that TuxCare onboarded. The fix adds SslConfiguration support with a verifyHostName parameter t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 is not present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability concerning improper SSL/TLS hostname verification in the SMTP appender was fixed by upstream commit 6851b5083e (LOG4J2-2819) authored by Matt Sicker, which was already included in the upstream Apache Log4j 2.20.0 release that TuxCare onboarded. The fix adds SslConfiguration support with a verifyHostName parameter t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T14:02:43.121421+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 does not affect version 2.20.0-tuxcare.4 of org.apache.logging.log4j:log4j-core. The target Apache Log4j version 2.20.0 is NOT vulnerable to CVE-2021-44228 (Log4Shell). The fix for this CVE was introduced in upstream version 2.16.0 (December 2021), and the target is running version 2.20.0 (released May 2023), which already contains the upstream fix. The fix commit c362aff473 by Apache committer Ralph Goers disabled JNDI lookup by default, requiring the explicit system property log4j2.enableJndiLookup=true to enable it. This fix was already present when TuxCare onboarded version 2.20.0 via commit bc4b78b32d.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "impact_statement": "The target Apache Log4j version 2.20.0 is NOT vulnerable to CVE-2021-44228 (Log4Shell). The fix for this CVE was introduced in upstream version 2.16.0 (December 2021), and the target is running version 2.20.0 (released May 2023), which already contains the upstream fix. The fix commit c362aff473 by Apache committer Ralph Goers disabled JNDI lookup by default, requiring the explicit system property log4j2.enableJndiLookup=true to enable it. This fix was already present when TuxCare onboarded version 2.20.0 via commit bc4b78b32d.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T14:02:43.121421+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.20.0-tuxcare.4 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2021-44832 is NOT present in this target. The vulnerability affects Apache Log4j2 versions 2.0-beta7 through 2.17.0, allowing RCE via JDBC Appender with malicious JNDI URI data sources. The target (version 2.20.0-tuxcare.3) contains the complete upstream fix from commit 05db5f9527, which was included in upstream 2.20.0 release. Both defense layers are present: (1) JNDI JDBC disabled by defa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-44832 is NOT present in this target. The vulnerability affects Apache Log4j2 versions 2.0-beta7 through 2.17.0, allowing RCE via JDBC Appender with malicious JNDI URI data sources. The target (version 2.20.0-tuxcare.3) contains the complete upstream fix from commit 05db5f9527, which was included in upstream 2.20.0 release. Both defense layers are present: (1) JNDI JDBC disabled by defa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T14:02:43.121421+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 does not affect version 2.20.0-tuxcare.4 of org.apache.logging.log4j:log4j-core. CVE-2021-45046 is NOT present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability affects versions 2.0-beta9 through 2.15.0 and was fixed in 2.16.0 by disabling JNDI functionality by default. The target version 2.20.0 (released May 2023) already contains the upstream fix that shipped in 2.16.0 (December 2021). The fix uses granular property checks (log4j2.enableJndiLookup, log4j2.enableJndiJms, log4j2.enableJndiContextSelector) that default to false, preventing JNDI lookups unless explicitly enabled. This protection was introduced by upstream Apache developers and was already present when TuxCare onboarded version 2.20.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "impact_statement": "CVE-2021-45046 is NOT present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability affects versions 2.0-beta9 through 2.15.0 and was fixed in 2.16.0 by disabling JNDI functionality by default. The target version 2.20.0 (released May 2023) already contains the upstream fix that shipped in 2.16.0 (December 2021). The fix uses granular property checks (log4j2.enableJndiLookup, log4j2.enableJndiJms, log4j2.enableJndiContextSelector) that default to false, preventing JNDI lookups unless explicitly enabled. This protection was introduced by upstream Apache developers and was already present when TuxCare onboarded version 2.20.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T14:02:43.121421+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.20.0-tuxcare.4 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2021-45105 is not present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability was fixed in upstream Apache Log4j 2.17.0 (commit 806023265f, December 2021) and later refactored in 2.17.1 (commit 17a77f5c27, January 2022). Both commits were already present in the Apache Log4j 2.20.0 upstream release before TuxCare onboarded it. The fix prevents uncontrolled recursion from self-referential loo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-45105 is not present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability was fixed in upstream Apache Log4j 2.17.0 (commit 806023265f, December 2021) and later refactored in 2.17.1 (commit 17a77f5c27, January 2022). Both commits were already present in the Apache Log4j 2.20.0 upstream release before TuxCare onboarded it. The fix prevents uncontrolled recursion from self-referential loo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T14:02:43.121421+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.20.0-tuxcare.4 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Log4j 1.x Chainsaw and SocketAppender components when deserializing deeply nested hashmaps/hashtables on JRE < 1.7, causing memory exhaustion DoS. The target repository is Apache Log4j 2.x version 2.20.0-tuxcare.3. The vulnerable server-side deserialization components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge, Chainsaw) that would receive and deserialize log events were removed from Log4j 2.x in April 2017 (commit 8865124fb1, between versions 2.8.2 and 2.9.0) and moved to a separate Tools repository. Version 2.20.0 contains only the client-side SocketAppender (sender), not the receiver components where deserialization occurs. The log4j-1.2-api module is merely a compatibility bridge that delegates to Log4j 2.x implementations, not actual Log4j 1.x code. Therefore, the attack vector (server receiving and deserializing malicious serialized log events) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "impact_statement": "CVE-2023-26464 affects Log4j 1.x Chainsaw and SocketAppender components when deserializing deeply nested hashmaps/hashtables on JRE < 1.7, causing memory exhaustion DoS. The target repository is Apache Log4j 2.x version 2.20.0-tuxcare.3. The vulnerable server-side deserialization components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge, Chainsaw) that would receive and deserialize log events were removed from Log4j 2.x in April 2017 (commit 8865124fb1, between versions 2.8.2 and 2.9.0) and moved to a separate Tools repository. Version 2.20.0 contains only the client-side SocketAppender (sender), not the receiver components where deserialization occurs. The log4j-1.2-api module is merely a compatibility bridge that delegates to Log4j 2.x implementations, not actual Log4j 1.x code. Therefore, the attack vector (server receiving and deserializing malicious serialized log events) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T14:02:43.121421+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.20.0-tuxcare.4 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T14:02:43.121421+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.20.0-tuxcare.4 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T14:02:43.121421+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.20.0-tuxcare.4 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.20.0 is not affected by CVE-2026-34478. The vulnerability was introduced in version 2.24.0 when Rfc5424Layout migrated from @PluginFactory to @PluginBuilderFactory. In 2.20.0, the plugin system still uses @PluginFactory with the correct documented attribute names (newLineEscape, useTlsMessageFormat, etc.), so user configurations work correctly.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Version 2.20.0 is not affected by CVE-2026-34478. The vulnerability was introduced in version 2.24.0 when Rfc5424Layout migrated from @PluginFactory to @PluginBuilderFactory. In 2.20.0, the plugin system still uses @PluginFactory with the correct documented attribute names (newLineEscape, useTlsMessageFormat, etc.), so user configurations work correctly."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T14:02:43.121421+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.20.0-tuxcare.4 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.20.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T14:02:43.121421+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 affects version 2.20.0-tuxcare.4 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      },
      "action_statement": "Vulnerability CVE-2026-34480 affects version 2.20.0-tuxcare.4 of org.apache.logging.log4j:log4j-core."
    }
  ]
}