{ "@id": "urn:uuid:a0cb6825-be65-438c-bd0a-b4d0cc99b213", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:04:11.456857+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2" } } ], "timestamp": "2026-11-03T19:28:54.845503+00:00", "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. The target version 2.21.1 does not contain the vulnerable TCP/UDP socket server code (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accepts serialized log events. These classes were removed from the Apache Log4j2 project by upstream commit 8865124fb1 when the log4j-server module was moved to a separate Tools repository during the 2.8.2 release cycle. Since version 2.21.1 was released much later, it never contained this vulnerable server-side functionality. The CVE-2017-5645 vulnerability cannot manifest because the attack surface (server-side deserialization of untrusted log events over TCP/UDP) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5645" }, "impact_statement": "The target version 2.21.1 does not contain the vulnerable TCP/UDP socket server code (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accepts serialized log events. These classes were removed from the Apache Log4j2 project by upstream commit 8865124fb1 when the log4j-server module was moved to a separate Tools repository during the 2.8.2 release cycle. Since version 2.21.1 was released much later, it never contained this vulnerable server-side functionality. The CVE-2017-5645 vulnerability cannot manifest because the attack surface (server-side deserialization of untrusted log events over TCP/UDP) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2" } } ], "timestamp": "2026-11-03T19:28:54.845503+00:00", "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2020-9488 fix for SMTP hostname verification was already present in upstream Apache Log4j 2.21.1 release. The fix (commit 6851b5083e by Matt Sicker, April 2020) adds SSL configuration support and hostname verification capability via mail.smtps.ssl.checkserveridentity property. This commit is an ancestor of TuxCare's onboarding commit 7bbf7f9c41, confirming the fix shipped with the upstream ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9488" }, "impact_statement": "not_affected \u2014 CVE-2020-9488 fix for SMTP hostname verification was already present in upstream Apache Log4j 2.21.1 release. The fix (commit 6851b5083e by Matt Sicker, April 2020) adds SSL configuration support and hostname verification capability via mail.smtps.ssl.checkserveridentity property. This commit is an ancestor of TuxCare's onboarding commit 7bbf7f9c41, confirming the fix shipped with the upstream ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2" } } ], "timestamp": "2026-11-03T19:28:54.845503+00:00", "status_notes": "Vulnerability CVE-2021-44228 does not affect version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. The target version 2.21.1 is not vulnerable to CVE-2021-44228 (Log4Shell). The upstream Apache release already included both critical fixes: (1) JNDI lookup is disabled by default and requires explicit enablement via log4j2.enableJndiLookup=true, and (2) message lookup substitution has been completely removed from the codebase. These fixes were present in the rel/2.21.1 tag created by ASF Logging Services RM and were authored by upstream Apache developers, not TuxCare backports.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44228" }, "impact_statement": "The target version 2.21.1 is not vulnerable to CVE-2021-44228 (Log4Shell). The upstream Apache release already included both critical fixes: (1) JNDI lookup is disabled by default and requires explicit enablement via log4j2.enableJndiLookup=true, and (2) message lookup substitution has been completely removed from the codebase. These fixes were present in the rel/2.21.1 tag created by ASF Logging Services RM and were authored by upstream Apache developers, not TuxCare backports.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2" } } ], "timestamp": "2026-11-03T19:28:54.845503+00:00", "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 The target (Log4j2 2.21.1-tuxcare.1) is not affected by CVE-2021-44832. The vulnerability was fixed in upstream version 2.17.1, and the target version 2.21.1 already contains the complete fix from commit 05db5f95 by Gary Gregory. Both required defenses are present: (1) opt-in requirement via log4j2.enableJndiJdbc property (defaults to false), and (2) JNDI URI protocol restriction to \"java:\" sch...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44832" }, "impact_statement": "not_affected \u2014 The target (Log4j2 2.21.1-tuxcare.1) is not affected by CVE-2021-44832. The vulnerability was fixed in upstream version 2.17.1, and the target version 2.21.1 already contains the complete fix from commit 05db5f95 by Gary Gregory. Both required defenses are present: (1) opt-in requirement via log4j2.enableJndiJdbc property (defaults to false), and (2) JNDI URI protocol restriction to \"java:\" sch..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2" } } ], "timestamp": "2026-11-03T19:28:54.845503+00:00", "status_notes": "Vulnerability CVE-2021-45046 does not affect version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2021-45046 is NOT present in Apache Log4j 2.21.1. The vulnerability (incomplete fix for CVE-2021-44228 allowing JNDI injection via Thread Context Map patterns) was fixed in upstream commit c362aff473 (LOG4J2-3208) authored by rgoers@apache.org. This fix shipped in the upstream release and predates TuxCare's involvement. The fix disables JNDI functionality by default via system property gates (log4j2.enableJndiLookup, etc., all defaulting to false), preventing attackers from exploiting MDC/context lookup patterns to trigger JNDI resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45046" }, "impact_statement": "CVE-2021-45046 is NOT present in Apache Log4j 2.21.1. The vulnerability (incomplete fix for CVE-2021-44228 allowing JNDI injection via Thread Context Map patterns) was fixed in upstream commit c362aff473 (LOG4J2-3208) authored by rgoers@apache.org. This fix shipped in the upstream release and predates TuxCare's involvement. The fix disables JNDI functionality by default via system property gates (log4j2.enableJndiLookup, etc., all defaulting to false), preventing attackers from exploiting MDC/context lookup patterns to trigger JNDI resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2" } } ], "timestamp": "2026-11-03T19:28:54.845503+00:00", "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2021-45105 is NOT present in Log4j 2.21.1. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed by upstream Apache in commit 806023265f, which shipped in release 2.17.0 (Dec 2021). Target version 2.21.1 was released in 2024 and contains this fix. The defense mechanism uses LookupResult.isLookupEvaluationAllowedInValue() which defaults...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45105" }, "impact_statement": "not_affected \u2014 CVE-2021-45105 is NOT present in Log4j 2.21.1. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed by upstream Apache in commit 806023265f, which shipped in release 2.17.0 (Dec 2021). Target version 2.21.1 was released in 2024 and contains this fix. The defense mechanism uses LookupResult.isLookupEvaluationAllowedInValue() which defaults..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Apache Log4j 1.x only (before version 2). The target repository is Apache Log4j 2.x (version 2.21.1-tuxcare.2), which has fundamentally different architecture. Log4j 2.x SocketAppender uses pluggable layouts instead of automatic Java object serialization, SerializedLayout is deprecated since 2.9 with security warnings, and the vulnerable socket server components (TcpSocketServer, UdpSocketServer) that would deserialize log events were removed from the main distribution and moved to a separate Tools repository (commit 8865124fb1, April 2017). The Chainsaw component mentioned in the CVE does not exist in Log4j 2.x. The log4j-1.2-api module is a compatibility bridge that translates Log4j 1.x API calls to Log4j 2.x implementation, not a vendored copy of vulnerable Log4j 1.x code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26464" }, "impact_statement": "CVE-2023-26464 affects Apache Log4j 1.x only (before version 2). The target repository is Apache Log4j 2.x (version 2.21.1-tuxcare.2), which has fundamentally different architecture. Log4j 2.x SocketAppender uses pluggable layouts instead of automatic Java object serialization, SerializedLayout is deprecated since 2.9 with security warnings, and the vulnerable socket server components (TcpSocketServer, UdpSocketServer) that would deserialize log events were removed from the main distribution and moved to a separate Tools repository (commit 8865124fb1, April 2017). The Chainsaw component mentioned in the CVE does not exist in Log4j 2.x. The log4j-1.2-api module is a compatibility bridge that translates Log4j 1.x API calls to Log4j 2.x implementation, not a vendored copy of vulnerable Log4j 1.x code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2" } } ], "timestamp": "2026-11-03T19:28:54.845503+00:00", "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2025-68161" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2" } } ], "timestamp": "2026-11-03T19:28:54.845503+00:00", "status_notes": "Vulnerability CVE-2026-34477 affects version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34477" }, "action_statement": "Vulnerability CVE-2026-34477 affects version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2" } } ], "timestamp": "2026-11-03T19:28:54.845503+00:00", "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.21.1 is NOT affected by CVE-2026-34478. The vulnerability requires the builder pattern to be activated via @PluginBuilderFactory (introduced in version 2.25.0), which only recognized alias attribute names (includeNL, escapeNL, useTLSMessageFormat) and ignored documented names (newLine, newLineEscape, useTlsMessageFormat). In version 2.21.1, the @PluginFactory method remains the active...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34478" }, "impact_statement": "not_affected \u2014 Version 2.21.1 is NOT affected by CVE-2026-34478. The vulnerability requires the builder pattern to be activated via @PluginBuilderFactory (introduced in version 2.25.0), which only recognized alias attribute names (includeNL, escapeNL, useTLSMessageFormat) and ignored documented names (newLine, newLineEscape, useTlsMessageFormat). In version 2.21.1, the @PluginFactory method remains the active..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2" } } ], "timestamp": "2026-11-03T19:28:54.845503+00:00", "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34479" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.21.1-tuxcare.2" } } ], "timestamp": "2026-11-03T19:28:54.845503+00:00", "status_notes": "Vulnerability CVE-2026-34480 affects version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34480" }, "action_statement": "Vulnerability CVE-2026-34480 affects version 2.21.1-tuxcare.2 of org.apache.logging.log4j:log4j-core." } ] }