{ "@id": "urn:uuid:183b939f-7767-4435-917e-4e4993f8f44b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 15, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:04:11.456857+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2014-8180 is a false positive for org.apache.logging.log4j:log4j-core 2.22.1-tuxcare.3. direct vulnerability is in MongoDB Server project", "vulnerability": { "name": "CVE-2014-8180" }, "impact_statement": "direct vulnerability is in MongoDB Server project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2016-6494 is a false positive for org.apache.logging.log4j:log4j-core 2.22.1-tuxcare.3. direct vulnerability is in MongoDB Server project", "vulnerability": { "name": "CVE-2016-6494" }, "impact_statement": "direct vulnerability is in MongoDB Server project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-11-03T12:16:16.415526+00:00", "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core. CVE-2017-5645 does not affect Log4j 2.22.1. The vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) were fixed in upstream version 2.8.2 (commit 5dcc192158, March 2017) and subsequently removed from the main repository (commit 8865124fb1, April 2017), relocated to a separate Apache Logging Tools repository. The target version 2.22.1 does not contain these components, making the attack vector described in the CVE impossible to exploit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5645" }, "impact_statement": "CVE-2017-5645 does not affect Log4j 2.22.1. The vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) were fixed in upstream version 2.8.2 (commit 5dcc192158, March 2017) and subsequently removed from the main repository (commit 8865124fb1, April 2017), relocated to a separate Apache Logging Tools repository. The target version 2.22.1 does not contain these components, making the attack vector described in the CVE impossible to exploit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-11-01T04:46:00.073284+00:00", "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2020-9488 affects Apache Log4j2 versions prior to 2.13.2 due to improper hostname verification in SMTP over TLS connections. The target repository (version 2.22.1-tuxcare.3) is NOT AFFECTED because the upstream vendor (Apache) already fixed this vulnerability in the 2.22.1 release that TuxCare onboarded. The fix enables hostname verification via the mail.smtps.ssl.checkserveridentity proper...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9488" }, "impact_statement": "not_affected \u2014 CVE-2020-9488 affects Apache Log4j2 versions prior to 2.13.2 due to improper hostname verification in SMTP over TLS connections. The target repository (version 2.22.1-tuxcare.3) is NOT AFFECTED because the upstream vendor (Apache) already fixed this vulnerability in the 2.22.1 release that TuxCare onboarded. The fix enables hostname verification via the mail.smtps.ssl.checkserveridentity proper..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2021-32036 is a false positive for org.apache.logging.log4j:log4j-core 2.22.1-tuxcare.3. direct vulnerability is in MongoDB Server project", "vulnerability": { "name": "CVE-2021-32036" }, "impact_statement": "direct vulnerability is in MongoDB Server project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2021-38295 is a false positive for org.apache.logging.log4j:log4j-core 2.22.1-tuxcare.3. direct vulnerability is in Apache CouchDB project", "vulnerability": { "name": "CVE-2021-38295" }, "impact_statement": "direct vulnerability is in Apache CouchDB project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-11-03T12:11:13.395831+00:00", "status_notes": "Vulnerability CVE-2021-44228 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core. The target repository (Apache Log4j 2.22.1-tuxcare.3) is not affected by CVE-2021-44228 (Log4Shell). The vulnerability was fixed in upstream Apache Log4j 2.16.0 and further hardened in 2.17.0. Version 2.22.1 (released in 2024, well after the CVE disclosure in December 2021) already contains the complete upstream fix. The fix was present in the upstream release that TuxCare onboarded, not backported by TuxCare. The target has comprehensive defenses: (1) JNDI lookups are disabled by default, requiring explicit opt-in via log4j2.enableJndiLookup=true, (2) JndiLookup constructor throws IllegalStateException if not enabled, preventing plugin instantiation, (3) JndiManager.lookup() only accepts java: scheme URIs, blocking all remote lookups (ldap://, ldaps://, rmi://, etc.), and (4) JndiManager factory enforces the enablement check. The vulnerable pattern (unrestricted JNDI lookups) is not present in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44228" }, "impact_statement": "The target repository (Apache Log4j 2.22.1-tuxcare.3) is not affected by CVE-2021-44228 (Log4Shell). The vulnerability was fixed in upstream Apache Log4j 2.16.0 and further hardened in 2.17.0. Version 2.22.1 (released in 2024, well after the CVE disclosure in December 2021) already contains the complete upstream fix. The fix was present in the upstream release that TuxCare onboarded, not backported by TuxCare. The target has comprehensive defenses: (1) JNDI lookups are disabled by default, requiring explicit opt-in via log4j2.enableJndiLookup=true, (2) JndiLookup constructor throws IllegalStateException if not enabled, preventing plugin instantiation, (3) JndiManager.lookup() only accepts java: scheme URIs, blocking all remote lookups (ldap://, ldaps://, rmi://, etc.), and (4) JndiManager factory enforces the enablement check. The vulnerable pattern (unrestricted JNDI lookups) is not present in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-10-31T12:51:58.636988+00:00", "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2021-44832 is NOT present in the target. The vulnerable pattern (unrestricted JNDI URI processing in JDBC Appender) was already fixed in the upstream Apache Log4j2 2.22.1 release that TuxCare onboarded. The target code contains both defense mechanisms from the upstream patch: (1) feature flag check requiring explicit enablement of JNDI JDBC (disabled by default), and (2) URI scheme validati...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44832" }, "impact_statement": "not_affected \u2014 CVE-2021-44832 is NOT present in the target. The vulnerable pattern (unrestricted JNDI URI processing in JDBC Appender) was already fixed in the upstream Apache Log4j2 2.22.1 release that TuxCare onboarded. The target code contains both defense mechanisms from the upstream patch: (1) feature flag check requiring explicit enablement of JNDI JDBC (disabled by default), and (2) URI scheme validati..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-11-03T12:07:34.733429+00:00", "status_notes": "Vulnerability CVE-2021-45046 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core. The target repository (Apache Log4j 2.22.1-tuxcare.3) is not affected by CVE-2021-45046. The vulnerability was fixed in Apache Log4j 2.16.0 (December 2021) and further refined in 2.17.0. The target version 2.22.1 (released November 2023) already includes both components of the fix: (1) JNDI functionality disabled by default via split property checks (log4j2.enableJndiLookup, log4j2.enableJndiJms, etc., all defaulting to false), and (2) message lookup patterns completely removed from MessagePatternConverter. These fixes were authored by Apache committers (rgoers@apache.org, gardgregory@gmail.com) and shipped in the upstream release that TuxCare onboarded, not applied by TuxCare as a backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45046" }, "impact_statement": "The target repository (Apache Log4j 2.22.1-tuxcare.3) is not affected by CVE-2021-45046. The vulnerability was fixed in Apache Log4j 2.16.0 (December 2021) and further refined in 2.17.0. The target version 2.22.1 (released November 2023) already includes both components of the fix: (1) JNDI functionality disabled by default via split property checks (log4j2.enableJndiLookup, log4j2.enableJndiJms, etc., all defaulting to false), and (2) message lookup patterns completely removed from MessagePatternConverter. These fixes were authored by Apache committers (rgoers@apache.org, gardgregory@gmail.com) and shipped in the upstream release that TuxCare onboarded, not applied by TuxCare as a backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-10-31T12:36:25.736244+00:00", "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core. not_affected \u2014 The target repository (Apache Log4j2 version 2.22.1-tuxcare.3) is NOT vulnerable to CVE-2021-45105. The fix for uncontrolled recursion from self-referential lookups was already present in the upstream release 2.22.1 that TuxCare onboarded. The defense mechanism uses a LookupResult interface with an isLookupEvaluationAllowedInValue() flag that defaults to false, preventing recursive evaluation o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45105" }, "impact_statement": "not_affected \u2014 The target repository (Apache Log4j2 version 2.22.1-tuxcare.3) is NOT vulnerable to CVE-2021-45105. The fix for uncontrolled recursion from self-referential lookups was already present in the upstream release 2.22.1 that TuxCare onboarded. The defense mechanism uses a LookupResult interface with an isLookupEvaluationAllowedInValue() flag that defaults to false, preventing recursive evaluation o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2022-24706 is a false positive for org.apache.logging.log4j:log4j-core 2.22.1-tuxcare.3. direct vulnerability is in Apache CouchDB project", "vulnerability": { "name": "CVE-2022-24706" }, "impact_statement": "direct vulnerability is in Apache CouchDB project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-26268 is a false positive for org.apache.logging.log4j:log4j-core 2.22.1-tuxcare.3. direct vulnerability is in Apache CouchDB project", "vulnerability": { "name": "CVE-2023-26268" }, "impact_statement": "direct vulnerability is in Apache CouchDB project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Apache Log4j 1.x (before version 2.0) when using SocketAppender or Chainsaw components that deserialize objects without protection against deeply nested HashMap/Hashtable structures. This repository is Apache Log4j 2.22.1-tuxcare.3, which is the recommended mitigation per the CVE advisory. The vulnerable Log4j 1.x SocketAppender and Chainsaw components are not present in this codebase. The log4j-1.2-api module is a compatibility bridge that delegates to safe Log4j 2.x implementations, not actual Log4j 1.x code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26464" }, "impact_statement": "CVE-2023-26464 affects Apache Log4j 1.x (before version 2.0) when using SocketAppender or Chainsaw components that deserialize objects without protection against deeply nested HashMap/Hashtable structures. This repository is Apache Log4j 2.22.1-tuxcare.3, which is the recommended mitigation per the CVE advisory. The vulnerable Log4j 1.x SocketAppender and Chainsaw components are not present in this codebase. The log4j-1.2-api module is a compatibility bridge that delegates to safe Log4j 2.x implementations, not actual Log4j 1.x code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-45725 is a false positive for org.apache.logging.log4j:log4j-core 2.22.1-tuxcare.3. direct vulnerability is in Apache CouchDB project", "vulnerability": { "name": "CVE-2023-45725" }, "impact_statement": "direct vulnerability is in Apache CouchDB project" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2025-68161" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34477 affects version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34477" }, "action_statement": "Vulnerability CVE-2026-34477 affects version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core. Version not vulnerable (per prereq analysis); terminalized.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34478" }, "impact_statement": "Version not vulnerable (per prereq analysis); terminalized." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34479" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.22.1-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34480" } } ] }