{ "@id": "urn:uuid:849527e8-358d-4a09-afa0-9e925cbe7b06", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-11T05:53:47.065866+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6" } } ], "timestamp": "2026-11-11T05:53:47.065866+00:00", "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core. The target repository (Apache Log4j 2.24.1) is not affected by CVE-2017-5645. The vulnerability concerned unsafe deserialization in TCP/UDP socket servers that received serialized log events. The upstream fix (adding FilteredObjectInputStream class whitelisting) was applied in commit 5dcc19215827db29c993d0305ee2b0d8dd05939d on 2017-04-02, which shipped in the upstream release before TuxCare onboarding. Subsequently, on 2017-04-11, the entire vulnerable component (TcpSocketServer, UdpSocketServer, AbstractSocketServer) was removed from the repository and moved to a separate Tools repo (commit 8865124fb1). The target contains neither the vulnerable pre-fix code nor the socket server infrastructure that would receive serialized log events over the network. Rule 5 Type A1 satisfied: the INPUT type (serialized binary data sent to TCP/UDP socket server) is not received anywhere in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5645" }, "impact_statement": "The target repository (Apache Log4j 2.24.1) is not affected by CVE-2017-5645. The vulnerability concerned unsafe deserialization in TCP/UDP socket servers that received serialized log events. The upstream fix (adding FilteredObjectInputStream class whitelisting) was applied in commit 5dcc19215827db29c993d0305ee2b0d8dd05939d on 2017-04-02, which shipped in the upstream release before TuxCare onboarding. Subsequently, on 2017-04-11, the entire vulnerable component (TcpSocketServer, UdpSocketServer, AbstractSocketServer) was removed from the repository and moved to a separate Tools repo (commit 8865124fb1). The target contains neither the vulnerable pre-fix code nor the socket server infrastructure that would receive serialized log events over the network. Rule 5 Type A1 satisfied: the INPUT type (serialized binary data sent to TCP/UDP socket server) is not received anywhere in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6" } } ], "timestamp": "2026-11-11T05:53:47.065866+00:00", "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2020-9488 affects Apache Log4j SMTP appender prior to version 2.13.2 due to missing hostname verification in SMTPS connections. The target version 2.24.1-tuxcare.3 contains the upstream fix (commit 6851b5083e from April 2020) that adds SSL configuration support with hostname verification via the `mail.smtps.ssl.checkserveridentity` property. This fix was already present in the upstream Apac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9488" }, "impact_statement": "not_affected \u2014 CVE-2020-9488 affects Apache Log4j SMTP appender prior to version 2.13.2 due to missing hostname verification in SMTPS connections. The target version 2.24.1-tuxcare.3 contains the upstream fix (commit 6851b5083e from April 2020) that adds SSL configuration support with hostname verification via the `mail.smtps.ssl.checkserveridentity` property. This fix was already present in the upstream Apac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6" } } ], "timestamp": "2026-11-11T05:53:47.065866+00:00", "status_notes": "Vulnerability CVE-2021-44228 does not affect version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core. Target version 2.24.1 is not affected by CVE-2021-44228 (Log4Shell). The vulnerability was fixed in upstream Apache Log4j2 versions 2.15.0-2.16.0 (December 2021), and version 2.24.1 (released 2024) includes these fixes. Two critical defenses are present: (1) Message lookups completely removed - MessagePatternConverter explicitly rejects lookup options with \"Message Lookups are no longer supported\", preventing ${jndi:...} substitution in log messages; (2) JNDI disabled by default and severely restricted - JndiManager requires explicit log4j2.enableJndiLookup=true (defaults false) and only allows \"java:\" protocol, blocking ldap/ldaps connections. The fixes were authored by Apache maintainers (ckozak@apache.org, rgoers@apache.org) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44228" }, "impact_statement": "Target version 2.24.1 is not affected by CVE-2021-44228 (Log4Shell). The vulnerability was fixed in upstream Apache Log4j2 versions 2.15.0-2.16.0 (December 2021), and version 2.24.1 (released 2024) includes these fixes. Two critical defenses are present: (1) Message lookups completely removed - MessagePatternConverter explicitly rejects lookup options with \"Message Lookups are no longer supported\", preventing ${jndi:...} substitution in log messages; (2) JNDI disabled by default and severely restricted - JndiManager requires explicit log4j2.enableJndiLookup=true (defaults false) and only allows \"java:\" protocol, blocking ldap/ldaps connections. The fixes were authored by Apache maintainers (ckozak@apache.org, rgoers@apache.org) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6" } } ], "timestamp": "2026-11-11T05:53:47.065866+00:00", "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core. not_affected \u2014 The target repository (Apache Log4j2 version 2.24.1-tuxcare.3) is NOT AFFECTED by CVE-2021-44832. The vulnerability, which allowed remote code execution via JDBC Appender with malicious JNDI URIs, has been fixed by upstream Apache in commit 05db5f95. This fix was included in the upstream release before TuxCare onboarded version 2.24.1. The fix implements two defense layers: (1) requires explici...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44832" }, "impact_statement": "not_affected \u2014 The target repository (Apache Log4j2 version 2.24.1-tuxcare.3) is NOT AFFECTED by CVE-2021-44832. The vulnerability, which allowed remote code execution via JDBC Appender with malicious JNDI URIs, has been fixed by upstream Apache in commit 05db5f95. This fix was included in the upstream release before TuxCare onboarded version 2.24.1. The fix implements two defense layers: (1) requires explici..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6" } } ], "timestamp": "2026-11-11T05:53:47.065866+00:00", "status_notes": "Vulnerability CVE-2021-45046 does not affect version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core. CVE-2021-45046 is NOT present in target version 2.24.1. The vulnerability required JNDI lookup functionality to be accessible via pattern substitution (Context Lookup ${ctx:...} or Thread Context Map patterns %X/%mdc/%MDC). The upstream Apache fix from version 2.16.0 is present: (1) JNDI lookup is disabled by default via system property checks (log4j2.enableJndiLookup defaults to false), and (2) message pattern lookups are completely removed. The fix commit c362aff473 authored by rgoers@apache.org was shipped in the upstream Apache 2.24.1 release that TuxCare onboarded, predating all TuxCare commits on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45046" }, "impact_statement": "CVE-2021-45046 is NOT present in target version 2.24.1. The vulnerability required JNDI lookup functionality to be accessible via pattern substitution (Context Lookup ${ctx:...} or Thread Context Map patterns %X/%mdc/%MDC). The upstream Apache fix from version 2.16.0 is present: (1) JNDI lookup is disabled by default via system property checks (log4j2.enableJndiLookup defaults to false), and (2) message pattern lookups are completely removed. The fix commit c362aff473 authored by rgoers@apache.org was shipped in the upstream Apache 2.24.1 release that TuxCare onboarded, predating all TuxCare commits on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6" } } ], "timestamp": "2026-11-11T05:53:47.065866+00:00", "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Target version 2.24.1 is not affected by CVE-2021-45105. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed in upstream Apache Log4j 2.17.2 via commit 17a77f5c27 (LOG4J2-3317). This fix was already present in the upstream release that TuxCare onboarded. The fix uses the LookupResult interface pattern: ContextMapLookup returns DefaultLoo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45105" }, "impact_statement": "not_affected \u2014 Target version 2.24.1 is not affected by CVE-2021-45105. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed in upstream Apache Log4j 2.17.2 via commit 17a77f5c27 (LOG4J2-3317). This fix was already present in the upstream release that TuxCare onboarded. The fix uses the LookupResult interface pattern: ContextMapLookup returns DefaultLoo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6" } } ], "timestamp": "2026-11-11T05:53:47.065866+00:00", "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Apache Log4j 1.x Chainsaw and SocketAppender components that deserialize deeply nested hashmap/hashtable objects, causing memory exhaustion on JRE < 1.7. The target repository is Apache Log4j 2.24.1-tuxcare.4, a completely different codebase architecture. The vulnerable Log4j 1.x components (Chainsaw and the deserialization-based SocketAppender) do not exist in Log4j 2.x. The log4j-1.2-api module is only a thin API compatibility bridge that delegates to Log4j 2.x's safe implementation, which uses FilteredObjectInputStream for controlled deserialization with class whitelisting. The CVE explicitly states it affects \"Apache Log4j before 2\" and recommends upgrading to Log4j 2.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26464" }, "impact_statement": "CVE-2023-26464 affects Apache Log4j 1.x Chainsaw and SocketAppender components that deserialize deeply nested hashmap/hashtable objects, causing memory exhaustion on JRE < 1.7. The target repository is Apache Log4j 2.24.1-tuxcare.4, a completely different codebase architecture. The vulnerable Log4j 1.x components (Chainsaw and the deserialization-based SocketAppender) do not exist in Log4j 2.x. The log4j-1.2-api module is only a thin API compatibility bridge that delegates to Log4j 2.x's safe implementation, which uses FilteredObjectInputStream for controlled deserialization with class whitelisting. The CVE explicitly states it affects \"Apache Log4j before 2\" and recommends upgrading to Log4j 2.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6" } } ], "timestamp": "2026-11-11T05:53:47.065866+00:00", "status_notes": "Vulnerability CVE-2025-68161 affects version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2025-68161" }, "action_statement": "Vulnerability CVE-2025-68161 affects version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6" } } ], "timestamp": "2026-11-11T05:53:47.065866+00:00", "status_notes": "Vulnerability CVE-2026-34477 affects version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34477" }, "action_statement": "Vulnerability CVE-2026-34477 affects version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6" } } ], "timestamp": "2026-11-11T05:53:47.065866+00:00", "status_notes": "Vulnerability CVE-2026-34478 is fixed in version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34478" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6" } } ], "timestamp": "2026-11-11T05:53:47.065866+00:00", "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34479" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.1-tuxcare.6" } } ], "timestamp": "2026-11-11T05:53:47.065866+00:00", "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.24.1-tuxcare.6 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34480" } } ] }