{ "@id": "urn:uuid:3790bce1-1c18-4c32-aebd-9da32addd4b1", "role": "Document Creator", "author": "https://tuxcare.com", "version": 14, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:04:11.456857+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2" } } ], "timestamp": "2026-11-03T12:15:19.421943+00:00", "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2017-5645 is not present in Apache Log4j 2.24.3-tuxcare.5. The vulnerable TcpSocketServer and UdpSocketServer components that accepted serialized log events over network sockets were fixed by upstream commit 5dcc192158 (adding FilteredObjectInputStream class filtering) and later removed entirely in commit 8865124fb1 (moved to separate Tools repository). Both commits were authored upstream and included in the release 2.24.3 that TuxCare onboarded. The input-receiving code no longer exists in this distribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5645" }, "impact_statement": "CVE-2017-5645 is not present in Apache Log4j 2.24.3-tuxcare.5. The vulnerable TcpSocketServer and UdpSocketServer components that accepted serialized log events over network sockets were fixed by upstream commit 5dcc192158 (adding FilteredObjectInputStream class filtering) and later removed entirely in commit 8865124fb1 (moved to separate Tools repository). Both commits were authored upstream and included in the release 2.24.3 that TuxCare onboarded. The input-receiving code no longer exists in this distribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2" } } ], "timestamp": "2026-11-01T04:46:00.073284+00:00", "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2020-9488 affects Apache Log4j SMTP appender prior to version 2.13.2 due to improper hostname verification in SMTPS connections. The target repository is at version 2.24.3-tuxcare.5, which inherited the fix from upstream Apache Log4j 2.13.2 release. The fix (commit 6851b5083ef9610bae320bf07e1f24d2aa08851b by Matt Sicker) adds verifyHostName support to SslConfiguration and SmtpManager proper...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9488" }, "impact_statement": "not_affected \u2014 CVE-2020-9488 affects Apache Log4j SMTP appender prior to version 2.13.2 due to improper hostname verification in SMTPS connections. The target repository is at version 2.24.3-tuxcare.5, which inherited the fix from upstream Apache Log4j 2.13.2 release. The fix (commit 6851b5083ef9610bae320bf07e1f24d2aa08851b by Matt Sicker) adds verifyHostName support to SslConfiguration and SmtpManager proper..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2" } } ], "timestamp": "2026-11-03T12:10:20.881763+00:00", "status_notes": "Vulnerability CVE-2021-44228 does not affect version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2021-44228 (Log4Shell) does not affect this target. The vulnerability allows remote code execution via JNDI lookups in log messages. Target version 2.24.3 already contains comprehensive defenses from upstream Apache Log4j2 that were introduced in version 2.16.0 (December 2021): JNDI lookups are disabled by default and require explicit opt-in via system property log4j2.enableJndiLookup=true, JNDI protocols are restricted to java: only (no ldap://, rmi://), and message lookup substitution has been removed. The fix was present in the upstream release when TuxCare onboarded version 2.24.3, requiring no separate backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44228" }, "impact_statement": "CVE-2021-44228 (Log4Shell) does not affect this target. The vulnerability allows remote code execution via JNDI lookups in log messages. Target version 2.24.3 already contains comprehensive defenses from upstream Apache Log4j2 that were introduced in version 2.16.0 (December 2021): JNDI lookups are disabled by default and require explicit opt-in via system property log4j2.enableJndiLookup=true, JNDI protocols are restricted to java: only (no ldap://, rmi://), and message lookup substitution has been removed. The fix was present in the upstream release when TuxCare onboarded version 2.24.3, requiring no separate backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2" } } ], "timestamp": "2026-10-31T12:51:28.026179+00:00", "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 The target repository (Log4j2 2.24.3-tuxcare.5) is not affected by CVE-2021-44832. The vulnerability fix was already present in the upstream Apache Log4j2 2.24.3 release before TuxCare onboarded it. The fix implements two defenses: (1) requires explicit opt-in via log4j2.enableJndiJdbc=true system property, and (2) restricts JNDI DataSource lookups to the java: protocol only, blocking malicious...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44832" }, "impact_statement": "not_affected \u2014 The target repository (Log4j2 2.24.3-tuxcare.5) is not affected by CVE-2021-44832. The vulnerability fix was already present in the upstream Apache Log4j2 2.24.3 release before TuxCare onboarded it. The fix implements two defenses: (1) requires explicit opt-in via log4j2.enableJndiJdbc=true system property, and (2) restricts JNDI DataSource lookups to the java: protocol only, blocking malicious..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2" } } ], "timestamp": "2026-11-03T12:07:34.733429+00:00", "status_notes": "Vulnerability CVE-2021-45046 does not affect version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2021-45046 is NOT present in Apache Log4j 2.24.3-tuxcare.5. The upstream fix (commit c362aff473 by rgoers@apache.org) that disables JNDI by default was already included in the upstream 2.24.3 release that TuxCare onboarded. The target contains multiple defense layers: (1) JNDI disabled by default via log4j2.enableJndiLookup property, (2) JndiLookup not registered in Interpolator unless explicitly enabled, (3) JndiLookup constructor throws IllegalStateException when JNDI disabled, and (4) message lookups completely removed. All defenses default to disabled/false, completely blocking the attack vector where attackers control Thread Context Map data to trigger JNDI lookups.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45046" }, "impact_statement": "CVE-2021-45046 is NOT present in Apache Log4j 2.24.3-tuxcare.5. The upstream fix (commit c362aff473 by rgoers@apache.org) that disables JNDI by default was already included in the upstream 2.24.3 release that TuxCare onboarded. The target contains multiple defense layers: (1) JNDI disabled by default via log4j2.enableJndiLookup property, (2) JndiLookup not registered in Interpolator unless explicitly enabled, (3) JndiLookup constructor throws IllegalStateException when JNDI disabled, and (4) message lookups completely removed. All defenses default to disabled/false, completely blocking the attack vector where attackers control Thread Context Map data to trigger JNDI lookups.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2" } } ], "timestamp": "2026-10-31T12:35:50.891113+00:00", "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2021-45105 affects Apache Log4j2 versions 2.0-alpha1 through 2.16.0 and was fixed in version 2.17.0. The target repository is at version 2.24.3, which already contains the upstream fix. The vulnerability involved uncontrolled recursion from self-referential lookups in Thread Context Map data. The fix prevents recursive evaluation of user-provided lookup values while still allowing it for tr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45105" }, "impact_statement": "not_affected \u2014 CVE-2021-45105 affects Apache Log4j2 versions 2.0-alpha1 through 2.16.0 and was fixed in version 2.17.0. The target repository is at version 2.24.3, which already contains the upstream fix. The vulnerability involved uncontrolled recursion from self-referential lookups in Thread Context Map data. The fix prevents recursive evaluation of user-provided lookup values while still allowing it for tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j-core. Apache Log4j 2.24.3 is not affected by CVE-2023-26464. This CVE targets Log4j 1.x's SocketAppender and Chainsaw components which deserialize logging events using Java Object Serialization, enabling memory exhaustion via deeply nested HashMap/Hashtable objects. Log4j 2.x is a complete rewrite that uses Layout-based serialization (JSON, XML, etc.) instead of Java Object deserialization. The vulnerable Log4j 1.x deserialization code is not present in this codebase. The log4j-1.2-api compatibility module is merely a bridge that delegates to Log4j 2.x implementations, not a vendored copy of Log4j 1.x code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26464" }, "impact_statement": "Apache Log4j 2.24.3 is not affected by CVE-2023-26464. This CVE targets Log4j 1.x's SocketAppender and Chainsaw components which deserialize logging events using Java Object Serialization, enabling memory exhaustion via deeply nested HashMap/Hashtable objects. Log4j 2.x is a complete rewrite that uses Layout-based serialization (JSON, XML, etc.) instead of Java Object deserialization. The vulnerable Log4j 1.x deserialization code is not present in this codebase. The log4j-1.2-api compatibility module is merely a bridge that delegates to Log4j 2.x implementations, not a vendored copy of Log4j 1.x code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2025-68161" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34477" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34478 is fixed in version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34478" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34479" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3-tuxcare.2" } } ], "timestamp": "2026-10-28T12:52:23.559296+00:00", "status_notes": "Vulnerability CVE-2026-34480 affects version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j-core, and is fixed in 2.24.3-tuxcare.5.", "vulnerability": { "name": "CVE-2026-34480" }, "action_statement": "Vulnerability CVE-2026-34480 affects version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j-core, and is fixed in 2.24.3-tuxcare.5." } ] }