{ "@id": "urn:uuid:f1136640-f8e4-4750-ab7d-0c4c890a4c4c", "role": "Document Creator", "author": "https://tuxcare.com", "version": 10, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:04:11.456857+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1" } } ], "timestamp": "2026-11-03T12:16:16.415526+00:00", "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-core. Apache Log4j2 version 2.25.2 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server classes (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that receive and deserialize log events from network connections were removed from this repository in April 2017 (commit 8865124fb1) and moved to the separate apache/logging-log4j-tools repository. The target version does not contain any code that receives serialized Java objects over network sockets, making the attack vector described in CVE-2017-5645 unexploitable. This is a Type A1 case: the INPUT type (serialized objects from network sockets) is not received anywhere in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5645" }, "impact_statement": "Apache Log4j2 version 2.25.2 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server classes (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that receive and deserialize log events from network connections were removed from this repository in April 2017 (commit 8865124fb1) and moved to the separate apache/logging-log4j-tools repository. The target version does not contain any code that receives serialized Java objects over network sockets, making the attack vector described in CVE-2017-5645 unexploitable. This is a Type A1 case: the INPUT type (serialized objects from network sockets) is not received anywhere in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1" } } ], "timestamp": "2026-11-01T04:50:00.399992+00:00", "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2020-9488 is not affecting the target. The vulnerability concerned the lack of SSL/TLS hostname verification capability in the SMTP appender prior to Apache Log4j 2.13.2. The fix (commit 6851b5083e, authored by Matt Sicker) was included in the upstream 2.13.2 release and is present in target version 2.25.2. The fix adds a configurable `verifyHostName` option that enables JavaMail hostname v...", "vulnerability": { "name": "CVE-2020-9488" }, "impact_statement": "not_affected \u2014 CVE-2020-9488 is not affecting the target. The vulnerability concerned the lack of SSL/TLS hostname verification capability in the SMTP appender prior to Apache Log4j 2.13.2. The fix (commit 6851b5083e, authored by Matt Sicker) was included in the upstream 2.13.2 release and is present in target version 2.25.2. The fix adds a configurable `verifyHostName` option that enables JavaMail hostname v..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1" } } ], "timestamp": "2026-11-03T12:11:56.518932+00:00", "status_notes": "Vulnerability CVE-2021-44228 does not affect version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-core. Target version 2.25.2 is not affected by CVE-2021-44228 (Log4Shell). The upstream Apache Log4j project included multiple comprehensive fixes in versions 2.15.0 and 2.16.0+ that were already present when version 2.25.2 was released. The target contains four defense layers: (1) JNDI disabled by default requiring explicit opt-in via log4j2.enableJndiLookup=true, (2) JndiLookup constructor validation, (3) JndiManager.lookup() restricts URI schemes to 'java' only (blocks ldap/ldaps entirely), and (4) message lookups disabled by default. These protections were authored by upstream Apache committers (Ralph Goers) and shipped in the upstream release before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44228" }, "impact_statement": "Target version 2.25.2 is not affected by CVE-2021-44228 (Log4Shell). The upstream Apache Log4j project included multiple comprehensive fixes in versions 2.15.0 and 2.16.0+ that were already present when version 2.25.2 was released. The target contains four defense layers: (1) JNDI disabled by default requiring explicit opt-in via log4j2.enableJndiLookup=true, (2) JndiLookup constructor validation, (3) JndiManager.lookup() restricts URI schemes to 'java' only (blocks ldap/ldaps entirely), and (4) message lookups disabled by default. These protections were authored by upstream Apache committers (Ralph Goers) and shipped in the upstream release before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1" } } ], "timestamp": "2026-10-31T12:51:01.814059+00:00", "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2021-44832 is NOT present in the target Apache Log4j2 version 2.25.2. The upstream vendor fix (commit 05db5f95) was already included in the upstream release that TuxCare onboarded. The fix adds two defenses: (1) requires explicit opt-in via system property log4j2.enableJndiJdbc=true (disabled by default), and (2) validates JNDI URIs to allow only the \"java:\" protocol scheme, rejecting ldap:...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44832" }, "impact_statement": "not_affected \u2014 CVE-2021-44832 is NOT present in the target Apache Log4j2 version 2.25.2. The upstream vendor fix (commit 05db5f95) was already included in the upstream release that TuxCare onboarded. The fix adds two defenses: (1) requires explicit opt-in via system property log4j2.enableJndiJdbc=true (disabled by default), and (2) validates JNDI URIs to allow only the \"java:\" protocol scheme, rejecting ldap:..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1" } } ], "timestamp": "2026-11-03T12:08:14.959299+00:00", "status_notes": "Vulnerability CVE-2021-45046 does not affect version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-core. Target version 2.25.2 is not affected by CVE-2021-45046. The vulnerability was fixed in upstream Apache Log4j 2.16.0 (December 2021) via commit c362aff473, which disabled JNDI by default. This fix was already present in the upstream 2.25.2 release that TuxCare onboarded. The target implements comprehensive defenses: (1) JndiManager requires explicit opt-in via log4j2.enableJndiLookup=true (defaults to false), (2) JndiLookup constructor throws IllegalStateException if JNDI is not enabled, (3) Interpolator only registers JndiLookup when enabled, (4) JndiManager.lookup() restricts to java: scheme only, and (5) MessagePatternConverter explicitly disables message lookups. The vulnerable pattern (unrestricted JNDI access via MDC/Context lookups) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45046" }, "impact_statement": "Target version 2.25.2 is not affected by CVE-2021-45046. The vulnerability was fixed in upstream Apache Log4j 2.16.0 (December 2021) via commit c362aff473, which disabled JNDI by default. This fix was already present in the upstream 2.25.2 release that TuxCare onboarded. The target implements comprehensive defenses: (1) JndiManager requires explicit opt-in via log4j2.enableJndiLookup=true (defaults to false), (2) JndiLookup constructor throws IllegalStateException if JNDI is not enabled, (3) Interpolator only registers JndiLookup when enabled, (4) JndiManager.lookup() restricts to java: scheme only, and (5) MessagePatternConverter explicitly disables message lookups. The vulnerable pattern (unrestricted JNDI access via MDC/Context lookups) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1" } } ], "timestamp": "2026-10-31T12:36:59.913988+00:00", "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Apache Log4j2 version 2.25.2 is not affected by CVE-2021-45105. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed in upstream release 2.17.0 via commit 806023265f authored by Carter Kozak. The target version 2.25.2 contains this upstream fix, which has evolved into a more sophisticated protection mechanism using the LookupResult interf...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45105" }, "impact_statement": "not_affected \u2014 Apache Log4j2 version 2.25.2 is not affected by CVE-2021-45105. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed in upstream release 2.17.0 via commit 806023265f authored by Carter Kozak. The target version 2.25.2 contains this upstream fix, which has evolved into a more sophisticated protection mechanism using the LookupResult interf..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Apache Log4j 1.x components (Chainsaw and SocketAppender) that deserialize logging events containing deeply nested hashmaps/hashtables, causing memory exhaustion. The target repository is Apache Log4j 2.x (version 2.25.2-tuxcare.2), which uses a fundamentally different architecture without Java object deserialization of logging events. The vulnerable Log4j 1.x components are absent from this codebase. The log4j-1.2-api module is merely a configuration bridge that converts Log4j 1.x configuration to Log4j 2.x components, containing no actual Log4j 1.x implementation code. The CVE explicitly states it affects \"Apache Log4j before 2\" and recommends updating to Log4j 2.x as the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26464" }, "impact_statement": "CVE-2023-26464 affects Apache Log4j 1.x components (Chainsaw and SocketAppender) that deserialize logging events containing deeply nested hashmaps/hashtables, causing memory exhaustion. The target repository is Apache Log4j 2.x (version 2.25.2-tuxcare.2), which uses a fundamentally different architecture without Java object deserialization of logging events. The vulnerable Log4j 1.x components are absent from this codebase. The log4j-1.2-api module is merely a configuration bridge that converts Log4j 1.x configuration to Log4j 2.x components, containing no actual Log4j 1.x implementation code. The CVE explicitly states it affects \"Apache Log4j before 2\" and recommends updating to Log4j 2.x as the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1" } } ], "timestamp": "2026-10-30T10:56:13.682132+00:00", "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2025-68161" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1" } } ], "timestamp": "2026-10-30T10:56:13.682132+00:00", "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34477" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1" } } ], "timestamp": "2026-10-30T10:56:13.682132+00:00", "status_notes": "Vulnerability CVE-2026-34478 is fixed in version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34478" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1" } } ], "timestamp": "2026-10-30T10:56:13.682132+00:00", "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34479" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.2-tuxcare.1" } } ], "timestamp": "2026-11-03T19:49:59.480791+00:00", "status_notes": "Vulnerability CVE-2026-34480 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.25.2-tuxcare.2.", "vulnerability": { "name": "CVE-2026-34480" }, "action_statement": "Vulnerability CVE-2026-34480 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.25.2-tuxcare.2." } ] }