{
  "@id": "urn:uuid:94b548e6-6320-40ff-84ca-bcbda6c8fc6b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T17:39:17.624200+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T17:39:17.624200+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core, and is fixed in 2.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core, and is fixed in 2.7-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:55:16.651900+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T12:57:13.162377+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core, and is fixed in 2.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core, and is fixed in 2.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:55:16.651900+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "action_statement": "Vulnerability CVE-2021-44832 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:55:16.651900+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:55:16.651900+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "action_statement": "Vulnerability CVE-2021-45105 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Apache Log4j 1.x on JRE < 1.7 via deserialization of deeply nested HashMap/Hashtable structures causing memory exhaustion. Log4j 2.7-tuxcare.2 is NOT AFFECTED because: (1) CVE explicitly scopes to \"Log4j before 2\" (Log4j 1.x only), (2) Log4j 2.7 requires JRE 1.7+ (maven.compile.source/target=1.7) and cannot run on the vulnerable JRE < 1.7 environment, (3) JRE 1.7+ has built-in protections against hash collision DoS, and (4) Log4j 2.x ThreadContext API restricts context data to String values only (not arbitrary Objects). While ObjectMessage can serialize arbitrary objects, the environmental precondition (JRE < 1.7) is architecturally unreachable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "impact_statement": "CVE-2023-26464 affects Apache Log4j 1.x on JRE < 1.7 via deserialization of deeply nested HashMap/Hashtable structures causing memory exhaustion. Log4j 2.7-tuxcare.2 is NOT AFFECTED because: (1) CVE explicitly scopes to \"Log4j before 2\" (Log4j 1.x only), (2) Log4j 2.7 requires JRE 1.7+ (maven.compile.source/target=1.7) and cannot run on the vulnerable JRE < 1.7 environment, (3) JRE 1.7+ has built-in protections against hash collision DoS, and (4) Log4j 2.x ThreadContext API restricts context data to String values only (not arbitrary Objects). While ObjectMessage can serialize arbitrary objects, the environmental precondition (JRE < 1.7) is architecturally unreachable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:55:16.651900+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:55:16.651900+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 does not affect version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2026-34477 concerns the `verifyHostName` XML attribute of the `<Ssl>` element being silently ignored in Log4j versions 2.12.0 through 2.25.3. The target version 2.7 predates the introduction of this attribute (added in 2.12.0 per CVE description). Version 2.7 has only a 3-parameter factory method `createSSLConfiguration(protocol, keyStoreConfig, trustStoreConfig)` with no `verifyHostName` p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-34477 concerns the `verifyHostName` XML attribute of the `<Ssl>` element being silently ignored in Log4j versions 2.12.0 through 2.25.3. The target version 2.7 predates the introduction of this attribute (added in 2.12.0 per CVE description). Version 2.7 has only a 3-parameter factory method `createSSLConfiguration(protocol, keyStoreConfig, trustStoreConfig)` with no `verifyHostName` p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:55:16.651900+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.7 is not affected by CVE-2026-34478. This vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from the factory method pattern to the builder pattern, causing documented configuration attribute names to be silently renamed. Version 2.7 predates this migration and uses the original factory method pattern where the documented attribute names (newLineEscape, use...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Version 2.7 is not affected by CVE-2026-34478. This vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from the factory method pattern to the builder pattern, causing documented configuration attribute names to be silently renamed. Version 2.7 predates this migration and uses the original factory method pattern where the documented attribute names (newLineEscape, use..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:55:55.429281+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:55:16.651900+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.7-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    }
  ]
}