{
  "@id": "urn:uuid:8be29264-55f6-4a7e-bf79-0d3eda6e9a30",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T13:16:00.156694+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:33:19.700587+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. The target Apache Log4j 2.8.2-tuxcare.1 is NOT affected by CVE-2017-5645. The vulnerability was fixed in upstream Apache Log4j 2.8.2 via commit 5dcc192158 (LOG4J2-1863), which introduced FilteredObjectInputStream to validate class names during deserialization. This upstream fix was already present when TuxCare onboarded version 2.8.2, making it part of the base release. The vulnerable pattern (unrestricted ObjectInputStream deserialization in TCP/UDP socket servers) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "The target Apache Log4j 2.8.2-tuxcare.1 is NOT affected by CVE-2017-5645. The vulnerability was fixed in upstream Apache Log4j 2.8.2 via commit 5dcc192158 (LOG4J2-1863), which introduced FilteredObjectInputStream to validate class names during deserialization. This upstream fix was already present when TuxCare onboarded version 2.8.2, making it part of the base release. The vulnerable pattern (unrestricted ObjectInputStream deserialization in TCP/UDP socket servers) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:33:19.700587+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T13:16:00.156694+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core, and is fixed in 2.8.2-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core, and is fixed in 2.8.2-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:33:19.700587+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 affects version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "action_statement": "Vulnerability CVE-2021-44832 affects version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:33:19.700587+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:33:19.700587+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 affects version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "action_statement": "Vulnerability CVE-2021-45105 affects version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Apache Log4j 1.x when using SocketAppender or Chainsaw components on JRE < 1.7. This repository is Apache Log4j 2.8.2, which is a complete architectural rewrite that does not contain the vulnerable Log4j 1.x components. The log4j-1.2-api compatibility module provides only basic API interfaces and does not include SocketAppender or Chainsaw implementations. Additionally, Log4j 2.8.2 requires Java 7+, while the CVE affects JRE < 1.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "impact_statement": "CVE-2023-26464 affects Apache Log4j 1.x when using SocketAppender or Chainsaw components on JRE < 1.7. This repository is Apache Log4j 2.8.2, which is a complete architectural rewrite that does not contain the vulnerable Log4j 1.x components. The log4j-1.2-api compatibility module provides only basic API interfaces and does not include SocketAppender or Chainsaw implementations. Additionally, Log4j 2.8.2 requires Java 7+, while the CVE affects JRE < 1.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:33:19.700587+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:33:19.700587+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 does not affect version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.8.2 is not affected by CVE-2026-34477. This CVE addresses the `verifyHostName` XML configuration attribute being silently ignored in Log4j Core versions 2.12.0 through 2.25.3. Version 2.8.2 (released April 2, 2017) predates the introduction of this configuration attribute entirely - the hostname verification feature was first added in May 2017 (LOG4J2-1442) and further developed in 2....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "impact_statement": "not_affected \u2014 Version 2.8.2 is not affected by CVE-2026-34477. This CVE addresses the `verifyHostName` XML configuration attribute being silently ignored in Log4j Core versions 2.12.0 through 2.25.3. Version 2.8.2 (released April 2, 2017) predates the introduction of this configuration attribute entirely - the hostname verification feature was first added in May 2017 (LOG4J2-1442) and further developed in 2...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:33:19.700587+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.8.2 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from factory method to builder pattern, inadvertently renaming security-relevant configuration attributes (newLineEscape\u2192escapeNL, useTlsMessageFormat\u2192useTLSMessageFormat, etc.). This caused user configurations using documented names to be silently ignored, leaving...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Version 2.8.2 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from factory method to builder pattern, inadvertently renaming security-relevant configuration attributes (newLineEscape\u2192escapeNL, useTlsMessageFormat\u2192useTLSMessageFormat, etc.). This caused user configurations using documented names to be silently ignored, leaving..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:33:58.528536+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:33:19.700587+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.8.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    }
  ]
}