{
  "@id": "urn:uuid:14c44e76-e999-45e1-af6b-75950ad85148",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T08:04:00.108193+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T04:46:00.073284+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 CVE-2020-9488 is not present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability concerning improper SSL/TLS hostname verification in the SMTP appender was fixed by upstream commit 6851b5083e (LOG4J2-2819) authored by Matt Sicker, which was already included in the upstream Apache Log4j 2.20.0 release that TuxCare onboarded. The fix adds SslConfiguration support with a verifyHostName parameter t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 is not present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability concerning improper SSL/TLS hostname verification in the SMTP appender was fixed by upstream commit 6851b5083e (LOG4J2-2819) authored by Matt Sicker, which was already included in the upstream Apache Log4j 2.20.0 release that TuxCare onboarded. The fix adds SslConfiguration support with a verifyHostName parameter t..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:50:32.466749+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 CVE-2021-44832 is NOT present in this target. The vulnerability affects Apache Log4j2 versions 2.0-beta7 through 2.17.0, allowing RCE via JDBC Appender with malicious JNDI URI data sources. The target (version 2.20.0-tuxcare.3) contains the complete upstream fix from commit 05db5f9527, which was included in upstream 2.20.0 release. Both defense layers are present: (1) JNDI JDBC disabled by defa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-44832 is NOT present in this target. The vulnerability affects Apache Log4j2 versions 2.0-beta7 through 2.17.0, allowing RCE via JDBC Appender with malicious JNDI URI data sources. The target (version 2.20.0-tuxcare.3) contains the complete upstream fix from commit 05db5f9527, which was included in upstream 2.20.0 release. Both defense layers are present: (1) JNDI JDBC disabled by defa..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:36:25.736244+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 CVE-2021-45105 is not present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability was fixed in upstream Apache Log4j 2.17.0 (commit 806023265f, December 2021) and later refactored in 2.17.1 (commit 17a77f5c27, January 2022). Both commits were already present in the Apache Log4j 2.20.0 upstream release before TuxCare onboarded it. The fix prevents uncontrolled recursion from self-referential loo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-45105 is not present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability was fixed in upstream Apache Log4j 2.17.0 (commit 806023265f, December 2021) and later refactored in 2.17.1 (commit 17a77f5c27, January 2022). Both commits were already present in the Apache Log4j 2.20.0 upstream release before TuxCare onboarded it. The fix prevents uncontrolled recursion from self-referential loo..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T19:20:00.402138+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T19:20:00.402138+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T08:04:00.108193+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 Version 2.20.0 is not affected by CVE-2026-34478. The vulnerability was introduced in version 2.24.0 when Rfc5424Layout migrated from @PluginFactory to @PluginBuilderFactory. In 2.20.0, the plugin system still uses @PluginFactory with the correct documented attribute names (newLineEscape, useTlsMessageFormat, etc.), so user configurations work correctly.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Version 2.20.0 is not affected by CVE-2026-34478. The vulnerability was introduced in version 2.24.0 when Rfc5424Layout migrated from @PluginFactory to @PluginBuilderFactory. In 2.20.0, the plugin system still uses @PluginFactory with the correct documented attribute names (newLineEscape, useTlsMessageFormat, etc.), so user configurations work correctly."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T19:20:00.402138+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T19:18:49.373232+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      },
      "action_statement": "Vulnerability CVE-2026-34480 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T19:20:00.402138+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 is fixed in version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-49844"
      }
    }
  ]
}