{
  "@id": "urn:uuid:1c9a4d51-25bf-411e-82a4-b5bd73d30cf7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T04:45:05.748294+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T04:45:05.748294+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl. not_affected \u2014 CVE-2020-9488 fix for SMTP hostname verification was already present in upstream Apache Log4j 2.21.1 release. The fix (commit 6851b5083e by Matt Sicker, April 2020) adds SSL configuration support and hostname verification capability via mail.smtps.ssl.checkserveridentity property. This commit is an ancestor of TuxCare's onboarding commit 7bbf7f9c41, confirming the fix shipped with the upstream ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 fix for SMTP hostname verification was already present in upstream Apache Log4j 2.21.1 release. The fix (commit 6851b5083e by Matt Sicker, April 2020) adds SSL configuration support and hostname verification capability via mail.smtps.ssl.checkserveridentity property. This commit is an ancestor of TuxCare's onboarding commit 7bbf7f9c41, confirming the fix shipped with the upstream ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:51:01.814059+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl. not_affected \u2014 The target (Log4j2 2.21.1-tuxcare.1) is not affected by CVE-2021-44832. The vulnerability was fixed in upstream version 2.17.1, and the target version 2.21.1 already contains the complete fix from commit 05db5f95 by Gary Gregory. Both required defenses are present: (1) opt-in requirement via log4j2.enableJndiJdbc property (defaults to false), and (2) JNDI URI protocol restriction to \"java:\" sch...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 The target (Log4j2 2.21.1-tuxcare.1) is not affected by CVE-2021-44832. The vulnerability was fixed in upstream version 2.17.1, and the target version 2.21.1 already contains the complete fix from commit 05db5f95 by Gary Gregory. Both required defenses are present: (1) opt-in requirement via log4j2.enableJndiJdbc property (defaults to false), and (2) JNDI URI protocol restriction to \"java:\" sch..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:35:26.110041+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl. not_affected \u2014 CVE-2021-45105 is NOT present in Log4j 2.21.1. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed by upstream Apache in commit 806023265f, which shipped in release 2.17.0 (Dec 2021). Target version 2.21.1 was released in 2024 and contains this fix. The defense mechanism uses LookupResult.isLookupEvaluationAllowedInValue() which defaults...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-45105 is NOT present in Log4j 2.21.1. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed by upstream Apache in commit 806023265f, which shipped in release 2.17.0 (Dec 2021). Target version 2.21.1 was released in 2024 and contains this fix. The defense mechanism uses LookupResult.isLookupEvaluationAllowedInValue() which defaults..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T22:12:07.346782+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T22:11:24.666700+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 affects version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "action_statement": "Vulnerability CVE-2026-34477 affects version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T22:11:24.666700+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl. not_affected \u2014 Version 2.21.1 is NOT affected by CVE-2026-34478. The vulnerability requires the builder pattern to be activated via @PluginBuilderFactory (introduced in version 2.25.0), which only recognized alias attribute names (includeNL, escapeNL, useTLSMessageFormat) and ignored documented names (newLine, newLineEscape, useTlsMessageFormat). In version 2.21.1, the @PluginFactory method remains the active...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Version 2.21.1 is NOT affected by CVE-2026-34478. The vulnerability requires the builder pattern to be activated via @PluginBuilderFactory (introduced in version 2.25.0), which only recognized alias attribute names (includeNL, escapeNL, useTLSMessageFormat) and ignored documented names (newLine, newLineEscape, useTlsMessageFormat). In version 2.21.1, the @PluginFactory method remains the active..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T22:12:07.346782+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T22:11:24.666700+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 affects version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      },
      "action_statement": "Vulnerability CVE-2026-34480 affects version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.21.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T22:12:07.346782+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 is fixed in version 2.21.1-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j2-impl.",
      "vulnerability": {
        "name": "CVE-2026-49844"
      }
    }
  ]
}