{
  "@id": "urn:uuid:c4c1d0c4-1065-4d08-b34e-99a9f2378eb1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T08:05:00.573920+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T04:46:00.073284+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client. not_affected \u2014 CVE-2020-9488 is not a concern for this version. The fix that enables hostname verification for SMTPS connections was included in upstream Apache Log4j 2.13.2 (via commit 6851b5083e by Matt Sicker) and is present in this 2.18.0 release. The defense code exists in SmtpManager.java:283 where it sets the JavaMail 'checkserveridentity' property to enable hostname validation. However, users must exp...",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 is not a concern for this version. The fix that enables hostname verification for SMTPS connections was included in upstream Apache Log4j 2.13.2 (via commit 6851b5083e by Matt Sicker) and is present in this 2.18.0 release. The defense code exists in SmtpManager.java:283 where it sets the JavaMail 'checkserveridentity' property to enable hostname validation. However, users must exp..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:46:26.915756+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client. not_affected \u2014 The target Apache Log4j2 version 2.18.0-tuxcare.2 is NOT affected by CVE-2021-44832. The vulnerability (unrestricted JNDI protocol URIs in JDBC Appender allowing remote code execution) was fixed in upstream version 2.17.1, and this fix is present in the 2.18.0 release. The fix commit (05db5f9527254632b59aed2a1d78a32c5ab74f16) by Apache committer Gary Gregory was shipped with the upstream releas...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 The target Apache Log4j2 version 2.18.0-tuxcare.2 is NOT affected by CVE-2021-44832. The vulnerability (unrestricted JNDI protocol URIs in JDBC Appender allowing remote code execution) was fixed in upstream version 2.17.1, and this fix is present in the 2.18.0 release. The fix commit (05db5f9527254632b59aed2a1d78a32c5ab74f16) by Apache committer Gary Gregory was shipped with the upstream releas..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:30:58.876712+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client. not_affected \u2014 Target version 2.18.0-tuxcare.2 is not affected by CVE-2021-45105 (uncontrolled recursion from self-referential lookups in Thread Context Map). The vulnerability pattern is not present because the fix was already included in upstream Apache Log4j2 2.18.0, which TuxCare onboarded. Apache refactored the original 2.17.0 fix to use a LookupResult interface where isLookupEvaluationAllowedInValue() d...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 Target version 2.18.0-tuxcare.2 is not affected by CVE-2021-45105 (uncontrolled recursion from self-referential lookups in Thread Context Map). The vulnerability pattern is not present because the fix was already included in upstream Apache Log4j2 2.18.0, which TuxCare onboarded. Apache refactored the original 2.17.0 fix to use a LookupResult interface where isLookupEvaluationAllowedInValue() d..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-12T15:39:00.053055+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client, and is fixed in 2.18.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "action_statement": "Vulnerability CVE-2026-34477 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client, and is fixed in 2.18.0-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:05:00.573920+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client. not_affected \u2014 Version 2.18.0 is NOT AFFECTED by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout migrated from @PluginFactory to @PluginBuilderFactory, causing documented configuration attribute names (newLineEscape, useTlsMessageFormat) to be silently ignored. Version 2.18.0 still uses the factory method pattern where these documented attribute names work correctly, so t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Version 2.18.0 is NOT AFFECTED by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout migrated from @PluginFactory to @PluginBuilderFactory, causing documented configuration attribute names (newLineEscape, useTlsMessageFormat) to be silently ignored. Version 2.18.0 still uses the factory method pattern where these documented attribute names work correctly, so t..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      },
      "action_statement": "Vulnerability CVE-2026-34479 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      },
      "action_statement": "Vulnerability CVE-2026-34480 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.18.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "action_statement": "Vulnerability CVE-2026-49844 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client."
    }
  ]
}