{
  "@id": "urn:uuid:71474a06-d917-46dd-bb24-c09ac188c462",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T07:59:00.096696+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T04:43:00.112738+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web. not_affected \u2014 CVE-2020-9488 concerns improper hostname verification in Log4j's SMTP appender when using SMTPS, allowing MITM attacks to intercept log messages. The fix adds SSL configuration support with a verifyHostName attribute that enables JavaMail's hostname verification via the mail.smtps.ssl.checkserveridentity property. The target repository (version 2.17.1-tuxcare.4, SHA 7fab1fe26e) already contains...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 concerns improper hostname verification in Log4j's SMTP appender when using SMTPS, allowing MITM attacks to intercept log messages. The fix adds SSL configuration support with a verifyHostName attribute that enables JavaMail's hostname verification via the mail.smtps.ssl.checkserveridentity property. The target repository (version 2.17.1-tuxcare.4, SHA 7fab1fe26e) already contains..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:46:08.848861+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web. not_affected \u2014 The target repository (Apache Log4j2 version 2.17.1) is NOT AFFECTED by CVE-2021-44832. The vulnerability pattern described in the CVE\u2014where a JDBC Appender with a JNDI datasource URI can be exploited for remote code execution\u2014is not present in this version. The upstream Apache fix (commit 05db5f9527) that addresses this vulnerability was already included in the upstream 2.17.1 release, which T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 The target repository (Apache Log4j2 version 2.17.1) is NOT AFFECTED by CVE-2021-44832. The vulnerability pattern described in the CVE\u2014where a JDBC Appender with a JNDI datasource URI can be exploited for remote code execution\u2014is not present in this version. The upstream Apache fix (commit 05db5f9527) that addresses this vulnerability was already included in the upstream 2.17.1 release, which T..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:32:16.664374+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web. not_affected \u2014 CVE-2021-45105 affects Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) and was fixed in 2.17.0 and 2.12.3. The target version is 2.17.1-tuxcare.4, which already contains the upstream fix. The fix introduces two StrSubstitutor subclasses: ConfigurationStrSubstitutor (allows recursive lookup evaluation for config parsing) and RuntimeStrSubstitutor (blocks recursive evaluation ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-45105 affects Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) and was fixed in 2.17.0 and 2.12.3. The target version is 2.17.1-tuxcare.4, which already contains the upstream fix. The fix introduces two StrSubstitutor subclasses: ConfigurationStrSubstitutor (allows recursive lookup evaluation for config parsing) and RuntimeStrSubstitutor (blocks recursive evaluation ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T07:59:00.096696+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web. not_affected \u2014 Target version 2.17.1 is NOT AFFECTED by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 during a builder pattern migration that accidentally renamed security-relevant configuration attributes (newLineEscape\u2192escapeNL, useTlsMessageFormat\u2192useTLSMessageFormat). Version 2.17.1 predates this refactoring, uses the factory method pattern, and has the correct documented attribute na...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Target version 2.17.1 is NOT AFFECTED by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 during a builder pattern migration that accidentally renamed security-relevant configuration attributes (newLineEscape\u2192escapeNL, useTlsMessageFormat\u2192useTLSMessageFormat). Version 2.17.1 predates this refactoring, uses the factory method pattern, and has the correct documented attribute na..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web, and is fixed in 2.17.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      },
      "action_statement": "Vulnerability CVE-2026-34479 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web, and is fixed in 2.17.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web, and is fixed in 2.17.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      },
      "action_statement": "Vulnerability CVE-2026-34480 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web, and is fixed in 2.17.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.17.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "action_statement": "Vulnerability CVE-2026-49844 affects version 2.17.1-tuxcare.2 of org.apache.logging.log4j:log4j-web."
    }
  ]
}