{
  "@id": "urn:uuid:ccbcd35b-2c16-485b-91a4-e0bd6416f67e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:17:09.103452+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j. CVE-2017-5645 affects Apache Log4j 2.x versions before 2.8.2 due to unsafe deserialization in TcpSocketServer and UdpSocketServer. The target version 2.10.0 is not affected because the entire log4j-server module (containing the vulnerable socket server classes) was moved to the Apache Tools repository by upstream developers before version 2.10.0 was released. The socket server functionality does not exist in this codebase, so the vulnerability's input path (serialized log events received over TCP/UDP sockets) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "CVE-2017-5645 affects Apache Log4j 2.x versions before 2.8.2 due to unsafe deserialization in TcpSocketServer and UdpSocketServer. The target version 2.10.0 is not affected because the entire log4j-server module (containing the vulnerable socket server classes) was moved to the Apache Tools repository by upstream developers before version 2.10.0 was released. The socket server functionality does not exist in this codebase, so the vulnerability's input path (serialized log events received over TCP/UDP sockets) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:49:28.796962+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j."
    }
  ]
}