{
  "@id": "urn:uuid:761f203d-1759-40ee-9183-293ab923aaef",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:13:29.842653+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.11.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.11.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:13:29.842653+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.11.0-tuxcare.2 of org.apache.logging.log4j:log4j. Target version 2.11.0 is not affected by CVE-2017-5645. The vulnerable socket server components (TcpSocketServer and UdpSocketServer) that accepted serialized log events over network connections were completely removed from the main Log4j repository in version 2.10.0 (commit 8865124fb1, April 2017). These components were moved to a separate Tools repository. Version 2.11.0 does not contain any network server code that receives and deserializes data, making the attack vector impossible. The upstream fix (FilteredObjectInputStream) was applied in version 2.8.2 (commit 5dcc192158, March 2017) before the components were removed, but the complete removal provides even stronger protection. The fix was authored by upstream (Matt Sicker, boards@gmail.com) and shipped in the upstream release before TuxCare started maintaining this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "Target version 2.11.0 is not affected by CVE-2017-5645. The vulnerable socket server components (TcpSocketServer and UdpSocketServer) that accepted serialized log events over network connections were completely removed from the main Log4j repository in version 2.10.0 (commit 8865124fb1, April 2017). These components were moved to a separate Tools repository. Version 2.11.0 does not contain any network server code that receives and deserializes data, making the attack vector impossible. The upstream fix (FilteredObjectInputStream) was applied in version 2.8.2 (commit 5dcc192158, March 2017) before the components were removed, but the complete removal provides even stronger protection. The fix was authored by upstream (Matt Sicker, boards@gmail.com) and shipped in the upstream release before TuxCare started maintaining this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.11.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.11.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-28T18:17:00.210054+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.11.0-tuxcare.2 of org.apache.logging.log4j:log4j.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.11.0-tuxcare.2 of org.apache.logging.log4j:log4j."
    }
  ]
}