{
  "@id": "urn:uuid:c8fc6907-0a5d-42ec-9ba0-7f42b5df8119",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T09:24:48.531970+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.13.3-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.13.3-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T09:24:48.531970+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.13.3-tuxcare.4 of org.apache.logging.log4j:log4j. CVE-2017-5645 is not present in Apache Log4j 2.13.3. The vulnerable TCP and UDP socket server components that would deserialize untrusted log events were removed from the main repository in commit 8865124fb1 (April 2017) and moved to a separate Tools repository. Additionally, the upstream fix (commit 5dcc192158 adding FilteredObjectInputStream class filtering) was already included in the upstream release before TuxCare onboarded version 2.13.3. The target repository no longer contains any code path that receives serialized Java objects over TCP/UDP socket servers for deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "CVE-2017-5645 is not present in Apache Log4j 2.13.3. The vulnerable TCP and UDP socket server components that would deserialize untrusted log events were removed from the main repository in commit 8865124fb1 (April 2017) and moved to a separate Tools repository. Additionally, the upstream fix (commit 5dcc192158 adding FilteredObjectInputStream class filtering) was already included in the upstream release before TuxCare onboarded version 2.13.3. The target repository no longer contains any code path that receives serialized Java objects over TCP/UDP socket servers for deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.13.3-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.13.3-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T09:24:48.531970+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.13.3-tuxcare.4 of org.apache.logging.log4j:log4j. not_affected \u2014 CVE-2020-9488 is not applicable to this target. The vulnerability concerns improper hostname verification in the SMTP appender's SMTPS connections, allowing man-in-the-middle attacks. The fix (adding verifyHostName configuration and setting mail.smtps.ssl.checkserveridentity property) was introduced in upstream Apache Log4j 2.13.2 by Matt Sicker (commit 6851b5083e). This target is version 2.13....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 is not applicable to this target. The vulnerability concerns improper hostname verification in the SMTP appender's SMTPS connections, allowing man-in-the-middle attacks. The fix (adding verifyHostName configuration and setting mail.smtps.ssl.checkserveridentity property) was introduced in upstream Apache Log4j 2.13.2 by Matt Sicker (commit 6851b5083e). This target is version 2.13...."
    }
  ]
}