{
  "@id": "urn:uuid:da339bca-e7b4-4189-ba20-1d9c9a6d22bc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:02:00.202619+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.17.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.17.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.17.0-tuxcare.1 of org.apache.logging.log4j:log4j. Target version 2.17.0-tuxcare.1 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accept serialized log events do not exist in this version. The upstream vendor applied the fix in commit 5dcc192158 (March 2017, version 2.8.2), then removed the entire socket server module in commit 8865124fb1 (April 2017). Both changes were shipped in the upstream release 2.17.0 that TuxCare onboarded. The attack vector requires \"serialized binary data sent to TCP or UDP socket server\" but these servers are absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "Target version 2.17.0-tuxcare.1 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accept serialized log events do not exist in this version. The upstream vendor applied the fix in commit 5dcc192158 (March 2017, version 2.8.2), then removed the entire socket server module in commit 8865124fb1 (April 2017). Both changes were shipped in the upstream release 2.17.0 that TuxCare onboarded. The attack vector requires \"serialized binary data sent to TCP or UDP socket server\" but these servers are absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.17.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.17.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T03:20:00.438931+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.17.0-tuxcare.1 of org.apache.logging.log4j:log4j. not_affected \u2014 The target Apache Log4j 2.17.0-tuxcare.1 is NOT AFFECTED by CVE-2020-9488. The upstream vendor fix for hostname verification in SMTP appender was already present in Apache Log4j 2.17.0 before TuxCare onboarded it. The fix (commit 6851b5083ef9610bae320bf07e1f24d2aa08851b by Matt Sicker) adds SSL configuration support to SmtpAppender with the ability to enable TLS hostname verification via the ve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 The target Apache Log4j 2.17.0-tuxcare.1 is NOT AFFECTED by CVE-2020-9488. The upstream vendor fix for hostname verification in SMTP appender was already present in Apache Log4j 2.17.0 before TuxCare onboarded it. The fix (commit 6851b5083ef9610bae320bf07e1f24d2aa08851b by Matt Sicker) adds SSL configuration support to SmtpAppender with the ability to enable TLS hostname verification via the ve..."
    }
  ]
}