{
  "@id": "urn:uuid:603857fb-80ab-4fa3-95ab-721f88f6c31d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:13:29.842653+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.17.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.17.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:13:29.842653+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.17.1-tuxcare.3 of org.apache.logging.log4j:log4j. Version 2.17.1 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that receive and deserialize log events from remote clients do not exist in this version. Upstream removed these components entirely in April 2017 (commit 8865124fb1), years before version 2.17.1 was released in December 2021. The fix (FilteredObjectInputStream for deserialization class whitelisting) was applied by upstream in March 2017 (commit 5dcc192158), and both changes were already in the upstream 2.17.1 release before TuxCare onboarded it (commit 655616ca35).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "Version 2.17.1 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that receive and deserialize log events from remote clients do not exist in this version. Upstream removed these components entirely in April 2017 (commit 8865124fb1), years before version 2.17.1 was released in December 2021. The fix (FilteredObjectInputStream for deserialization class whitelisting) was applied by upstream in March 2017 (commit 5dcc192158), and both changes were already in the upstream 2.17.1 release before TuxCare onboarded it (commit 655616ca35).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.17.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.17.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T04:43:00.112738+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.17.1-tuxcare.3 of org.apache.logging.log4j:log4j. not_affected \u2014 CVE-2020-9488 concerns improper hostname verification in Log4j's SMTP appender when using SMTPS, allowing MITM attacks to intercept log messages. The fix adds SSL configuration support with a verifyHostName attribute that enables JavaMail's hostname verification via the mail.smtps.ssl.checkserveridentity property. The target repository (version 2.17.1-tuxcare.4, SHA 7fab1fe26e) already contains...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 concerns improper hostname verification in Log4j's SMTP appender when using SMTPS, allowing MITM attacks to intercept log messages. The fix adds SSL configuration support with a verifyHostName attribute that enables JavaMail's hostname verification via the mail.smtps.ssl.checkserveridentity property. The target repository (version 2.17.1-tuxcare.4, SHA 7fab1fe26e) already contains..."
    }
  ]
}