{
  "@id": "urn:uuid:20a6f500-64f3-4d88-8ae7-9f0fff1862cd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T06:01:54.373948+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.25.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.25.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T06:01:54.373948+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.25.2-tuxcare.3 of org.apache.logging.log4j:log4j. Apache Log4j2 version 2.25.2 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server classes (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that receive and deserialize log events from network connections were removed from this repository in April 2017 (commit 8865124fb1) and moved to the separate apache/logging-log4j-tools repository. The target version does not contain any code that receives serialized Java objects over network sockets, making the attack vector described in CVE-2017-5645 unexploitable. This is a Type A1 case: the INPUT type (serialized objects from network sockets) is not received anywhere in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "Apache Log4j2 version 2.25.2 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server classes (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that receive and deserialize log events from network connections were removed from this repository in April 2017 (commit 8865124fb1) and moved to the separate apache/logging-log4j-tools repository. The target version does not contain any code that receives serialized Java objects over network sockets, making the attack vector described in CVE-2017-5645 unexploitable. This is a Type A1 case: the INPUT type (serialized objects from network sockets) is not received anywhere in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.25.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.25.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T06:01:54.373948+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.25.2-tuxcare.3 of org.apache.logging.log4j:log4j. not_affected \u2014 CVE-2020-9488 is not affecting the target. The vulnerability concerned the lack of SSL/TLS hostname verification capability in the SMTP appender prior to Apache Log4j 2.13.2. The fix (commit 6851b5083e, authored by Matt Sicker) was included in the upstream 2.13.2 release and is present in target version 2.25.2. The fix adds a configurable `verifyHostName` option that enables JavaMail hostname v...",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 is not affecting the target. The vulnerability concerned the lack of SSL/TLS hostname verification capability in the SMTP appender prior to Apache Log4j 2.13.2. The fix (commit 6851b5083e, authored by Matt Sicker) was included in the upstream 2.13.2 release and is present in target version 2.25.2. The fix adds a configurable `verifyHostName` option that enables JavaMail hostname v..."
    }
  ]
}