{
  "@id": "urn:uuid:2e0d33b6-db33-4ef3-903c-2ad4ffbdd426",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:17:09.103452+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j. The target Apache Log4j 2.8.2-tuxcare.1 is NOT affected by CVE-2017-5645. The vulnerability was fixed in upstream Apache Log4j 2.8.2 via commit 5dcc192158 (LOG4J2-1863), which introduced FilteredObjectInputStream to validate class names during deserialization. This upstream fix was already present when TuxCare onboarded version 2.8.2, making it part of the base release. The vulnerable pattern (unrestricted ObjectInputStream deserialization in TCP/UDP socket servers) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "The target Apache Log4j 2.8.2-tuxcare.1 is NOT affected by CVE-2017-5645. The vulnerability was fixed in upstream Apache Log4j 2.8.2 via commit 5dcc192158 (LOG4J2-1863), which introduced FilteredObjectInputStream to validate class names during deserialization. This upstream fix was already present when TuxCare onboarded version 2.8.2, making it part of the base release. The vulnerable pattern (unrestricted ObjectInputStream deserialization in TCP/UDP socket servers) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:40:29.426671+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j."
    }
  ]
}