{
  "@id": "urn:uuid:d5a07402-7ac4-45ea-a74a-fd804946e3b2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T17:45:23.648147+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:45:23.648147+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j. The target repository (Apache Log4j 2.9.1) is not affected by CVE-2017-5645. The vulnerable server components (TcpSocketServer, UdpSocketServer) that receive and deserialize objects over TCP/UDP sockets were completely removed from the codebase before the 2.9.1 release. Git history shows these components were moved to a separate Tools repository in commit 8865124fb1, which is an ancestor of both the upstream 2.9.1 release tag (fc3104171c) and the current HEAD. The input handler for serialized objects over network sockets does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "The target repository (Apache Log4j 2.9.1) is not affected by CVE-2017-5645. The vulnerable server components (TcpSocketServer, UdpSocketServer) that receive and deserialize objects over TCP/UDP sockets were completely removed from the codebase before the 2.9.1 release. Git history shows these components were moved to a separate Tools repository in commit 8865124fb1, which is an ancestor of both the upstream 2.9.1 release tag (fc3104171c) and the current HEAD. The input handler for serialized objects over network sockets does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:45:23.648147+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j."
    }
  ]
}