{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dc58c677-b33d-5842-b2ca-b53340530917", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "logback-core", "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.12-tuxcare.2", "type": "library", "group": "ch.qos.logback", "bom-ref": "pkg:maven/ch.qos.logback/logback-core@1.2.12-tuxcare.2", "version": "1.2.12-tuxcare.2", "pedigree": { "ancestors": [ { "name": "logback-core", "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.12", "type": "library", "group": "ch.qos.logback", "version": "1.2.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5929", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:c9b57064-d485-5060-b8df-dfd787d8bc7c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5929 does not affect version 1.2.12-tuxcare.2 of ch.qos.logback:logback-core. The target (logback 1.2.12-tuxcare.2) is not affected by CVE-2017-5929. The upstream vendor (QOS.ch) fixed this deserialization vulnerability in version 1.2.0 by replacing all ObjectInputStream usage with HardenedObjectInputStream subclasses that enforce whitelist-based class filtering. The fix commit (f46044b805...) was already present in the upstream 1.2.12 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix predates the first TuxCare commit (822fed60e \"Onboard version 1.2.12\"). All vulnerable components mentioned in the CVE (SocketNode classic/access, ServerSocketReceiver, RemoteAppenderStreamClient) now use hardened deserialization streams that reject unauthorized classes via InvalidClassException.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11).", "justification": "code_not_present" } }, { "id": "CVE-2021-42550", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:ffce87c0-d8fb-55de-a04a-0240d9a98355", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42550 does not affect version 1.2.12-tuxcare.2 of ch.qos.logback:logback-core. not_affected \u2014 CVE-2021-42550 affects logback 1.2.7 and prior versions, allowing arbitrary code execution via malicious JNDI lookups in configuration files. The target (logback 1.2.12-tuxcare.2) contains the upstream security fix (commit e612536f8) that restricts JNDI lookups to the \"java:\" namespace, blocking remote LDAP/RMI attacks. This fix was authored by Michael Osipov and shipped in upstream logback 1.2...", "justification": "code_not_present" } }, { "id": "CVE-2023-6378", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:73ef9130-833a-533a-b980-6c2135543665", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-6378 affects version 1.2.12-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2023-6481", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:bd347d69-c719-556e-bae9-05b7e88ddeb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-6481 affects version 1.2.12-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2024-12798", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:19560cd4-cf97-5f7d-9890-b43181340b26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-12798 is fixed in version 1.2.12-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2024-12801", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:d18e50c4-20c1-52b4-9f77-b1471965e8b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-12801 is fixed in version 1.2.12-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2025-11226", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:e678b8cf-c1be-5b43-8d00-5e034d221dc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11226 is fixed in version 1.2.12-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-10532", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:1f6d2fdb-72c6-5fb6-8ffc-730416130b02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10532 is fixed in version 1.2.12-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-1225", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:6ba36d6c-f7b6-5bca-a1fc-1f1b154a3366", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-1225 is fixed in version 1.2.12-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-9828", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:04837a70-bc3d-56a5-a9c1-bb2cc1ec4445", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-9828 affects version 1.2.12-tuxcare.2 of ch.qos.logback:logback-core." } } ], "dependencies": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.12-tuxcare.2" } ] }