{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d9c9504e-7ce8-5901-9d6e-75f7bccb31e3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "logback-core", "purl": "pkg:maven/ch.qos.logback/logback-core@1.4.14-tuxcare.2", "type": "library", "group": "ch.qos.logback", "bom-ref": "pkg:maven/ch.qos.logback/logback-core@1.4.14-tuxcare.2", "version": "1.4.14-tuxcare.2", "pedigree": { "ancestors": [ { "name": "logback-core", "purl": "pkg:maven/ch.qos.logback/logback-core@1.4.14", "type": "library", "group": "ch.qos.logback", "version": "1.4.14" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5929", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.14-tuxcare.2" } ], "bom-ref": "urn:uuid:17dab979-88f8-5ae6-becf-45b017fb885b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5929 does not affect version 1.4.14-tuxcare.2 of ch.qos.logback:logback-core. CVE-2017-5929 is NOT affecting this target. The vulnerability involves unsafe Java deserialization via ObjectInputStream in SocketNode and related classes, allowing arbitrary code execution. The upstream fix (commit f46044b80 by ceki@qos.ch) was already present in Logback 1.4.14 when TuxCare onboarded it. The fix replaces plain ObjectInputStream with HardenedObjectInputStream, which implements class whitelisting via resolveClass() override and blocks proxy-based bypasses. All network deserialization entry points (SocketNode in logback-classic and logback-access, RemoteAppenderStreamClient) use the hardened streams. The vulnerable pattern (unfiltered deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11).", "justification": "code_not_present" } }, { "id": "CVE-2021-42550", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.14-tuxcare.2" } ], "bom-ref": "urn:uuid:063f9016-bb52-5a8e-aca2-4786f6fd4ee3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42550 does not affect version 1.4.14-tuxcare.2 of ch.qos.logback:logback-core. not_affected \u2014 CVE-2021-42550 affects logback 1.2.7 and prior versions. The target (logback 1.4.14-tuxcare.2) contains the upstream fix that restricts JNDI lookups to the \"java:\" namespace, preventing arbitrary code execution via LDAP/RMI/DNS. The fix (commit 8fb44ca67) was authored by Ceki Gulcu (ceki@qos.ch) on 2021-12-16 and was already present in the upstream 1.4.14 release before TuxCare onboarded it. Al...", "justification": "code_not_present" } }, { "id": "CVE-2023-6378", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.14-tuxcare.2" } ], "bom-ref": "urn:uuid:777ce743-26dc-5cc8-b3ca-4debcfae87fe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-6378 does not affect version 1.4.14-tuxcare.2 of ch.qos.logback:logback-core. The target repository logback version 1.4.14-tuxcare.2 is NOT AFFECTED by CVE-2023-6378. The serialization DoS vulnerability was fixed by upstream commit 9c782b45be4abdafb7e17481e24e7354c2acd1eb authored by Ceki Gulcu (ceki@qos.ch), which was already included in the upstream 1.4.14 release before TuxCare onboarded it. Both LoggingEventVO.java and HardenedObjectInputStream.java contain the complete mitigations at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; < 1.2.13), NVD (>= 1.2.0, < 1.2.13; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12), Snyk (< 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12).", "justification": "code_not_present" } }, { "id": "CVE-2023-6481", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.14-tuxcare.2" } ], "bom-ref": "urn:uuid:c20d5b7a-1cad-55bd-a320-89883f436633", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-6481 does not affect version 1.4.14-tuxcare.2 of ch.qos.logback:logback-core. CVE-2023-6481 affects logback versions 1.4.13, 1.3.13, and 1.2.12 due to missing deserialization filter initialization in HardenedObjectInputStream. The target version 1.4.14 contains the upstream fix (commit 7018a3609) that adds initObjectFilter() calls to both constructors, establishing depth and array limits that prevent DoS attacks via deeply nested serialized objects. This fix was authored by upstream maintainer Ceki Gulcu and shipped in the upstream 1.4.14 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.4.13, < 1.4.14; >= 1.3.13, < 1.3.14; >= 1.2.12, < 1.2.13), NVD (= 1.2.12; = 1.3.13; = 1.4.13), Snyk (< 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14; < 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14).", "justification": "code_not_present" } }, { "id": "CVE-2024-12798", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.14-tuxcare.2" } ], "bom-ref": "urn:uuid:83384b74-1fa9-5934-8935-5e43aadb02be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-12798 is fixed in version 1.4.14-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2024-12801", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.14-tuxcare.2" } ], "bom-ref": "urn:uuid:b6227cf3-0fea-5dc7-9077-beb83e1e99db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-12801 is fixed in version 1.4.14-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2025-11226", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.14-tuxcare.2" } ], "bom-ref": "urn:uuid:21635994-818a-5ac2-996a-d892083af6e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11226 is fixed in version 1.4.14-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-10532", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.14-tuxcare.2" } ], "bom-ref": "urn:uuid:4bd175af-7c04-5a45-9495-b6f6304d8665", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10532 is fixed in version 1.4.14-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-1225", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.14-tuxcare.2" } ], "bom-ref": "urn:uuid:cd8fcc87-4de9-5292-94e7-ef76184bb933", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-1225 is fixed in version 1.4.14-tuxcare.2 of ch.qos.logback:logback-core." } }, { "id": "CVE-2026-9828", "affects": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.14-tuxcare.2" } ], "bom-ref": "urn:uuid:903815b6-864c-55e7-94ab-2059c2071119", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-9828 affects version 1.4.14-tuxcare.2 of ch.qos.logback:logback-core." } } ], "dependencies": [ { "ref": "pkg:maven/ch.qos.logback/logback-core@1.4.14-tuxcare.2" } ] }