{ "@id": "urn:uuid:92876bbe-628d-41f9-93f9-2852e1751ac2", "role": "Document Creator", "author": "https://tuxcare.com", "version": 10, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:04:11.456857+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare" } } ], "timestamp": "2026-11-04T09:02:00.202619+00:00", "status_notes": "Vulnerability CVE-2017-5929 does not affect version 1.2.13.tuxcare of ch.qos.logback:logback-core. CVE-2017-5929 deserialization vulnerability is NOT present in logback 1.2.13. The fix (HardenedObjectInputStream with class whitelisting) was introduced in upstream release 1.2.0 by ceki@qos.ch and is present in the target. All vulnerable deserialization entry points (SocketNode in logback-classic and logback-access, RemoteAppenderStreamClient) use hardened streams instead of plain ObjectInputStream. No plain ObjectInputStream usage remains in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5929" }, "impact_statement": "CVE-2017-5929 deserialization vulnerability is NOT present in logback 1.2.13. The fix (HardenedObjectInputStream with class whitelisting) was introduced in upstream release 1.2.0 by ceki@qos.ch and is present in the target. All vulnerable deserialization entry points (SocketNode in logback-classic and logback-access, RemoteAppenderStreamClient) use hardened streams instead of plain ObjectInputStream. No plain ObjectInputStream usage remains in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare" } } ], "timestamp": "2026-11-02T18:01:00.202910+00:00", "status_notes": "Vulnerability CVE-2021-42550 does not affect version 1.2.13.tuxcare of ch.qos.logback:logback-core. not_affected \u2014 CVE-2021-42550 is NOT present in logback 1.2.13-tuxcare.2. The target contains an upstream fix (commit e612536f8 by Michael Osipov) that restricts JNDI lookups to the \"java:\" namespace only, preventing connections to attacker-controlled LDAP/RMI servers. This fix was already present in the upstream release that TuxCare onboarded, making the vulnerable pattern absent from the shipped version. Al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-42550" }, "impact_statement": "not_affected \u2014 CVE-2021-42550 is NOT present in logback 1.2.13-tuxcare.2. The target contains an upstream fix (commit e612536f8 by Michael Osipov) that restricts JNDI lookups to the \"java:\" namespace only, preventing connections to attacker-controlled LDAP/RMI servers. This fix was already present in the upstream release that TuxCare onboarded, making the vulnerable pattern absent from the shipped version. Al..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare" } } ], "timestamp": "2026-11-03T11:58:00.062525+00:00", "status_notes": "Vulnerability CVE-2023-6378 does not affect version 1.2.13.tuxcare of ch.qos.logback:logback-core. CVE-2023-6378 is not present in target version 1.2.13. The upstream fix commit bb095154be011267b64e37a1d401546e7cc2b7c3 (authored by ceki@qos.ch) was already included in the upstream release before TuxCare onboarding. Both defense mechanisms are present: (1) LoggingEventVO.readObject() validates array lengths before allocation, rejecting negative or oversized values, and (2) HardenedObjectInputStream installs JVM-level deserialization filters limiting array size (10000) and object graph depth (16). The vulnerable pattern (unbounded array allocation during deserialization) has been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; < 1.2.13), NVD (>= 1.2.0, < 1.2.13; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12), Snyk (< 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-6378" }, "impact_statement": "CVE-2023-6378 is not present in target version 1.2.13. The upstream fix commit bb095154be011267b64e37a1d401546e7cc2b7c3 (authored by ceki@qos.ch) was already included in the upstream release before TuxCare onboarding. Both defense mechanisms are present: (1) LoggingEventVO.readObject() validates array lengths before allocation, rejecting negative or oversized values, and (2) HardenedObjectInputStream installs JVM-level deserialization filters limiting array size (10000) and object graph depth (16). The vulnerable pattern (unbounded array allocation during deserialization) has been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; < 1.2.13), NVD (>= 1.2.0, < 1.2.13; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12), Snyk (< 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2023-6481 does not affect version 1.2.13.tuxcare of ch.qos.logback:logback-core. CVE-2023-6481 affects logback 1.2.12 and earlier. The target is version 1.2.13-tuxcare.2, which already contains the upstream fix from commit bb095154b (2023-12-01, \"fix CVE-2023-6378\"). This commit added ObjectInputFilter with depth=16 and array=10000 limits to both HardenedObjectInputStream constructors, preventing DoS attacks via deeply nested or oversized serialized objects. The fix was included in the upstream v_1.2.13 release (2023-12-01 15:19:53) before TuxCare onboarded it (first TuxCare commit 2025-03-31). All receiver component deserialization flows through HardenedLoggingEventInputStream\u2192HardenedObjectInputStream, ensuring the protection is applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.4.13, < 1.4.14; >= 1.3.13, < 1.3.14; >= 1.2.12, < 1.2.13), NVD (= 1.2.12; = 1.3.13; = 1.4.13), Snyk (< 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14; < 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-6481" }, "impact_statement": "CVE-2023-6481 affects logback 1.2.12 and earlier. The target is version 1.2.13-tuxcare.2, which already contains the upstream fix from commit bb095154b (2023-12-01, \"fix CVE-2023-6378\"). This commit added ObjectInputFilter with depth=16 and array=10000 limits to both HardenedObjectInputStream constructors, preventing DoS attacks via deeply nested or oversized serialized objects. The fix was included in the upstream v_1.2.13 release (2023-12-01 15:19:53) before TuxCare onboarded it (first TuxCare commit 2025-03-31). All receiver component deserialization flows through HardenedLoggingEventInputStream\u2192HardenedObjectInputStream, ensuring the protection is applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.4.13, < 1.4.14; >= 1.3.13, < 1.3.14; >= 1.2.12, < 1.2.13), NVD (= 1.2.12; = 1.3.13; = 1.4.13), Snyk (< 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14; < 1.2.13; >= 1.3.0, < 1.3.14; >= 1.4.0, < 1.4.14)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12798 is fixed in version 1.2.13.tuxcare of ch.qos.logback:logback-core.", "vulnerability": { "name": "CVE-2024-12798" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12801 is fixed in version 1.2.13.tuxcare of ch.qos.logback:logback-core.", "vulnerability": { "name": "CVE-2024-12801" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11226 affects version 1.2.13.tuxcare of ch.qos.logback:logback-core, and is fixed in 1.2.13-tuxcare.1.", "vulnerability": { "name": "CVE-2025-11226" }, "action_statement": "Vulnerability CVE-2025-11226 affects version 1.2.13.tuxcare of ch.qos.logback:logback-core, and is fixed in 1.2.13-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare" } } ], "timestamp": "2026-10-22T18:20:00.759822+00:00", "status_notes": "Vulnerability CVE-2026-10532 affects version 1.2.13.tuxcare of ch.qos.logback:logback-core, and is fixed in 1.2.13-tuxcare.2.", "vulnerability": { "name": "CVE-2026-10532" }, "action_statement": "Vulnerability CVE-2026-10532 affects version 1.2.13.tuxcare of ch.qos.logback:logback-core, and is fixed in 1.2.13-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare" } } ], "timestamp": "2026-10-22T18:19:00.193454+00:00", "status_notes": "Vulnerability CVE-2026-1225 affects version 1.2.13.tuxcare of ch.qos.logback:logback-core, and is fixed in 1.2.13-tuxcare.2.", "vulnerability": { "name": "CVE-2026-1225" }, "action_statement": "Vulnerability CVE-2026-1225 affects version 1.2.13.tuxcare of ch.qos.logback:logback-core, and is fixed in 1.2.13-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare", "identifiers": { "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.13.tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9828 affects version 1.2.13.tuxcare of ch.qos.logback:logback-core.", "vulnerability": { "name": "CVE-2026-9828" }, "action_statement": "Vulnerability CVE-2026-9828 affects version 1.2.13.tuxcare of ch.qos.logback:logback-core." } ] }