{
  "@id": "urn:uuid:b56f22ae-ba82-415d-9208-cfc590429883",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. CVE-2017-5645 affects Apache Log4j 2.x versions before 2.8.2 due to unsafe deserialization in TcpSocketServer and UdpSocketServer. The target version 2.10.0 is not affected because the entire log4j-server module (containing the vulnerable socket server classes) was moved to the Apache Tools repository by upstream developers before version 2.10.0 was released. The socket server functionality does not exist in this codebase, so the vulnerability's input path (serialized log events received over TCP/UDP sockets) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "CVE-2017-5645 affects Apache Log4j 2.x versions before 2.8.2 due to unsafe deserialization in TcpSocketServer and UdpSocketServer. The target version 2.10.0 is not affected because the entire log4j-server module (containing the vulnerable socket server classes) was moved to the Apache Tools repository by upstream developers before version 2.10.0 was released. The socket server functionality does not exist in this codebase, so the vulnerability's input path (serialized log events received over TCP/UDP sockets) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:49:28.796962+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T18:07:30.386689+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.10.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.10.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:49:28.796962+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "action_statement": "Vulnerability CVE-2021-44832 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:49:28.796962+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:49:28.796962+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "action_statement": "Vulnerability CVE-2021-45105 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Apache Log4j 1.x (versions before 2.0) with specific vulnerable components (Chainsaw and SocketAppender) that deserialize deeply nested HashMap/Hashtable objects, causing memory exhaustion on JRE < 1.7. The target repository is Apache Log4j 2.10.0-tuxcare.2, which is outside the affected version range. The CVE explicitly states \"before Log4j 2\" as affected versions and recommends upgrading to Log4j 2.x. The vulnerable Log4j 1.x deserialization pattern is not present in Log4j 2.x's architecture - no Chainsaw component exists, and Log4j 2 uses a completely different serialization mechanism (SortedArrayStringMap with flat arrays rather than recursive HashMap/Hashtable deserialization). The log4j-1.2-api module is merely an API compatibility layer that delegates to Log4j 2.x core, not vendored Log4j 1.x code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "impact_statement": "CVE-2023-26464 affects Apache Log4j 1.x (versions before 2.0) with specific vulnerable components (Chainsaw and SocketAppender) that deserialize deeply nested HashMap/Hashtable objects, causing memory exhaustion on JRE < 1.7. The target repository is Apache Log4j 2.10.0-tuxcare.2, which is outside the affected version range. The CVE explicitly states \"before Log4j 2\" as affected versions and recommends upgrading to Log4j 2.x. The vulnerable Log4j 1.x deserialization pattern is not present in Log4j 2.x's architecture - no Chainsaw component exists, and Log4j 2 uses a completely different serialization mechanism (SortedArrayStringMap with flat arrays rather than recursive HashMap/Hashtable deserialization). The log4j-1.2-api module is merely an API compatibility layer that delegates to Log4j 2.x core, not vendored Log4j 1.x code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:49:28.796962+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:43:53.744155+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 does not affect version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Target version 2.10.0 is NOT affected by CVE-2026-34477. The vulnerability concerns the `verifyHostName` XML attribute of the `<Ssl>` element being silently ignored in Log4j versions 2.12.0 through 2.25.3. This attribute was introduced in Log4j Core 2.12.0 and does not exist in version 2.10.0. The target only has the 3-parameter `createSSLConfiguration` factory method without any `verifyHostNam...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "impact_statement": "not_affected \u2014 Target version 2.10.0 is NOT affected by CVE-2026-34477. The vulnerability concerns the `verifyHostName` XML attribute of the `<Ssl>` element being silently ignored in Log4j versions 2.12.0 through 2.25.3. This attribute was introduced in Log4j Core 2.12.0 and does not exist in version 2.10.0. The target only has the 3-parameter `createSSLConfiguration` factory method without any `verifyHostNam..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:07:56.784941+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.10.0 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from a factory method pattern to a builder pattern, causing documented configuration attribute names (newLineEscape, useTlsMessageFormat, etc.) to be silently renamed. Version 2.10.0 predates this architectural change and still uses the factory method pattern with...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Version 2.10.0 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from a factory method pattern to a builder pattern, causing documented configuration attribute names (newLineEscape, useTlsMessageFormat, etc.) to be silently renamed. Version 2.10.0 predates this architectural change and still uses the factory method pattern with..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T18:07:30.386689+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.10.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      },
      "action_statement": "Vulnerability CVE-2026-34479 affects version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.10.0-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:50:08.046667+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.10.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    }
  ]
}