{ "@id": "urn:uuid:52ee8e4a-aef0-4a20-bb28-590679a3a3be", "role": "Document Creator", "author": "https://tuxcare.com", "version": 16, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:04:11.456857+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1" } } ], "timestamp": "2026-11-03T12:15:19.421943+00:00", "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core. CVE-2017-5645 describes a Java deserialization vulnerability in Log4j 2.x's TCP and UDP socket servers that accept serialized log events from external sources. The vulnerable components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge, and related server infrastructure) do NOT exist in the target repository. These components were moved to a separate apache/logging-log4j-tools repository in April 2017 (commit 8865124fb1), shortly after the upstream security fix was applied in March 2017 (commit 5dcc192158). The target repository (version 2.12.4-tuxcare.3) onboarded by TuxCare already had both the fix and the subsequent architectural removal in its upstream release. Without the socket server entry points that accept network-delivered serialized data, the attack vector described in the CVE cannot be realized in this codebase. While FilteredObjectInputStream (the fix's defense class) exists in the target, it is only used for internal serialization within the library, not for accepting external network input.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5645" }, "impact_statement": "CVE-2017-5645 describes a Java deserialization vulnerability in Log4j 2.x's TCP and UDP socket servers that accept serialized log events from external sources. The vulnerable components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge, and related server infrastructure) do NOT exist in the target repository. These components were moved to a separate apache/logging-log4j-tools repository in April 2017 (commit 8865124fb1), shortly after the upstream security fix was applied in March 2017 (commit 5dcc192158). The target repository (version 2.12.4-tuxcare.3) onboarded by TuxCare already had both the fix and the subsequent architectural removal in its upstream release. Without the socket server entry points that accept network-delivered serialized data, the attack vector described in the CVE cannot be realized in this codebase. While FilteredObjectInputStream (the fix's defense class) exists in the target, it is only used for internal serialization within the library, not for accepting external network input.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1" } } ], "timestamp": "2026-11-01T04:41:00.175184+00:00", "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 The target repository (version 2.12.4-tuxcare.3, SHA 8621950d2b) is NOT vulnerable to CVE-2020-9488. The fix for hostname verification in SMTPS connections was already present in the upstream Apache Log4j 2.12.4 release that TuxCare onboarded. The defense code (verifyHostName parameter and mail.smtps.ssl.checkserveridentity property) exists in both SslConfiguration.java and SmtpManager.java, pr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9488" }, "impact_statement": "not_affected \u2014 The target repository (version 2.12.4-tuxcare.3, SHA 8621950d2b) is NOT vulnerable to CVE-2020-9488. The fix for hostname verification in SMTPS connections was already present in the upstream Apache Log4j 2.12.4 release that TuxCare onboarded. The defense code (verifyHostName parameter and mail.smtps.ssl.checkserveridentity property) exists in both SslConfiguration.java and SmtpManager.java, pr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2021-44228 does not affect version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core. Target Apache Log4j 2.12.4-tuxcare.3 is NOT affected by CVE-2021-44228 (Log4Shell). The vulnerability was fixed in upstream Apache Log4j 2.12.3 via commit bf8ba18f63 authored by Gary Gregory, and version 2.12.4 inherits this fix. The fix implements three-layer defense: (1) JNDI disabled by default, (2) JndiLookup throws exception if not explicitly enabled via log4j2.enableJndiLookup=true, (3) JndiManager.lookup() only allows \"java:\" protocol, blocking ldap/ldaps exploits. TuxCare onboarded version 2.12.4 which already contained the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44228" }, "impact_statement": "Target Apache Log4j 2.12.4-tuxcare.3 is NOT affected by CVE-2021-44228 (Log4Shell). The vulnerability was fixed in upstream Apache Log4j 2.12.3 via commit bf8ba18f63 authored by Gary Gregory, and version 2.12.4 inherits this fix. The fix implements three-layer defense: (1) JNDI disabled by default, (2) JndiLookup throws exception if not explicitly enabled via log4j2.enableJndiLookup=true, (3) JndiManager.lookup() only allows \"java:\" protocol, blocking ldap/ldaps exploits. TuxCare onboarded version 2.12.4 which already contained the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1" } } ], "timestamp": "2026-10-31T12:49:12.061475+00:00", "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Target version 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2021-44832. The security fix was already present in Apache's upstream 2.12.4 release (December 2021), which TuxCare onboarded in August 2026. Both defense layers are in place: (1) JNDI JDBC feature disabled by default (requires log4j2.enableJndiJdbc=true), and (2) JNDI URI validation restricting lookups to java: protocol only, blocking mali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44832" }, "impact_statement": "not_affected \u2014 Target version 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2021-44832. The security fix was already present in Apache's upstream 2.12.4 release (December 2021), which TuxCare onboarded in August 2026. Both defense layers are in place: (1) JNDI JDBC feature disabled by default (requires log4j2.enableJndiJdbc=true), and (2) JNDI URI validation restricting lookups to java: protocol only, blocking mali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2021-45046 does not affect version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core. Target version 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2021-45046. The upstream Apache Log4j project already fixed this vulnerability (commit f819c838 \"Disable JNDI by default\" by Ralph Goers, December 13, 2021) before TuxCare onboarded the 2.12.4 release. The vulnerable pattern\u2014unrestricted JNDI lookup execution via Thread Context Map data\u2014is not present because JndiLookup is disabled by default and only registered when log4j2.enableJndiLookup=true.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45046" }, "impact_statement": "Target version 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2021-45046. The upstream Apache Log4j project already fixed this vulnerability (commit f819c838 \"Disable JNDI by default\" by Ralph Goers, December 13, 2021) before TuxCare onboarded the 2.12.4 release. The vulnerable pattern\u2014unrestricted JNDI lookup execution via Thread Context Map data\u2014is not present because JndiLookup is disabled by default and only registered when log4j2.enableJndiLookup=true.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1" } } ], "timestamp": "2026-10-31T12:30:58.876712+00:00", "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2021-45105 is NOT present in this target. The vulnerability was fixed in the upstream Apache Log4j 2.12.4 release before TuxCare onboarded it. The fix commit bf7e916df6 (authored by Carter Kozak on 2021-12-19) introduced RuntimeStrSubstitutor and ConfigurationStrSubstitutor classes to control recursive evaluation of lookups. RuntimeStrSubstitutor disables recursive evalu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45105" }, "impact_statement": "not_affected \u2014 CVE-2021-45105 is NOT present in this target. The vulnerability was fixed in the upstream Apache Log4j 2.12.4 release before TuxCare onboarded it. The fix commit bf7e916df6 (authored by Carter Kozak on 2021-12-19) introduced RuntimeStrSubstitutor and ConfigurationStrSubstitutor classes to control recursive evaluation of lookups. RuntimeStrSubstitutor disables recursive evalu..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Apache Log4j 1.x server components (Chainsaw, SimpleSocketServer) that receive and deserialize log events over the network. These components do not exist in Log4j 2.12.4. The target uses a fundamentally different architecture where SocketAppender only sends log events (client side) and does not receive them. The vulnerable code path is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26464" }, "impact_statement": "CVE-2023-26464 affects Apache Log4j 1.x server components (Chainsaw, SimpleSocketServer) that receive and deserialize log events over the network. These components do not exist in Log4j 2.12.4. The target uses a fundamentally different architecture where SocketAppender only sends log events (client side) and does not receive them. The vulnerable code path is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68161 affects version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2025-68161" }, "action_statement": "Vulnerability CVE-2025-68161 affects version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1" } } ], "timestamp": "2026-10-23T12:02:38.903929+00:00", "status_notes": "Vulnerability CVE-2026-34477 affects version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.12.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-34477" }, "action_statement": "Vulnerability CVE-2026-34477 affects version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.12.4-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1" } } ], "timestamp": "2026-11-01T08:03:00.133854+00:00", "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.12.4 is not affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from the @PluginFactory pattern to the @PluginBuilderFactory pattern, during which configuration attribute names were unintentionally changed. Version 2.12.4 predates this migration and uses the documented attribute names (newLine, newLineEscape, useTlsMessageForm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34478" }, "impact_statement": "not_affected \u2014 Version 2.12.4 is not affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from the @PluginFactory pattern to the @PluginBuilderFactory pattern, during which configuration attribute names were unintentionally changed. Version 2.12.4 predates this migration and uses the documented attribute names (newLine, newLineEscape, useTlsMessageForm..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1" } } ], "timestamp": "2026-10-23T12:03:00.106827+00:00", "status_notes": "Vulnerability CVE-2026-34479 affects version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.12.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-34479" }, "action_statement": "Vulnerability CVE-2026-34479 affects version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.12.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.12.4-tuxcare.1" } } ], "timestamp": "2026-10-23T12:02:38.903929+00:00", "status_notes": "Vulnerability CVE-2026-34480 affects version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.12.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-34480" }, "action_statement": "Vulnerability CVE-2026-34480 affects version 2.12.4-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.12.4-tuxcare.2." } ] }