{
  "@id": "urn:uuid:9310cde7-4e5a-43dc-ac20-71d1a33b61ea",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:15:19.421943+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core. CVE-2017-5645 is not present in Apache Log4j 2.13.3. The vulnerable TCP and UDP socket server components that would deserialize untrusted log events were removed from the main repository in commit 8865124fb1 (April 2017) and moved to a separate Tools repository. Additionally, the upstream fix (commit 5dcc192158 adding FilteredObjectInputStream class filtering) was already included in the upstream release before TuxCare onboarded version 2.13.3. The target repository no longer contains any code path that receives serialized Java objects over TCP/UDP socket servers for deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "CVE-2017-5645 is not present in Apache Log4j 2.13.3. The vulnerable TCP and UDP socket server components that would deserialize untrusted log events were removed from the main repository in commit 8865124fb1 (April 2017) and moved to a separate Tools repository. Additionally, the upstream fix (commit 5dcc192158 adding FilteredObjectInputStream class filtering) was already included in the upstream release before TuxCare onboarded version 2.13.3. The target repository no longer contains any code path that receives serialized Java objects over TCP/UDP socket servers for deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T04:41:00.175184+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2020-9488 is not applicable to this target. The vulnerability concerns improper hostname verification in the SMTP appender's SMTPS connections, allowing man-in-the-middle attacks. The fix (adding verifyHostName configuration and setting mail.smtps.ssl.checkserveridentity property) was introduced in upstream Apache Log4j 2.13.2 by Matt Sicker (commit 6851b5083e). This target is version 2.13....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 is not applicable to this target. The vulnerability concerns improper hostname verification in the SMTP appender's SMTPS connections, allowing man-in-the-middle attacks. The fix (adding verifyHostName configuration and setting mail.smtps.ssl.checkserveridentity property) was introduced in upstream Apache Log4j 2.13.2 by Matt Sicker (commit 6851b5083e). This target is version 2.13...."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-01T16:38:01.606556+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-01T16:38:01.606556+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 affects version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "action_statement": "Vulnerability CVE-2021-44832 affects version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-01T16:38:01.606556+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-01T16:38:01.606556+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 affects version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "action_statement": "Vulnerability CVE-2021-45105 affects version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 explicitly affects \"Apache Log4j before 2\" (Log4j 1.x only). The vulnerable components - Chainsaw GUI and SocketAppender receiver functionality - do not exist in Log4j 2.13.3. Log4j 2.x completely redesigned the architecture: SocketAppender is sender-only, Chainsaw was never ported to v2, and no network receiver components that deserialize untrusted log events exist in the codebase. The attack vector (deeply nested HashMap/Hashtable in serialized logging data received over network) cannot be delivered to Log4j 2.13.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "impact_statement": "CVE-2023-26464 explicitly affects \"Apache Log4j before 2\" (Log4j 1.x only). The vulnerable components - Chainsaw GUI and SocketAppender receiver functionality - do not exist in Log4j 2.13.3. Log4j 2.x completely redesigned the architecture: SocketAppender is sender-only, Chainsaw was never ported to v2, and no network receiver components that deserialize untrusted log events exist in the codebase. The attack vector (deeply nested HashMap/Hashtable in serialized logging data received over network) cannot be delivered to Log4j 2.13.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-13T14:12:08.053071+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.13.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.13.3-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-01T16:40:38.533635+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:04:00.108193+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Target version 2.13.3 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when the @PluginBuilderFactory pattern was added, breaking backward compatibility for configuration attribute names. Version 2.13.3 uses the older @PluginFactory pattern which correctly processes all security-relevant configuration attributes (newLine, newLineEscape, useTlsMessageFormat, ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Target version 2.13.3 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when the @PluginBuilderFactory pattern was added, breaking backward compatibility for configuration attribute names. Version 2.13.3 uses the older @PluginFactory pattern which correctly processes all security-relevant configuration attributes (newLine, newLineEscape, useTlsMessageFormat, ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-01T16:40:38.533635+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-01T16:40:38.533635+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.13.3-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    }
  ]
}