{ "@id": "urn:uuid:f83fda50-5896-4427-bbc9-4431b90890bf", "role": "Document Creator", "author": "https://tuxcare.com", "version": 14, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:03:00.104314+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2" } } ], "timestamp": "2026-11-03T12:12:40.044104+00:00", "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2017-5645 affects TcpSocketServer and UdpSocketServer classes that deserialize network-received log events without class filtering, enabling arbitrary code execution. These vulnerable components were completely removed from the main Apache Log4j2 distribution in version 2.9.0 (April 2017, commit 8865124fb1) and moved to a separate Tools repository. The target version 2.17.2 does not contain these socket server classes at all. Exhaustive search confirmed no network-based deserialization entry points exist in the current codebase. The only socket-related component found is SocketAppender, which is an outbound sender, not an inbound receiver. The removal was an upstream change that shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5645" }, "impact_statement": "CVE-2017-5645 affects TcpSocketServer and UdpSocketServer classes that deserialize network-received log events without class filtering, enabling arbitrary code execution. These vulnerable components were completely removed from the main Apache Log4j2 distribution in version 2.9.0 (April 2017, commit 8865124fb1) and moved to a separate Tools repository. The target version 2.17.2 does not contain these socket server classes at all. Exhaustive search confirmed no network-based deserialization entry points exist in the current codebase. The only socket-related component found is SocketAppender, which is an outbound sender, not an inbound receiver. The removal was an upstream change that shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2" } } ], "timestamp": "2026-11-01T04:44:00.147922+00:00", "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2020-9488 affects Apache Log4j versions prior to 2.13.2. The target version 2.17.2 includes the upstream fix that adds SSL/TLS hostname verification capability for SMTP appender. The fix was authored by Apache committer Matt Sicker (boards@gmail.com) in commit 6851b5083e on April 13, 2020, and was included in the upstream 2.17.2 release that TuxCare onboarded. The vulnerable code pattern (c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9488" }, "impact_statement": "not_affected \u2014 CVE-2020-9488 affects Apache Log4j versions prior to 2.13.2. The target version 2.17.2 includes the upstream fix that adds SSL/TLS hostname verification capability for SMTP appender. The fix was authored by Apache committer Matt Sicker (boards@gmail.com) in commit 6851b5083e on April 13, 2020, and was included in the upstream 2.17.2 release that TuxCare onboarded. The vulnerable code pattern (c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2021-44228 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. Target Apache Log4j 2.17.2 is NOT vulnerable to CVE-2021-44228 (Log4Shell). The vulnerable pattern (unrestricted JNDI lookups allowing arbitrary code execution via attacker-controlled LDAP servers) is not present. The fix was introduced in upstream Apache Log4j 2.15.0 (commit c77b3cb393 by rgoers@apache.org) and shipped with the upstream 2.17.2 release that TuxCare onboarded. Version 2.17.2 implements even stronger protections than 2.15.0: JNDI is disabled by default (requires explicit log4j2.enableJndiLookup=true), and even when enabled, only the java: protocol is allowed\u2014ldap/ldaps protocols are completely blocked. The three-layer defense (constructor check, manager creation check, protocol restriction) prevents all exploitation paths for this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44228" }, "impact_statement": "Target Apache Log4j 2.17.2 is NOT vulnerable to CVE-2021-44228 (Log4Shell). The vulnerable pattern (unrestricted JNDI lookups allowing arbitrary code execution via attacker-controlled LDAP servers) is not present. The fix was introduced in upstream Apache Log4j 2.15.0 (commit c77b3cb393 by rgoers@apache.org) and shipped with the upstream 2.17.2 release that TuxCare onboarded. Version 2.17.2 implements even stronger protections than 2.15.0: JNDI is disabled by default (requires explicit log4j2.enableJndiLookup=true), and even when enabled, only the java: protocol is allowed\u2014ldap/ldaps protocols are completely blocked. The three-layer defense (constructor check, manager creation check, protocol restriction) prevents all exploitation paths for this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2" } } ], "timestamp": "2026-10-31T12:46:44.245433+00:00", "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2021-44832 is not present in this target. The vulnerability was fixed in upstream Apache Log4j2 version 2.17.1 (released December 2021) by commit 05db5f9527254632b59aed2a1d78a32c5ab74f16, authored by Gary Gregory. TuxCare onboarded version 2.17.2 in commit 41033c5d1f52bdd02ed207cbb538556163b8aae5, which already contained this upstream fix. The vulnerable pattern (unrestricted JNDI lookups i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44832" }, "impact_statement": "not_affected \u2014 CVE-2021-44832 is not present in this target. The vulnerability was fixed in upstream Apache Log4j2 version 2.17.1 (released December 2021) by commit 05db5f9527254632b59aed2a1d78a32c5ab74f16, authored by Gary Gregory. TuxCare onboarded version 2.17.2 in commit 41033c5d1f52bdd02ed207cbb538556163b8aae5, which already contained this upstream fix. The vulnerable pattern (unrestricted JNDI lookups i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2021-45046 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. Apache Log4j 2.17.2 is not affected by CVE-2021-45046. The vulnerability, which allowed attackers to craft malicious JNDI lookup patterns in Thread Context Map (MDC) data resulting in RCE, was fixed in upstream version 2.16.0 by disabling JNDI functionality by default. Version 2.17.2 already contains this fix (commit c362aff by rgoers@apache.org) plus enhanced granular controls. The fix introduces `log4j2.enableJndi*` properties (defaulting to FALSE) that prevent JndiLookup registration in the Interpolator and block JNDI operations unless explicitly enabled. TuxCare onboarded version 2.17.2 which already included the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45046" }, "impact_statement": "Apache Log4j 2.17.2 is not affected by CVE-2021-45046. The vulnerability, which allowed attackers to craft malicious JNDI lookup patterns in Thread Context Map (MDC) data resulting in RCE, was fixed in upstream version 2.16.0 by disabling JNDI functionality by default. Version 2.17.2 already contains this fix (commit c362aff by rgoers@apache.org) plus enhanced granular controls. The fix introduces `log4j2.enableJndi*` properties (defaulting to FALSE) that prevent JndiLookup registration in the Interpolator and block JNDI operations unless explicitly enabled. TuxCare onboarded version 2.17.2 which already included the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2" } } ], "timestamp": "2026-10-31T12:31:30.473956+00:00", "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Target repository Log4j 2.17.2 is not affected by CVE-2021-45105. The vulnerability was fixed in upstream release 2.17.0 by commit 806023265f, which was included in the 2.17.2 release that TuxCare onboarded. The defense mechanism uses a LookupResult interface where isLookupEvaluationAllowedInValue() defaults to false for runtime data sources like Thread Context Map, preventing recursive evaluat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45105" }, "impact_statement": "not_affected \u2014 Target repository Log4j 2.17.2 is not affected by CVE-2021-45105. The vulnerability was fixed in upstream release 2.17.0 by commit 806023265f, which was included in the 2.17.2 release that TuxCare onboarded. The defense mechanism uses a LookupResult interface where isLookupEvaluationAllowedInValue() defaults to false for runtime data sources like Thread Context Map, preventing recursive evaluat..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 explicitly affects Log4j 1.x only (\"Apache Log4j before 2\"). The target is Log4j 2.17.2, which eliminated the vulnerability through architectural redesign. Log4j 1.x used Java object serialization (ObjectInputStream) in SocketAppender/SocketServer to transmit log events, enabling DoS via deeply nested HashMap/Hashtable deserialization. Log4j 2.x fundamentally changed to Layout-based serialization, has no server components that deserialize incoming log events, and blocks direct LogEvent deserialization via InvalidObjectException. The attack chain from malicious input to memory exhaustion does not exist in Log4j 2.x architecture.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-26464" }, "impact_statement": "CVE-2023-26464 explicitly affects Log4j 1.x only (\"Apache Log4j before 2\"). The target is Log4j 2.17.2, which eliminated the vulnerability through architectural redesign. Log4j 1.x used Java object serialization (ObjectInputStream) in SocketAppender/SocketServer to transmit log events, enabling DoS via deeply nested HashMap/Hashtable deserialization. Log4j 2.x fundamentally changed to Layout-based serialization, has no server components that deserialize incoming log events, and blocks direct LogEvent deserialization via InvalidObjectException. The attack chain from malicious input to memory exhaustion does not exist in Log4j 2.x architecture.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2025-68161" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34477" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2" } } ], "timestamp": "2026-11-01T07:58:00.120241+00:00", "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.17.2 is not affected by CVE-2026-34478. This CVE affects versions 2.21.0 through 2.25.3 where configuration attributes were renamed during migration to the builder pattern. Version 2.17.2 uses the original factory pattern with correctly documented attribute names (newLineEscape, useTlsMessageFormat, etc.) and was never affected by this vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34478" }, "impact_statement": "not_affected \u2014 Version 2.17.2 is not affected by CVE-2026-34478. This CVE affects versions 2.21.0 through 2.25.3 where configuration attributes were renamed during migration to the builder pattern. Version 2.17.2 uses the original factory pattern with correctly documented attribute names (newLineEscape, useTlsMessageFormat, etc.) and was never affected by this vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34479" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34480" } } ] }