{ "@id": "urn:uuid:88c5ffa1-d17e-4730-9c99-801e14f6c3cb", "role": "Document Creator", "author": "https://tuxcare.com", "version": 15, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:04:11.456857+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1" } } ], "timestamp": "2026-11-03T12:15:19.421943+00:00", "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. The target repository (Apache Log4j 2.18.0) is not affected by CVE-2017-5645. The vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accept serialized log events over TCP/UDP do not exist in this version. These components were removed by Apache upstream in April 2017 (commit 8865124fb1) and moved to a separate Tools repository, well before version 2.18.0 was released in 2022. Version 2.18.0 never contained these vulnerable network-facing deserialization components.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5645" }, "impact_statement": "The target repository (Apache Log4j 2.18.0) is not affected by CVE-2017-5645. The vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accept serialized log events over TCP/UDP do not exist in this version. These components were removed by Apache upstream in April 2017 (commit 8865124fb1) and moved to a separate Tools repository, well before version 2.18.0 was released in 2022. Version 2.18.0 never contained these vulnerable network-facing deserialization components.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1" } } ], "timestamp": "2026-11-01T04:46:00.073284+00:00", "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2020-9488 is not a concern for this version. The fix that enables hostname verification for SMTPS connections was included in upstream Apache Log4j 2.13.2 (via commit 6851b5083e by Matt Sicker) and is present in this 2.18.0 release. The defense code exists in SmtpManager.java:283 where it sets the JavaMail 'checkserveridentity' property to enable hostname validation. However, users must exp...", "vulnerability": { "name": "CVE-2020-9488" }, "impact_statement": "not_affected \u2014 CVE-2020-9488 is not a concern for this version. The fix that enables hostname verification for SMTPS connections was included in upstream Apache Log4j 2.13.2 (via commit 6851b5083e by Matt Sicker) and is present in this 2.18.0 release. The defense code exists in SmtpManager.java:283 where it sets the JavaMail 'checkserveridentity' property to enable hostname validation. However, users must exp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2021-44228 does not affect version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. Apache Log4j 2.18.0 (released June 2022) already includes all CVE-2021-44228 (Log4Shell) fixes from upstream. The vulnerable JNDI lookup code pattern is not present: (1) JNDI is disabled by default, requiring explicit opt-in via log4j2.enableJndi* properties; (2) only the 'java' protocol is allowed, blocking ldap/ldaps entirely; (3) JndiLookup constructor throws IllegalStateException unless explicitly enabled. These protections were shipped in the upstream 2.18.0 release (LOG4J2-3208, LOG4J2-3198, LOG4J2-3242). No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44228" }, "impact_statement": "Apache Log4j 2.18.0 (released June 2022) already includes all CVE-2021-44228 (Log4Shell) fixes from upstream. The vulnerable JNDI lookup code pattern is not present: (1) JNDI is disabled by default, requiring explicit opt-in via log4j2.enableJndi* properties; (2) only the 'java' protocol is allowed, blocking ldap/ldaps entirely; (3) JndiLookup constructor throws IllegalStateException unless explicitly enabled. These protections were shipped in the upstream 2.18.0 release (LOG4J2-3208, LOG4J2-3198, LOG4J2-3242). No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1" } } ], "timestamp": "2026-10-31T12:46:26.915756+00:00", "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 The target Apache Log4j2 version 2.18.0-tuxcare.2 is NOT affected by CVE-2021-44832. The vulnerability (unrestricted JNDI protocol URIs in JDBC Appender allowing remote code execution) was fixed in upstream version 2.17.1, and this fix is present in the 2.18.0 release. The fix commit (05db5f9527254632b59aed2a1d78a32c5ab74f16) by Apache committer Gary Gregory was shipped with the upstream releas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44832" }, "impact_statement": "not_affected \u2014 The target Apache Log4j2 version 2.18.0-tuxcare.2 is NOT affected by CVE-2021-44832. The vulnerability (unrestricted JNDI protocol URIs in JDBC Appender allowing remote code execution) was fixed in upstream version 2.17.1, and this fix is present in the 2.18.0 release. The fix commit (05db5f9527254632b59aed2a1d78a32c5ab74f16) by Apache committer Gary Gregory was shipped with the upstream releas..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2021-45046 does not affect version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. CVE-2021-45046 affects Log4j versions 2.0-beta9 through 2.15.0. The target version 2.18.0-tuxcare.2 includes the upstream fix from Apache Log4j 2.16.0 (commit c362aff473, December 2021). The fix disables JNDI lookups by default, preventing attackers from exploiting JNDI patterns in Thread Context Map data. The vulnerable code pattern is not present in the target - JndiLookup is only registered if explicitly enabled via system property log4j2.enableJndiLookup (defaults to false).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45046" }, "impact_statement": "CVE-2021-45046 affects Log4j versions 2.0-beta9 through 2.15.0. The target version 2.18.0-tuxcare.2 includes the upstream fix from Apache Log4j 2.16.0 (commit c362aff473, December 2021). The fix disables JNDI lookups by default, preventing attackers from exploiting JNDI patterns in Thread Context Map data. The vulnerable code pattern is not present in the target - JndiLookup is only registered if explicitly enabled via system property log4j2.enableJndiLookup (defaults to false).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1" } } ], "timestamp": "2026-10-31T12:30:58.876712+00:00", "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Target version 2.18.0-tuxcare.2 is not affected by CVE-2021-45105 (uncontrolled recursion from self-referential lookups in Thread Context Map). The vulnerability pattern is not present because the fix was already included in upstream Apache Log4j2 2.18.0, which TuxCare onboarded. Apache refactored the original 2.17.0 fix to use a LookupResult interface where isLookupEvaluationAllowedInValue() d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45105" }, "impact_statement": "not_affected \u2014 Target version 2.18.0-tuxcare.2 is not affected by CVE-2021-45105 (uncontrolled recursion from self-referential lookups in Thread Context Map). The vulnerability pattern is not present because the fix was already included in upstream Apache Log4j2 2.18.0, which TuxCare onboarded. Apache refactored the original 2.17.0 fix to use a LookupResult interface where isLookupEvaluationAllowedInValue() d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. Log4j 2.18.0 is not affected by CVE-2023-26464. This vulnerability specifically affects Log4j 1.x's server-side components (SimpleSocketServer, Chainsaw, SocketNode) that receive and deserialize log events from network connections. Log4j 2.x fundamentally redesigned the architecture and removed these receiver components. The SocketAppender in Log4j 2 is sender-only and does not include a companion receiver. Exhaustive searches confirm no production code exists for receiving serialized log events over the network, eliminating the attack vector entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26464" }, "impact_statement": "Log4j 2.18.0 is not affected by CVE-2023-26464. This vulnerability specifically affects Log4j 1.x's server-side components (SimpleSocketServer, Chainsaw, SocketNode) that receive and deserialize log events from network connections. Log4j 2.x fundamentally redesigned the architecture and removed these receiver components. The SocketAppender in Log4j 2 is sender-only and does not include a companion receiver. Exhaustive searches confirm no production code exists for receiving serialized log events over the network, eliminating the attack vector entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2025-68161" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1" } } ], "timestamp": "2026-10-12T15:39:00.053055+00:00", "status_notes": "Vulnerability CVE-2026-34477 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.18.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-34477" }, "action_statement": "Vulnerability CVE-2026-34477 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.18.0-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1" } } ], "timestamp": "2026-11-01T08:05:00.573920+00:00", "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.18.0 is NOT AFFECTED by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout migrated from @PluginFactory to @PluginBuilderFactory, causing documented configuration attribute names (newLineEscape, useTlsMessageFormat) to be silently ignored. Version 2.18.0 still uses the factory method pattern where these documented attribute names work correctly, so t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34478" }, "impact_statement": "not_affected \u2014 Version 2.18.0 is NOT AFFECTED by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout migrated from @PluginFactory to @PluginBuilderFactory, causing documented configuration attribute names (newLineEscape, useTlsMessageFormat) to be silently ignored. Version 2.18.0 still uses the factory method pattern where these documented attribute names work correctly, so t..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34479 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34479" }, "action_statement": "Vulnerability CVE-2026-34479 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.18.0-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34480 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34480" }, "action_statement": "Vulnerability CVE-2026-34480 affects version 2.18.0-tuxcare.1 of org.apache.logging.log4j:log4j-core." } ] }