{ "@id": "urn:uuid:b06a43d0-86fc-44dd-afec-cf0cbdfe1b01", "role": "Document Creator", "author": "https://tuxcare.com", "version": 15, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:03:00.104314+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2" } } ], "timestamp": "2026-11-03T12:13:29.842653+00:00", "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. Apache Log4j 2.19.0 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server components (TcpSocketServer, UdpSocketServer) that could deserialize untrusted serialized objects were completely removed from the logging-log4j2 repository in commit 8865124fb1 (April 2017), well before version 2.19.0. These server components do not exist in the target version. The fix for the vulnerability (commit 5dcc192158) was authored by upstream Apache developer Matt Sicker and was already present in the upstream release when TuxCare onboarded version 2.19.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5645" }, "impact_statement": "Apache Log4j 2.19.0 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server components (TcpSocketServer, UdpSocketServer) that could deserialize untrusted serialized objects were completely removed from the logging-log4j2 repository in commit 8865124fb1 (April 2017), well before version 2.19.0. These server components do not exist in the target version. The fix for the vulnerability (commit 5dcc192158) was authored by upstream Apache developer Matt Sicker and was already present in the upstream release when TuxCare onboarded version 2.19.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2" } } ], "timestamp": "2026-11-01T04:42:00.149197+00:00", "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2020-9488 is not affecting the target Apache Log4j 2.19.0-tuxcare.2. The hostname verification fix for SMTPS connections was included in the upstream Apache Log4j 2.19.0 release before TuxCare onboarded it. The fix (commit 6851b5083e by Matt Sicker) adds support for configurable SSL hostname verification via the SslConfiguration.verifyHostName parameter, which sets the JavaMail property mai...", "vulnerability": { "name": "CVE-2020-9488" }, "impact_statement": "not_affected \u2014 CVE-2020-9488 is not affecting the target Apache Log4j 2.19.0-tuxcare.2. The hostname verification fix for SMTPS connections was included in the upstream Apache Log4j 2.19.0 release before TuxCare onboarded it. The fix (commit 6851b5083e by Matt Sicker) adds support for configurable SSL hostname verification via the SslConfiguration.verifyHostName parameter, which sets the JavaMail property mai..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2021-44228 does not affect version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. The target version 2.19.0 is not affected by CVE-2021-44228 (Log4Shell). Comprehensive fixes were shipped in upstream Log4j 2.17.0 (December 2021), nine months before the 2.19.0 release. The target implements two defense layers: (1) JNDI lookups are disabled by default, requiring explicit opt-in via system property log4j2.enableJndiLookup=true, and (2) even when enabled, JNDI is restricted to only the \"java:\" protocol scheme, completely blocking ldap://, ldaps://, and other remote protocols that enable the RCE attack vector. The vulnerable pattern described in CVE-2021-44228 is not present in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44228" }, "impact_statement": "The target version 2.19.0 is not affected by CVE-2021-44228 (Log4Shell). Comprehensive fixes were shipped in upstream Log4j 2.17.0 (December 2021), nine months before the 2.19.0 release. The target implements two defense layers: (1) JNDI lookups are disabled by default, requiring explicit opt-in via system property log4j2.enableJndiLookup=true, and (2) even when enabled, JNDI is restricted to only the \"java:\" protocol scheme, completely blocking ldap://, ldaps://, and other remote protocols that enable the RCE attack vector. The vulnerable pattern described in CVE-2021-44228 is not present in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2" } } ], "timestamp": "2026-10-31T12:48:11.451074+00:00", "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Apache Log4j 2.19.0 is not affected by CVE-2021-44832. The vulnerability requires unrestricted JNDI URI protocols in JDBC Appender configuration, which was fixed in upstream version 2.17.1. The target version 2.19.0 already contains the complete fix from commit 05db5f9527 by Gary Gregory, which added two defense layers: (1) a feature flag (log4j2.enableJndiJdbc) that disables JNDI in JDBC by de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44832" }, "impact_statement": "not_affected \u2014 Apache Log4j 2.19.0 is not affected by CVE-2021-44832. The vulnerability requires unrestricted JNDI URI protocols in JDBC Appender configuration, which was fixed in upstream version 2.17.1. The target version 2.19.0 already contains the complete fix from commit 05db5f9527 by Gary Gregory, which added two defense layers: (1) a feature flag (log4j2.enableJndiJdbc) that disables JNDI in JDBC by de..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2021-45046 does not affect version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2021-45046: Apache Log4j 2.19.0-tuxcare.2 is NOT AFFECTED. The vulnerability was fixed in upstream Apache Log4j 2.16.0 by disabling JNDI functionality by default. The target version 2.19.0 (released Sept 2022) includes the upstream fix from commit c362aff473e9812798ff8f25f30a2619996605d5 authored by rgoers@apache.org. The fix was already present in the upstream release before TuxCare onboarding. Two defense layers prevent exploitation: (1) JndiLookup is not registered in Interpolator's lookup map unless explicitly enabled via log4j2.enableJndiLookup property (defaults to false), (2) JndiLookup constructor throws IllegalStateException unless JNDI is enabled. Message lookups were also removed as additional hardening. The vulnerable code path (MDC data \u2192 pattern expansion \u2192 JNDI lookup \u2192 RCE) is completely blocked by the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45046" }, "impact_statement": "CVE-2021-45046: Apache Log4j 2.19.0-tuxcare.2 is NOT AFFECTED. The vulnerability was fixed in upstream Apache Log4j 2.16.0 by disabling JNDI functionality by default. The target version 2.19.0 (released Sept 2022) includes the upstream fix from commit c362aff473e9812798ff8f25f30a2619996605d5 authored by rgoers@apache.org. The fix was already present in the upstream release before TuxCare onboarding. Two defense layers prevent exploitation: (1) JndiLookup is not registered in Interpolator's lookup map unless explicitly enabled via log4j2.enableJndiLookup property (defaults to false), (2) JndiLookup constructor throws IllegalStateException unless JNDI is enabled. Message lookups were also removed as additional hardening. The vulnerable code path (MDC data \u2192 pattern expansion \u2192 JNDI lookup \u2192 RCE) is completely blocked by the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2" } } ], "timestamp": "2026-10-31T12:35:50.891113+00:00", "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2021-45105 is NOT present in Apache Log4j 2.19.0. The vulnerability (uncontrolled recursion from self-referential Thread Context Map lookups causing StackOverflowError) was fixed in upstream version 2.17.0 (December 2021). Version 2.19.0 contains an improved LookupResult-based defense (LOG4J2-3317, January 2022) where DefaultLookupResult.isLookupEvaluationAllowedInValue() returns false, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45105" }, "impact_statement": "not_affected \u2014 CVE-2021-45105 is NOT present in Apache Log4j 2.19.0. The vulnerability (uncontrolled recursion from self-referential Thread Context Map lookups causing StackOverflowError) was fixed in upstream version 2.17.0 (December 2021). Version 2.19.0 contains an improved LookupResult-based defense (LOG4J2-3317, January 2022) where DefaultLookupResult.isLookupEvaluationAllowedInValue() returns false, pre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Log4j 1.x Chainsaw and SocketAppender components that deserialize deeply nested hashmaps/hashtables, causing memory exhaustion on JRE < 1.7. This repository is Apache Log4j 2.19.0-tuxcare.2, which is a complete architectural rewrite that does not use Java deserialization for network appenders. The vulnerable Log4j 1.x components (Chainsaw, deserialization-based SocketAppender/SocketServer) do not exist in this codebase. The log4j-1.2-api compatibility module is a facade that wraps Log4j 2 implementations without containing actual Log4j 1.x network code. Type A1 satisfied: the input type (deserialized logging entries with nested structures) is not received anywhere in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26464" }, "impact_statement": "CVE-2023-26464 affects Log4j 1.x Chainsaw and SocketAppender components that deserialize deeply nested hashmaps/hashtables, causing memory exhaustion on JRE < 1.7. This repository is Apache Log4j 2.19.0-tuxcare.2, which is a complete architectural rewrite that does not use Java deserialization for network appenders. The vulnerable Log4j 1.x components (Chainsaw, deserialization-based SocketAppender/SocketServer) do not exist in this codebase. The log4j-1.2-api compatibility module is a facade that wraps Log4j 2 implementations without containing actual Log4j 1.x network code. Type A1 satisfied: the input type (deserialized logging entries with nested structures) is not received anywhere in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2" } } ], "timestamp": "2026-10-13T14:23:00.078163+00:00", "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2025-68161" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2" } } ], "timestamp": "2026-10-13T14:25:07.334490+00:00", "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34477" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2" } } ], "timestamp": "2026-11-01T08:00:00.159537+00:00", "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.19.0 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from the factory pattern (@PluginFactory) to the builder pattern (@PluginBuilderFactory), and configuration attributes were inadvertently renamed. Version 2.19.0 predates this migration and still uses the factory pattern with correctly-named configuration attribut...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34478" }, "impact_statement": "not_affected \u2014 Version 2.19.0 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from the factory pattern (@PluginFactory) to the builder pattern (@PluginBuilderFactory), and configuration attributes were inadvertently renamed. Version 2.19.0 predates this migration and still uses the factory pattern with correctly-named configuration attribut..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2" } } ], "timestamp": "2026-10-13T14:23:00.078163+00:00", "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34479" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.19.0-tuxcare.2" } } ], "timestamp": "2026-10-13T14:23:00.078163+00:00", "status_notes": "Vulnerability CVE-2026-34480 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34480" }, "action_statement": "Vulnerability CVE-2026-34480 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-core." } ] }