{ "@id": "urn:uuid:a4ac8352-1f10-4e75-8b70-5ad1effbef16", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:03:00.104314+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5" } } ], "timestamp": "2026-11-03T18:58:15.531409+00:00", "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.23.1-tuxcare.5 of org.apache.logging.log4j:log4j-core. CVE-2017-5645 affects Log4j2 versions before 2.8.2 where TCP/UDP socket servers deserialize untrusted serialized binary payloads without class filtering. The target (version 2.23.1-tuxcare.4) is not affected: (1) the vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge, AbstractSocketServer) were completely removed from the main repository in April 2017 (commit 8865124fb11); (2) prior to removal, the fix (FilteredObjectInputStream with class allow-list) was already applied in March 2017 (commit 5dcc19215827db29c993d0305ee2b0d8dd05939d) by upstream author Matt Sicker. Both the fix and the removal are part of the upstream release 2.23.1 that TuxCare onboarded. The target contains no code that accepts serialized binary data from TCP/UDP sockets for deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5645" }, "impact_statement": "CVE-2017-5645 affects Log4j2 versions before 2.8.2 where TCP/UDP socket servers deserialize untrusted serialized binary payloads without class filtering. The target (version 2.23.1-tuxcare.4) is not affected: (1) the vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge, AbstractSocketServer) were completely removed from the main repository in April 2017 (commit 8865124fb11); (2) prior to removal, the fix (FilteredObjectInputStream with class allow-list) was already applied in March 2017 (commit 5dcc19215827db29c993d0305ee2b0d8dd05939d) by upstream author Matt Sicker. Both the fix and the removal are part of the upstream release 2.23.1 that TuxCare onboarded. The target contains no code that accepts serialized binary data from TCP/UDP sockets for deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5" } } ], "timestamp": "2026-11-03T18:58:15.531409+00:00", "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.23.1-tuxcare.5 of org.apache.logging.log4j:log4j-core. not_affected \u2014 The target Apache Log4j2 version 2.23.1-tuxcare.4 is NOT AFFECTED by CVE-2020-9488. The vulnerability (improper hostname verification in SMTP appender's SMTPS connections) was fixed by the upstream Apache project in version 2.13.2 (April 2020) via commit 6851b5083e. This fix was already present in the Apache Log4j2 2.23.1 release that TuxCare onboarded. The defense code exists in SmtpManager.ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9488" }, "impact_statement": "not_affected \u2014 The target Apache Log4j2 version 2.23.1-tuxcare.4 is NOT AFFECTED by CVE-2020-9488. The vulnerability (improper hostname verification in SMTP appender's SMTPS connections) was fixed by the upstream Apache project in version 2.13.2 (April 2020) via commit 6851b5083e. This fix was already present in the Apache Log4j2 2.23.1 release that TuxCare onboarded. The defense code exists in SmtpManager.ja..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5" } } ], "timestamp": "2026-11-03T18:58:15.531409+00:00", "status_notes": "Vulnerability CVE-2021-44228 does not affect version 2.23.1-tuxcare.5 of org.apache.logging.log4j:log4j-core. The target repository (Apache Log4j 2.23.1-tuxcare.4) is not affected by CVE-2021-44228 (Log4Shell). The vulnerability allows remote code execution via JNDI lookups in log messages. Version 2.23.1 already contains comprehensive upstream defenses: (1) JNDI lookups disabled by default, requiring explicit opt-in via log4j2.enableJndiLookup=true, (2) even when enabled, JNDI is restricted to only the java: protocol (ldap://, rmi://, etc. are blocked), and (3) message lookup substitution completely removed. These fixes were authored by Apache developers (rgoers@apache.org) in upstream releases 2.15.0-2.16.0, well before version 2.23.1. TuxCare onboarded the already-fixed upstream release via commit 3ee1c96028f2a1ed1804794edf66905311eabdc6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44228" }, "impact_statement": "The target repository (Apache Log4j 2.23.1-tuxcare.4) is not affected by CVE-2021-44228 (Log4Shell). The vulnerability allows remote code execution via JNDI lookups in log messages. Version 2.23.1 already contains comprehensive upstream defenses: (1) JNDI lookups disabled by default, requiring explicit opt-in via log4j2.enableJndiLookup=true, (2) even when enabled, JNDI is restricted to only the java: protocol (ldap://, rmi://, etc. are blocked), and (3) message lookup substitution completely removed. These fixes were authored by Apache developers (rgoers@apache.org) in upstream releases 2.15.0-2.16.0, well before version 2.23.1. TuxCare onboarded the already-fixed upstream release via commit 3ee1c96028f2a1ed1804794edf66905311eabdc6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.15.0; >= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2), NVD (>= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.15.0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5" } } ], "timestamp": "2026-11-03T18:58:15.531409+00:00", "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.23.1-tuxcare.5 of org.apache.logging.log4j:log4j-core. not_affected \u2014 The target Apache Log4j2 version 2.23.1-tuxcare.4 is NOT AFFECTED by CVE-2021-44832. The vulnerability allowed attackers with configuration file write access to construct malicious JDBC Appender configurations using JNDI URIs pointing to attacker-controlled LDAP/RMI servers for remote code execution. The complete upstream security fix was already present in Apache Log4j2 version 2.17.1 (release...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-44832" }, "impact_statement": "not_affected \u2014 The target Apache Log4j2 version 2.23.1-tuxcare.4 is NOT AFFECTED by CVE-2021-44832. The vulnerability allowed attackers with configuration file write access to construct malicious JDBC Appender configurations using JNDI URIs pointing to attacker-controlled LDAP/RMI servers for remote code execution. The complete upstream security fix was already present in Apache Log4j2 version 2.17.1 (release..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5" } } ], "timestamp": "2026-11-03T18:58:15.531409+00:00", "status_notes": "Vulnerability CVE-2021-45046 does not affect version 2.23.1-tuxcare.5 of org.apache.logging.log4j:log4j-core. CVE-2021-45046 is not present in Apache Log4j 2.23.1-tuxcare.4. The vulnerability affected versions 2.0-beta9 to 2.15.0 and was fixed in 2.16.0. The target version (2.23.1) is significantly newer and contains the upstream fix that disables JNDI functionality by default, preventing exploitation via Thread Context Map (MDC) input data. The fix was authored by Apache committer Ralph Goers and shipped in the upstream 2.23.1 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45046" }, "impact_statement": "CVE-2021-45046 is not present in Apache Log4j 2.23.1-tuxcare.4. The vulnerability affected versions 2.0-beta9 to 2.15.0 and was fixed in 2.16.0. The target version (2.23.1) is significantly newer and contains the upstream fix that disables JNDI functionality by default, preventing exploitation via Thread Context Map (MDC) input data. The fix was authored by Apache committer Ralph Goers and shipped in the upstream 2.23.1 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.16.0; >= 2.4.0, < 2.12.2; < 2.3.1), NVD (>= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; = 2.0; = 2.0-beta9; = 2.0-rc1; = 2.0-rc2), Snyk (>= 2.0-beta9, < 2.3.1; >= 2.4, < 2.12.2; >= 2.13.0, < 2.16.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5" } } ], "timestamp": "2026-11-03T18:58:15.531409+00:00", "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.23.1-tuxcare.5 of org.apache.logging.log4j:log4j-core. not_affected \u2014 The target repository (Apache Log4j 2.23.1-tuxcare.4) is not affected by CVE-2021-45105. The vulnerability, which allowed uncontrolled recursion from self-referential lookups in Thread Context Map data, has been fixed by upstream Apache commits that were already present in the 2.23.1 release. The fix prevents recursive evaluation of runtime lookups (including Thread Context Map data) by using t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45105" }, "impact_statement": "not_affected \u2014 The target repository (Apache Log4j 2.23.1-tuxcare.4) is not affected by CVE-2021-45105. The vulnerability, which allowed uncontrolled recursion from self-referential lookups in Thread Context Map data, has been fixed by upstream Apache commits that were already present in the 2.23.1 release. The fix prevents recursive evaluation of runtime lookups (including Thread Context Map data) by using t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.23.1-tuxcare.5 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Apache Log4j 1.x (before version 2.0) when using Chainsaw or SocketAppender components with JRE < 1.7, where deserialization of deeply nested HashMap/Hashtable structures can exhaust memory. The target repository is Apache Log4j 2.23.1-tuxcare.5, which uses a completely different architecture without the vulnerable deserialization code. The log4j-1.2-api module is a compatibility bridge that translates Log4j 1.x API calls into Log4j 2.x calls, not actual Log4j 1.x code. The vulnerable components (Log4j 1.x SocketAppender/Chainsaw with ObjectInputStream-based deserialization) are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26464" }, "impact_statement": "CVE-2023-26464 affects Apache Log4j 1.x (before version 2.0) when using Chainsaw or SocketAppender components with JRE < 1.7, where deserialization of deeply nested HashMap/Hashtable structures can exhaust memory. The target repository is Apache Log4j 2.23.1-tuxcare.5, which uses a completely different architecture without the vulnerable deserialization code. The log4j-1.2-api module is a compatibility bridge that translates Log4j 1.x API calls into Log4j 2.x calls, not actual Log4j 1.x code. The vulnerable components (Log4j 1.x SocketAppender/Chainsaw with ObjectInputStream-based deserialization) are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5" } } ], "timestamp": "2026-11-03T18:58:15.531409+00:00", "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.23.1-tuxcare.5 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2025-68161" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5" } } ], "timestamp": "2026-11-03T18:58:15.531409+00:00", "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.23.1-tuxcare.5 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34477" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5" } } ], "timestamp": "2026-11-03T18:58:15.531409+00:00", "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.23.1-tuxcare.5 of org.apache.logging.log4j:log4j-core. Version not vulnerable (per prereq analysis); terminalized.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34478" }, "impact_statement": "Version not vulnerable (per prereq analysis); terminalized." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5" } } ], "timestamp": "2026-11-03T18:58:15.531409+00:00", "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.23.1-tuxcare.5 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34479" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.23.1-tuxcare.5" } } ], "timestamp": "2026-11-03T18:58:15.531409+00:00", "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.23.1-tuxcare.5 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34480" } } ] }