{
  "@id": "urn:uuid:fd6553bc-7bc4-41db-901d-7a2a12f99d3c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T07:58:00.120241+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T04:44:00.147922+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 CVE-2020-9488 affects Apache Log4j versions prior to 2.13.2. The target version 2.17.2 includes the upstream fix that adds SSL/TLS hostname verification capability for SMTP appender. The fix was authored by Apache committer Matt Sicker (boards@gmail.com) in commit 6851b5083e on April 13, 2020, and was included in the upstream 2.17.2 release that TuxCare onboarded. The vulnerable code pattern (c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 affects Apache Log4j versions prior to 2.13.2. The target version 2.17.2 includes the upstream fix that adds SSL/TLS hostname verification capability for SMTP appender. The fix was authored by Apache committer Matt Sicker (boards@gmail.com) in commit 6851b5083e on April 13, 2020, and was included in the upstream 2.17.2 release that TuxCare onboarded. The vulnerable code pattern (c..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:46:44.245433+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 CVE-2021-44832 is not present in this target. The vulnerability was fixed in upstream Apache Log4j2 version 2.17.1 (released December 2021) by commit 05db5f9527254632b59aed2a1d78a32c5ab74f16, authored by Gary Gregory. TuxCare onboarded version 2.17.2 in commit 41033c5d1f52bdd02ed207cbb538556163b8aae5, which already contained this upstream fix. The vulnerable pattern (unrestricted JNDI lookups i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-44832 is not present in this target. The vulnerability was fixed in upstream Apache Log4j2 version 2.17.1 (released December 2021) by commit 05db5f9527254632b59aed2a1d78a32c5ab74f16, authored by Gary Gregory. TuxCare onboarded version 2.17.2 in commit 41033c5d1f52bdd02ed207cbb538556163b8aae5, which already contained this upstream fix. The vulnerable pattern (unrestricted JNDI lookups i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:31:30.473956+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 Target repository Log4j 2.17.2 is not affected by CVE-2021-45105. The vulnerability was fixed in upstream release 2.17.0 by commit 806023265f, which was included in the 2.17.2 release that TuxCare onboarded. The defense mechanism uses a LookupResult interface where isLookupEvaluationAllowedInValue() defaults to false for runtime data sources like Thread Context Map, preventing recursive evaluat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 Target repository Log4j 2.17.2 is not affected by CVE-2021-45105. The vulnerability was fixed in upstream release 2.17.0 by commit 806023265f, which was included in the 2.17.2 release that TuxCare onboarded. The defense mechanism uses a LookupResult interface where isLookupEvaluationAllowedInValue() defaults to false for runtime data sources like Thread Context Map, preventing recursive evaluat..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T07:58:00.120241+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 Version 2.17.2 is not affected by CVE-2026-34478. This CVE affects versions 2.21.0 through 2.25.3 where configuration attributes were renamed during migration to the builder pattern. Version 2.17.2 uses the original factory pattern with correctly documented attribute names (newLineEscape, useTlsMessageFormat, etc.) and was never affected by this vulnerability.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Version 2.17.2 is not affected by CVE-2026-34478. This CVE affects versions 2.21.0 through 2.25.3 where configuration attributes were renamed during migration to the builder pattern. Version 2.17.2 uses the original factory pattern with correctly documented attribute names (newLineEscape, useTlsMessageFormat, etc.) and was never affected by this vulnerability."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "action_statement": "Vulnerability CVE-2026-49844 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    }
  ]
}