{
  "@id": "urn:uuid:ddb6d0fa-dec3-4ae3-9447-16123a7c0e60",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T04:43:00.112738+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T04:43:00.112738+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl. not_affected \u2014 CVE-2020-9488 affects Apache Log4j SMTP appender prior to version 2.13.2 due to missing hostname verification in SMTPS connections. The target version 2.24.1-tuxcare.3 contains the upstream fix (commit 6851b5083e from April 2020) that adds SSL configuration support with hostname verification via the `mail.smtps.ssl.checkserveridentity` property. This fix was already present in the upstream Apac...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 affects Apache Log4j SMTP appender prior to version 2.13.2 due to missing hostname verification in SMTPS connections. The target version 2.24.1-tuxcare.3 contains the upstream fix (commit 6851b5083e from April 2020) that adds SSL configuration support with hostname verification via the `mail.smtps.ssl.checkserveridentity` property. This fix was already present in the upstream Apac..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T12:47:41.880696+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl. not_affected \u2014 The target repository (Apache Log4j2 version 2.24.1-tuxcare.3) is NOT AFFECTED by CVE-2021-44832. The vulnerability, which allowed remote code execution via JDBC Appender with malicious JNDI URIs, has been fixed by upstream Apache in commit 05db5f95. This fix was included in the upstream release before TuxCare onboarded version 2.24.1. The fix implements two defense layers: (1) requires explici...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 The target repository (Apache Log4j2 version 2.24.1-tuxcare.3) is NOT AFFECTED by CVE-2021-44832. The vulnerability, which allowed remote code execution via JDBC Appender with malicious JNDI URIs, has been fixed by upstream Apache in commit 05db5f95. This fix was included in the upstream release before TuxCare onboarded version 2.24.1. The fix implements two defense layers: (1) requires explici..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T12:33:45.716823+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl. not_affected \u2014 Target version 2.24.1 is not affected by CVE-2021-45105. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed in upstream Apache Log4j 2.17.2 via commit 17a77f5c27 (LOG4J2-3317). This fix was already present in the upstream release that TuxCare onboarded. The fix uses the LookupResult interface pattern: ContextMapLookup returns DefaultLoo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 Target version 2.24.1 is not affected by CVE-2021-45105. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed in upstream Apache Log4j 2.17.2 via commit 17a77f5c27 (LOG4J2-3317). This fix was already present in the upstream release that TuxCare onboarded. The fix uses the LookupResult interface pattern: ContextMapLookup returns DefaultLoo..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T13:27:21.940300+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T13:27:21.940300+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "action_statement": "Vulnerability CVE-2026-34477 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T13:27:21.940300+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 is fixed in version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl.",
      "vulnerability": {
        "name": "CVE-2026-34478"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T13:27:21.940300+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T13:27:21.940300+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      },
      "action_statement": "Vulnerability CVE-2026-34480 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.24.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T13:27:21.940300+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl.",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "action_statement": "Vulnerability CVE-2026-49844 affects version 2.24.1-tuxcare.3 of org.apache.logging.log4j:log4j-slf4j-impl."
    }
  ]
}