{
  "@id": "urn:uuid:0b82691b-f4e9-4e6b-b632-14a59d46fb47",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T04:50:00.399992+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:56:13.682132+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T04:50:00.399992+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client. not_affected \u2014 CVE-2020-9488 is not affecting the target. The vulnerability concerned the lack of SSL/TLS hostname verification capability in the SMTP appender prior to Apache Log4j 2.13.2. The fix (commit 6851b5083e, authored by Matt Sicker) was included in the upstream 2.13.2 release and is present in target version 2.25.2. The fix adds a configurable `verifyHostName` option that enables JavaMail hostname v...",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 is not affecting the target. The vulnerability concerned the lack of SSL/TLS hostname verification capability in the SMTP appender prior to Apache Log4j 2.13.2. The fix (commit 6851b5083e, authored by Matt Sicker) was included in the upstream 2.13.2 release and is present in target version 2.25.2. The fix adds a configurable `verifyHostName` option that enables JavaMail hostname v..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:56:13.682132+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:51:01.814059+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client. not_affected \u2014 CVE-2021-44832 is NOT present in the target Apache Log4j2 version 2.25.2. The upstream vendor fix (commit 05db5f95) was already included in the upstream release that TuxCare onboarded. The fix adds two defenses: (1) requires explicit opt-in via system property log4j2.enableJndiJdbc=true (disabled by default), and (2) validates JNDI URIs to allow only the \"java:\" protocol scheme, rejecting ldap:...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-44832 is NOT present in the target Apache Log4j2 version 2.25.2. The upstream vendor fix (commit 05db5f95) was already included in the upstream release that TuxCare onboarded. The fix adds two defenses: (1) requires explicit opt-in via system property log4j2.enableJndiJdbc=true (disabled by default), and (2) validates JNDI URIs to allow only the \"java:\" protocol scheme, rejecting ldap:..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:56:13.682132+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:36:59.913988+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client. not_affected \u2014 Apache Log4j2 version 2.25.2 is not affected by CVE-2021-45105. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed in upstream release 2.17.0 via commit 806023265f authored by Carter Kozak. The target version 2.25.2 contains this upstream fix, which has evolved into a more sophisticated protection mechanism using the LookupResult interf...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 Apache Log4j2 version 2.25.2 is not affected by CVE-2021-45105. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed in upstream release 2.17.0 via commit 806023265f authored by Carter Kozak. The target version 2.25.2 contains this upstream fix, which has evolved into a more sophisticated protection mechanism using the LookupResult interf..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:56:13.682132+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:56:13.682132+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:56:13.682132+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:56:13.682132+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 is fixed in version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2026-34478"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:56:13.682132+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:56:13.682132+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      },
      "action_statement": "Vulnerability CVE-2026-34480 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-spring-cloud-config-client@2.25.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:56:13.682132+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client.",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "action_statement": "Vulnerability CVE-2026-49844 affects version 2.25.2-tuxcare.1 of org.apache.logging.log4j:log4j-spring-cloud-config-client."
    }
  ]
}