{
  "@id": "urn:uuid:d2560189-9f4a-4850-8e21-f4ff59a6002c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:16:16.415526+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.11.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.11.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:16:16.415526+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.11.1-tuxcare.1 of org.apache.logging.log4j:log4j. CVE-2017-5645 affects TcpSocketServer and UdpSocketServer classes that receive serialized log events over network sockets. These classes do not exist in the target repository at version 2.11.1. The vulnerability was fixed in upstream version 2.8.2 (commit 5dcc192158, March 2017), and the affected classes were subsequently moved to a separate Tools repository (commit 8865124fb1, April 2017). Both changes occurred before version 2.11.1 was released. The target version never contained the vulnerable code path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "CVE-2017-5645 affects TcpSocketServer and UdpSocketServer classes that receive serialized log events over network sockets. These classes do not exist in the target repository at version 2.11.1. The vulnerability was fixed in upstream version 2.8.2 (commit 5dcc192158, March 2017), and the affected classes were subsequently moved to a separate Tools repository (commit 8865124fb1, April 2017). Both changes occurred before version 2.11.1 was released. The target version never contained the vulnerable code path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.11.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.11.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-02T12:45:13.890718+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.11.1-tuxcare.1 of org.apache.logging.log4j:log4j.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.11.1-tuxcare.1 of org.apache.logging.log4j:log4j."
    }
  ]
}