{
  "@id": "urn:uuid:0cc9f3ae-453e-4b56-8540-56e1c29c1180",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T08:59:51.528820+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.12.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.12.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T08:59:51.528820+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.12.4-tuxcare.4 of org.apache.logging.log4j:log4j. CVE-2017-5645 describes a Java deserialization vulnerability in Log4j 2.x's TCP and UDP socket servers that accept serialized log events from external sources. The vulnerable components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge, and related server infrastructure) do NOT exist in the target repository. These components were moved to a separate apache/logging-log4j-tools repository in April 2017 (commit 8865124fb1), shortly after the upstream security fix was applied in March 2017 (commit 5dcc192158). The target repository (version 2.12.4-tuxcare.3) onboarded by TuxCare already had both the fix and the subsequent architectural removal in its upstream release. Without the socket server entry points that accept network-delivered serialized data, the attack vector described in the CVE cannot be realized in this codebase. While FilteredObjectInputStream (the fix's defense class) exists in the target, it is only used for internal serialization within the library, not for accepting external network input.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "CVE-2017-5645 describes a Java deserialization vulnerability in Log4j 2.x's TCP and UDP socket servers that accept serialized log events from external sources. The vulnerable components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge, and related server infrastructure) do NOT exist in the target repository. These components were moved to a separate apache/logging-log4j-tools repository in April 2017 (commit 8865124fb1), shortly after the upstream security fix was applied in March 2017 (commit 5dcc192158). The target repository (version 2.12.4-tuxcare.3) onboarded by TuxCare already had both the fix and the subsequent architectural removal in its upstream release. Without the socket server entry points that accept network-delivered serialized data, the attack vector described in the CVE cannot be realized in this codebase. While FilteredObjectInputStream (the fix's defense class) exists in the target, it is only used for internal serialization within the library, not for accepting external network input.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.12.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.12.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T08:59:51.528820+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.12.4-tuxcare.4 of org.apache.logging.log4j:log4j. not_affected \u2014 The target repository (version 2.12.4-tuxcare.3, SHA 8621950d2b) is NOT vulnerable to CVE-2020-9488. The fix for hostname verification in SMTPS connections was already present in the upstream Apache Log4j 2.12.4 release that TuxCare onboarded. The defense code (verifyHostName parameter and mail.smtps.ssl.checkserveridentity property) exists in both SslConfiguration.java and SmtpManager.java, pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 The target repository (version 2.12.4-tuxcare.3, SHA 8621950d2b) is NOT vulnerable to CVE-2020-9488. The fix for hostname verification in SMTPS connections was already present in the upstream Apache Log4j 2.12.4 release that TuxCare onboarded. The defense code (verifyHostName parameter and mail.smtps.ssl.checkserveridentity property) exists in both SslConfiguration.java and SmtpManager.java, pr..."
    }
  ]
}