{
  "@id": "urn:uuid:99171841-2df5-4bb1-8a58-665bd91aa435",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:12:40.044104+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:12:40.044104+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j. CVE-2017-5645 affects TcpSocketServer and UdpSocketServer classes that deserialize network-received log events without class filtering, enabling arbitrary code execution. These vulnerable components were completely removed from the main Apache Log4j2 distribution in version 2.9.0 (April 2017, commit 8865124fb1) and moved to a separate Tools repository. The target version 2.17.2 does not contain these socket server classes at all. Exhaustive search confirmed no network-based deserialization entry points exist in the current codebase. The only socket-related component found is SocketAppender, which is an outbound sender, not an inbound receiver. The removal was an upstream change that shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "CVE-2017-5645 affects TcpSocketServer and UdpSocketServer classes that deserialize network-received log events without class filtering, enabling arbitrary code execution. These vulnerable components were completely removed from the main Apache Log4j2 distribution in version 2.9.0 (April 2017, commit 8865124fb1) and moved to a separate Tools repository. The target version 2.17.2 does not contain these socket server classes at all. Exhaustive search confirmed no network-based deserialization entry points exist in the current codebase. The only socket-related component found is SocketAppender, which is an outbound sender, not an inbound receiver. The removal was an upstream change that shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T04:44:00.147922+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j. not_affected \u2014 CVE-2020-9488 affects Apache Log4j versions prior to 2.13.2. The target version 2.17.2 includes the upstream fix that adds SSL/TLS hostname verification capability for SMTP appender. The fix was authored by Apache committer Matt Sicker (boards@gmail.com) in commit 6851b5083e on April 13, 2020, and was included in the upstream 2.17.2 release that TuxCare onboarded. The vulnerable code pattern (c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 affects Apache Log4j versions prior to 2.13.2. The target version 2.17.2 includes the upstream fix that adds SSL/TLS hostname verification capability for SMTP appender. The fix was authored by Apache committer Matt Sicker (boards@gmail.com) in commit 6851b5083e on April 13, 2020, and was included in the upstream 2.17.2 release that TuxCare onboarded. The vulnerable code pattern (c..."
    }
  ]
}