{
  "@id": "urn:uuid:19ae2fd5-461b-4166-be1d-fdcf6a8815cb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:15:19.421943+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.18.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.18.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:15:19.421943+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.18.0-tuxcare.2 of org.apache.logging.log4j:log4j. The target repository (Apache Log4j 2.18.0) is not affected by CVE-2017-5645. The vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accept serialized log events over TCP/UDP do not exist in this version. These components were removed by Apache upstream in April 2017 (commit 8865124fb1) and moved to a separate Tools repository, well before version 2.18.0 was released in 2022. Version 2.18.0 never contained these vulnerable network-facing deserialization components.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "The target repository (Apache Log4j 2.18.0) is not affected by CVE-2017-5645. The vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accept serialized log events over TCP/UDP do not exist in this version. These components were removed by Apache upstream in April 2017 (commit 8865124fb1) and moved to a separate Tools repository, well before version 2.18.0 was released in 2022. Version 2.18.0 never contained these vulnerable network-facing deserialization components.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.18.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.18.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T04:46:00.073284+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.18.0-tuxcare.2 of org.apache.logging.log4j:log4j. not_affected \u2014 CVE-2020-9488 is not a concern for this version. The fix that enables hostname verification for SMTPS connections was included in upstream Apache Log4j 2.13.2 (via commit 6851b5083e by Matt Sicker) and is present in this 2.18.0 release. The defense code exists in SmtpManager.java:283 where it sets the JavaMail 'checkserveridentity' property to enable hostname validation. However, users must exp...",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 is not a concern for this version. The fix that enables hostname verification for SMTPS connections was included in upstream Apache Log4j 2.13.2 (via commit 6851b5083e by Matt Sicker) and is present in this 2.18.0 release. The defense code exists in SmtpManager.java:283 where it sets the JavaMail 'checkserveridentity' property to enable hostname validation. However, users must exp..."
    }
  ]
}