{
  "@id": "urn:uuid:f4c2f73b-b9fe-41ff-a39a-f1e9cd1a1eb8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:13:29.842653+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.19.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.19.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:13:29.842653+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.19.0-tuxcare.1 of org.apache.logging.log4j:log4j. Apache Log4j 2.19.0 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server components (TcpSocketServer, UdpSocketServer) that could deserialize untrusted serialized objects were completely removed from the logging-log4j2 repository in commit 8865124fb1 (April 2017), well before version 2.19.0. These server components do not exist in the target version. The fix for the vulnerability (commit 5dcc192158) was authored by upstream Apache developer Matt Sicker and was already present in the upstream release when TuxCare onboarded version 2.19.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "Apache Log4j 2.19.0 is not affected by CVE-2017-5645. The vulnerable TCP/UDP socket server components (TcpSocketServer, UdpSocketServer) that could deserialize untrusted serialized objects were completely removed from the logging-log4j2 repository in commit 8865124fb1 (April 2017), well before version 2.19.0. These server components do not exist in the target version. The fix for the vulnerability (commit 5dcc192158) was authored by upstream Apache developer Matt Sicker and was already present in the upstream release when TuxCare onboarded version 2.19.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.19.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.19.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T04:42:00.149197+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.19.0-tuxcare.1 of org.apache.logging.log4j:log4j. not_affected \u2014 CVE-2020-9488 is not affecting the target Apache Log4j 2.19.0-tuxcare.2. The hostname verification fix for SMTPS connections was included in the upstream Apache Log4j 2.19.0 release before TuxCare onboarded it. The fix (commit 6851b5083e by Matt Sicker) adds support for configurable SSL hostname verification via the SslConfiguration.verifyHostName parameter, which sets the JavaMail property mai...",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 is not affecting the target Apache Log4j 2.19.0-tuxcare.2. The hostname verification fix for SMTPS connections was included in the upstream Apache Log4j 2.19.0 release before TuxCare onboarded it. The fix (commit 6851b5083e by Matt Sicker) adds support for configurable SSL hostname verification via the SslConfiguration.verifyHostName parameter, which sets the JavaMail property mai..."
    }
  ]
}