{
  "@id": "urn:uuid:0799a880-924e-485d-b16a-8192d1e96118",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:15:19.421943+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.20.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.20.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:15:19.421943+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.20.0-tuxcare.3 of org.apache.logging.log4j:log4j. The target Apache Log4j 2.20.0 is NOT AFFECTED by CVE-2017-5645. The vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accept and deserialize log events over TCP/UDP network connections were removed from the main Log4j repository in April 2017 (commit 8865124fb1) and moved to a separate Tools repository. Version 2.20.0 does not contain any server components that receive serialized log events over network. The fix commit (5dcc192158) that added FilteredObjectInputStream was already in the upstream Apache Log4j 2.20.0 release before TuxCare onboarded it. Rule 5 Type A1 applies: the Brief's INPUT (serialized Java objects received over TCP/UDP socket) is not received anywhere in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "The target Apache Log4j 2.20.0 is NOT AFFECTED by CVE-2017-5645. The vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accept and deserialize log events over TCP/UDP network connections were removed from the main Log4j repository in April 2017 (commit 8865124fb1) and moved to a separate Tools repository. Version 2.20.0 does not contain any server components that receive serialized log events over network. The fix commit (5dcc192158) that added FilteredObjectInputStream was already in the upstream Apache Log4j 2.20.0 release before TuxCare onboarded it. Rule 5 Type A1 applies: the Brief's INPUT (serialized Java objects received over TCP/UDP socket) is not received anywhere in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.20.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.20.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T04:46:00.073284+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.20.0-tuxcare.3 of org.apache.logging.log4j:log4j. not_affected \u2014 CVE-2020-9488 is not present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability concerning improper SSL/TLS hostname verification in the SMTP appender was fixed by upstream commit 6851b5083e (LOG4J2-2819) authored by Matt Sicker, which was already included in the upstream Apache Log4j 2.20.0 release that TuxCare onboarded. The fix adds SslConfiguration support with a verifyHostName parameter t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 is not present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability concerning improper SSL/TLS hostname verification in the SMTP appender was fixed by upstream commit 6851b5083e (LOG4J2-2819) authored by Matt Sicker, which was already included in the upstream Apache Log4j 2.20.0 release that TuxCare onboarded. The fix adds SslConfiguration support with a verifyHostName parameter t..."
    }
  ]
}