{
  "@id": "urn:uuid:337027f2-7a6d-4cdc-872d-11f3d1245955",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T09:37:33.117519+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.21.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.21.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T09:37:33.117519+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.21.1-tuxcare.3 of org.apache.logging.log4j:log4j. The target version 2.21.1 does not contain the vulnerable TCP/UDP socket server code (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accepts serialized log events. These classes were removed from the Apache Log4j2 project by upstream commit 8865124fb1 when the log4j-server module was moved to a separate Tools repository during the 2.8.2 release cycle. Since version 2.21.1 was released much later, it never contained this vulnerable server-side functionality. The CVE-2017-5645 vulnerability cannot manifest because the attack surface (server-side deserialization of untrusted log events over TCP/UDP) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "The target version 2.21.1 does not contain the vulnerable TCP/UDP socket server code (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) that accepts serialized log events. These classes were removed from the Apache Log4j2 project by upstream commit 8865124fb1 when the log4j-server module was moved to a separate Tools repository during the 2.8.2 release cycle. Since version 2.21.1 was released much later, it never contained this vulnerable server-side functionality. The CVE-2017-5645 vulnerability cannot manifest because the attack surface (server-side deserialization of untrusted log events over TCP/UDP) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.21.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.21.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T09:37:33.117519+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.21.1-tuxcare.3 of org.apache.logging.log4j:log4j. not_affected \u2014 CVE-2020-9488 fix for SMTP hostname verification was already present in upstream Apache Log4j 2.21.1 release. The fix (commit 6851b5083e by Matt Sicker, April 2020) adds SSL configuration support and hostname verification capability via mail.smtps.ssl.checkserveridentity property. This commit is an ancestor of TuxCare's onboarding commit 7bbf7f9c41, confirming the fix shipped with the upstream ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 fix for SMTP hostname verification was already present in upstream Apache Log4j 2.21.1 release. The fix (commit 6851b5083e by Matt Sicker, April 2020) adds SSL configuration support and hostname verification capability via mail.smtps.ssl.checkserveridentity property. This commit is an ancestor of TuxCare's onboarding commit 7bbf7f9c41, confirming the fix shipped with the upstream ..."
    }
  ]
}