{
  "@id": "urn:uuid:3c20771f-776c-47a2-9d3d-f778b72cc6d4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:16:16.415526+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2014-8180 is a false positive for org.apache.logging.log4j:log4j 2.22.1-tuxcare.2. direct vulnerability is in MongoDB Server project",
      "vulnerability": {
        "name": "CVE-2014-8180"
      },
      "impact_statement": "direct vulnerability is in MongoDB Server project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2016-6494 is a false positive for org.apache.logging.log4j:log4j 2.22.1-tuxcare.2. direct vulnerability is in MongoDB Server project",
      "vulnerability": {
        "name": "CVE-2016-6494"
      },
      "impact_statement": "direct vulnerability is in MongoDB Server project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:16:16.415526+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.22.1-tuxcare.2 of org.apache.logging.log4j:log4j. CVE-2017-5645 does not affect Log4j 2.22.1. The vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) were fixed in upstream version 2.8.2 (commit 5dcc192158, March 2017) and subsequently removed from the main repository (commit 8865124fb1, April 2017), relocated to a separate Apache Logging Tools repository. The target version 2.22.1 does not contain these components, making the attack vector described in the CVE impossible to exploit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "CVE-2017-5645 does not affect Log4j 2.22.1. The vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge) were fixed in upstream version 2.8.2 (commit 5dcc192158, March 2017) and subsequently removed from the main repository (commit 8865124fb1, April 2017), relocated to a separate Apache Logging Tools repository. The target version 2.22.1 does not contain these components, making the attack vector described in the CVE impossible to exploit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T04:46:00.073284+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.22.1-tuxcare.2 of org.apache.logging.log4j:log4j. not_affected \u2014 CVE-2020-9488 affects Apache Log4j2 versions prior to 2.13.2 due to improper hostname verification in SMTP over TLS connections. The target repository (version 2.22.1-tuxcare.3) is NOT AFFECTED because the upstream vendor (Apache) already fixed this vulnerability in the 2.22.1 release that TuxCare onboarded. The fix enables hostname verification via the mail.smtps.ssl.checkserveridentity proper...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 affects Apache Log4j2 versions prior to 2.13.2 due to improper hostname verification in SMTP over TLS connections. The target repository (version 2.22.1-tuxcare.3) is NOT AFFECTED because the upstream vendor (Apache) already fixed this vulnerability in the 2.22.1 release that TuxCare onboarded. The fix enables hostname verification via the mail.smtps.ssl.checkserveridentity proper..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2021-32036 is a false positive for org.apache.logging.log4j:log4j 2.22.1-tuxcare.2. direct vulnerability is in MongoDB Server project",
      "vulnerability": {
        "name": "CVE-2021-32036"
      },
      "impact_statement": "direct vulnerability is in MongoDB Server project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2021-38295 is a false positive for org.apache.logging.log4j:log4j 2.22.1-tuxcare.2. direct vulnerability is in Apache CouchDB project",
      "vulnerability": {
        "name": "CVE-2021-38295"
      },
      "impact_statement": "direct vulnerability is in Apache CouchDB project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2022-24706 is a false positive for org.apache.logging.log4j:log4j 2.22.1-tuxcare.2. direct vulnerability is in Apache CouchDB project",
      "vulnerability": {
        "name": "CVE-2022-24706"
      },
      "impact_statement": "direct vulnerability is in Apache CouchDB project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2023-26268 is a false positive for org.apache.logging.log4j:log4j 2.22.1-tuxcare.2. direct vulnerability is in Apache CouchDB project",
      "vulnerability": {
        "name": "CVE-2023-26268"
      },
      "impact_statement": "direct vulnerability is in Apache CouchDB project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.22.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2023-45725 is a false positive for org.apache.logging.log4j:log4j 2.22.1-tuxcare.2. direct vulnerability is in Apache CouchDB project",
      "vulnerability": {
        "name": "CVE-2023-45725"
      },
      "impact_statement": "direct vulnerability is in Apache CouchDB project"
    }
  ]
}