{
  "@id": "urn:uuid:ba6858eb-d885-4bec-89d2-28f74d2364bd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:14:20.152420+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.23.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.23.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:14:20.152420+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.23.1-tuxcare.3 of org.apache.logging.log4j:log4j. CVE-2017-5645 affects Log4j2 versions before 2.8.2 where TCP/UDP socket servers deserialize untrusted serialized binary payloads without class filtering. The target (version 2.23.1-tuxcare.4) is not affected: (1) the vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge, AbstractSocketServer) were completely removed from the main repository in April 2017 (commit 8865124fb11); (2) prior to removal, the fix (FilteredObjectInputStream with class allow-list) was already applied in March 2017 (commit 5dcc19215827db29c993d0305ee2b0d8dd05939d) by upstream author Matt Sicker. Both the fix and the removal are part of the upstream release 2.23.1 that TuxCare onboarded. The target contains no code that accepts serialized binary data from TCP/UDP sockets for deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "CVE-2017-5645 affects Log4j2 versions before 2.8.2 where TCP/UDP socket servers deserialize untrusted serialized binary payloads without class filtering. The target (version 2.23.1-tuxcare.4) is not affected: (1) the vulnerable socket server components (TcpSocketServer, UdpSocketServer, ObjectInputStreamLogEventBridge, AbstractSocketServer) were completely removed from the main repository in April 2017 (commit 8865124fb11); (2) prior to removal, the fix (FilteredObjectInputStream with class allow-list) was already applied in March 2017 (commit 5dcc19215827db29c993d0305ee2b0d8dd05939d) by upstream author Matt Sicker. Both the fix and the removal are part of the upstream release 2.23.1 that TuxCare onboarded. The target contains no code that accepts serialized binary data from TCP/UDP sockets for deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.23.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.23.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T04:44:00.147922+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.23.1-tuxcare.3 of org.apache.logging.log4j:log4j. not_affected \u2014 The target Apache Log4j2 version 2.23.1-tuxcare.4 is NOT AFFECTED by CVE-2020-9488. The vulnerability (improper hostname verification in SMTP appender's SMTPS connections) was fixed by the upstream Apache project in version 2.13.2 (April 2020) via commit 6851b5083e. This fix was already present in the Apache Log4j2 2.23.1 release that TuxCare onboarded. The defense code exists in SmtpManager.ja...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 The target Apache Log4j2 version 2.23.1-tuxcare.4 is NOT AFFECTED by CVE-2020-9488. The vulnerability (improper hostname verification in SMTP appender's SMTPS connections) was fixed by the upstream Apache project in version 2.13.2 (April 2020) via commit 6851b5083e. This fix was already present in the Apache Log4j2 2.23.1 release that TuxCare onboarded. The defense code exists in SmtpManager.ja..."
    }
  ]
}