{
  "@id": "urn:uuid:3582c923-41ee-45ba-95c8-a9f63921c4d4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T18:40:37.502257+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.24.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.24.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T18:40:37.502257+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.24.1-tuxcare.4 of org.apache.logging.log4j:log4j. The target repository (Apache Log4j 2.24.1) is not affected by CVE-2017-5645. The vulnerability concerned unsafe deserialization in TCP/UDP socket servers that received serialized log events. The upstream fix (adding FilteredObjectInputStream class whitelisting) was applied in commit 5dcc19215827db29c993d0305ee2b0d8dd05939d on 2017-04-02, which shipped in the upstream release before TuxCare onboarding. Subsequently, on 2017-04-11, the entire vulnerable component (TcpSocketServer, UdpSocketServer, AbstractSocketServer) was removed from the repository and moved to a separate Tools repo (commit 8865124fb1). The target contains neither the vulnerable pre-fix code nor the socket server infrastructure that would receive serialized log events over the network. Rule 5 Type A1 satisfied: the INPUT type (serialized binary data sent to TCP/UDP socket server) is not received anywhere in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "The target repository (Apache Log4j 2.24.1) is not affected by CVE-2017-5645. The vulnerability concerned unsafe deserialization in TCP/UDP socket servers that received serialized log events. The upstream fix (adding FilteredObjectInputStream class whitelisting) was applied in commit 5dcc19215827db29c993d0305ee2b0d8dd05939d on 2017-04-02, which shipped in the upstream release before TuxCare onboarding. Subsequently, on 2017-04-11, the entire vulnerable component (TcpSocketServer, UdpSocketServer, AbstractSocketServer) was removed from the repository and moved to a separate Tools repo (commit 8865124fb1). The target contains neither the vulnerable pre-fix code nor the socket server infrastructure that would receive serialized log events over the network. Rule 5 Type A1 satisfied: the INPUT type (serialized binary data sent to TCP/UDP socket server) is not received anywhere in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.24.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.24.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T18:40:37.502257+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.24.1-tuxcare.4 of org.apache.logging.log4j:log4j. not_affected \u2014 CVE-2020-9488 affects Apache Log4j SMTP appender prior to version 2.13.2 due to missing hostname verification in SMTPS connections. The target version 2.24.1-tuxcare.3 contains the upstream fix (commit 6851b5083e from April 2020) that adds SSL configuration support with hostname verification via the `mail.smtps.ssl.checkserveridentity` property. This fix was already present in the upstream Apac...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 affects Apache Log4j SMTP appender prior to version 2.13.2 due to missing hostname verification in SMTPS connections. The target version 2.24.1-tuxcare.3 contains the upstream fix (commit 6851b5083e from April 2020) that adds SSL configuration support with hostname verification via the `mail.smtps.ssl.checkserveridentity` property. This fix was already present in the upstream Apac..."
    }
  ]
}