{
  "@id": "urn:uuid:afda19bb-57f8-4741-bb71-ff3a981f83a7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:15:19.421943+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.24.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.24.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:15:19.421943+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j. CVE-2017-5645 is not present in Apache Log4j 2.24.3-tuxcare.5. The vulnerable TcpSocketServer and UdpSocketServer components that accepted serialized log events over network sockets were fixed by upstream commit 5dcc192158 (adding FilteredObjectInputStream class filtering) and later removed entirely in commit 8865124fb1 (moved to separate Tools repository). Both commits were authored upstream and included in the release 2.24.3 that TuxCare onboarded. The input-receiving code no longer exists in this distribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "CVE-2017-5645 is not present in Apache Log4j 2.24.3-tuxcare.5. The vulnerable TcpSocketServer and UdpSocketServer components that accepted serialized log events over network sockets were fixed by upstream commit 5dcc192158 (adding FilteredObjectInputStream class filtering) and later removed entirely in commit 8865124fb1 (moved to separate Tools repository). Both commits were authored upstream and included in the release 2.24.3 that TuxCare onboarded. The input-receiving code no longer exists in this distribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j@2.24.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j@2.24.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T04:46:00.073284+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.24.3-tuxcare.2 of org.apache.logging.log4j:log4j. not_affected \u2014 CVE-2020-9488 affects Apache Log4j SMTP appender prior to version 2.13.2 due to improper hostname verification in SMTPS connections. The target repository is at version 2.24.3-tuxcare.5, which inherited the fix from upstream Apache Log4j 2.13.2 release. The fix (commit 6851b5083ef9610bae320bf07e1f24d2aa08851b by Matt Sicker) adds verifyHostName support to SslConfiguration and SmtpManager proper...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 affects Apache Log4j SMTP appender prior to version 2.13.2 due to improper hostname verification in SMTPS connections. The target repository is at version 2.24.3-tuxcare.5, which inherited the fix from upstream Apache Log4j 2.13.2 release. The fix (commit 6851b5083ef9610bae320bf07e1f24d2aa08851b by Matt Sicker) adds verifyHostName support to SslConfiguration and SmtpManager proper..."
    }
  ]
}