{
  "@id": "urn:uuid:7d273a2c-2397-4b74-b492-ca35993f66a3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T08:00:00.159537+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T04:42:00.149197+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 does not affect version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 CVE-2020-9488 is not affecting the target Apache Log4j 2.19.0-tuxcare.2. The hostname verification fix for SMTPS connections was included in the upstream Apache Log4j 2.19.0 release before TuxCare onboarded it. The fix (commit 6851b5083e by Matt Sicker) adds support for configurable SSL hostname verification via the SslConfiguration.verifyHostName parameter, which sets the JavaMail property mai...",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-9488 is not affecting the target Apache Log4j 2.19.0-tuxcare.2. The hostname verification fix for SMTPS connections was included in the upstream Apache Log4j 2.19.0 release before TuxCare onboarded it. The fix (commit 6851b5083e by Matt Sicker) adds support for configurable SSL hostname verification via the SslConfiguration.verifyHostName parameter, which sets the JavaMail property mai..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:48:11.451074+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 Apache Log4j 2.19.0 is not affected by CVE-2021-44832. The vulnerability requires unrestricted JNDI URI protocols in JDBC Appender configuration, which was fixed in upstream version 2.17.1. The target version 2.19.0 already contains the complete fix from commit 05db5f9527 by Gary Gregory, which added two defense layers: (1) a feature flag (log4j2.enableJndiJdbc) that disables JNDI in JDBC by de...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 Apache Log4j 2.19.0 is not affected by CVE-2021-44832. The vulnerability requires unrestricted JNDI URI protocols in JDBC Appender configuration, which was fixed in upstream version 2.17.1. The target version 2.19.0 already contains the complete fix from commit 05db5f9527 by Gary Gregory, which added two defense layers: (1) a feature flag (log4j2.enableJndiJdbc) that disables JNDI in JDBC by de..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:35:50.891113+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 CVE-2021-45105 is NOT present in Apache Log4j 2.19.0. The vulnerability (uncontrolled recursion from self-referential Thread Context Map lookups causing StackOverflowError) was fixed in upstream version 2.17.0 (December 2021). Version 2.19.0 contains an improved LookupResult-based defense (LOG4J2-3317, January 2022) where DefaultLookupResult.isLookupEvaluationAllowedInValue() returns false, pre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-45105 is NOT present in Apache Log4j 2.19.0. The vulnerability (uncontrolled recursion from self-referential Thread Context Map lookups causing StackOverflowError) was fixed in upstream version 2.17.0 (December 2021). Version 2.19.0 contains an improved LookupResult-based defense (LOG4J2-3317, January 2022) where DefaultLookupResult.isLookupEvaluationAllowedInValue() returns false, pre..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:23:00.078163+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:25:07.334490+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T08:00:00.159537+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 Version 2.19.0 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from the factory pattern (@PluginFactory) to the builder pattern (@PluginBuilderFactory), and configuration attributes were inadvertently renamed. Version 2.19.0 predates this migration and still uses the factory pattern with correctly-named configuration attribut...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Version 2.19.0 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from the factory pattern (@PluginFactory) to the builder pattern (@PluginBuilderFactory), and configuration attributes were inadvertently renamed. Version 2.19.0 predates this migration and still uses the factory pattern with correctly-named configuration attribut..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:23:00.078163+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:23:00.078163+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      },
      "action_statement": "Vulnerability CVE-2026-34480 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:23:00.078163+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "action_statement": "Vulnerability CVE-2026-49844 affects version 2.19.0-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    }
  ]
}