{
  "@id": "urn:uuid:ee7ecc18-6e92-476f-b4ff-9ef86cb7e0da",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T12:47:41.880696+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:47:41.880696+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 The target repository (Apache Log4j2 version 2.24.1-tuxcare.3) is NOT AFFECTED by CVE-2021-44832. The vulnerability, which allowed remote code execution via JDBC Appender with malicious JNDI URIs, has been fixed by upstream Apache in commit 05db5f95. This fix was included in the upstream release before TuxCare onboarded version 2.24.1. The fix implements two defense layers: (1) requires explici...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 The target repository (Apache Log4j2 version 2.24.1-tuxcare.3) is NOT AFFECTED by CVE-2021-44832. The vulnerability, which allowed remote code execution via JDBC Appender with malicious JNDI URIs, has been fixed by upstream Apache in commit 05db5f95. This fix was included in the upstream release before TuxCare onboarded version 2.24.1. The fix implements two defense layers: (1) requires explici..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:33:45.716823+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker. not_affected \u2014 Target version 2.24.1 is not affected by CVE-2021-45105. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed in upstream Apache Log4j 2.17.2 via commit 17a77f5c27 (LOG4J2-3317). This fix was already present in the upstream release that TuxCare onboarded. The fix uses the LookupResult interface pattern: ContextMapLookup returns DefaultLoo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 Target version 2.24.1 is not affected by CVE-2021-45105. The vulnerability (uncontrolled recursion from self-referential lookups in Thread Context Map data) was fixed in upstream Apache Log4j 2.17.2 via commit 17a77f5c27 (LOG4J2-3317). This fix was already present in the upstream release that TuxCare onboarded. The fix uses the LookupResult interface pattern: ContextMapLookup returns DefaultLoo..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:18:00.156680+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:18:00.156680+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "action_statement": "Vulnerability CVE-2026-34477 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:18:00.156680+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 is fixed in version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-34478"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:18:00.156680+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:18:00.156680+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      },
      "action_statement": "Vulnerability CVE-2026-34480 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-docker@2.24.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:18:00.156680+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker.",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "action_statement": "Vulnerability CVE-2026-49844 affects version 2.24.1-tuxcare.2 of org.apache.logging.log4j:log4j-docker."
    }
  ]
}