{
  "@id": "urn:uuid:83bf3ac9-fe20-4055-a8e9-2e3ddf0a8c4a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T12:46:44.245433+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:46:44.245433+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json. not_affected \u2014 CVE-2021-44832 is not present in this target. The vulnerability was fixed in upstream Apache Log4j2 version 2.17.1 (released December 2021) by commit 05db5f9527254632b59aed2a1d78a32c5ab74f16, authored by Gary Gregory. TuxCare onboarded version 2.17.2 in commit 41033c5d1f52bdd02ed207cbb538556163b8aae5, which already contained this upstream fix. The vulnerable pattern (unrestricted JNDI lookups i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-44832 is not present in this target. The vulnerability was fixed in upstream Apache Log4j2 version 2.17.1 (released December 2021) by commit 05db5f9527254632b59aed2a1d78a32c5ab74f16, authored by Gary Gregory. TuxCare onboarded version 2.17.2 in commit 41033c5d1f52bdd02ed207cbb538556163b8aae5, which already contained this upstream fix. The vulnerable pattern (unrestricted JNDI lookups i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:31:30.473956+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json. not_affected \u2014 Target repository Log4j 2.17.2 is not affected by CVE-2021-45105. The vulnerability was fixed in upstream release 2.17.0 by commit 806023265f, which was included in the 2.17.2 release that TuxCare onboarded. The defense mechanism uses a LookupResult interface where isLookupEvaluationAllowedInValue() defaults to false for runtime data sources like Thread Context Map, preventing recursive evaluat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 Target repository Log4j 2.17.2 is not affected by CVE-2021-45105. The vulnerability was fixed in upstream release 2.17.0 by commit 806023265f, which was included in the 2.17.2 release that TuxCare onboarded. The defense mechanism uses a LookupResult interface where isLookupEvaluationAllowedInValue() defaults to false for runtime data sources like Thread Context Map, preventing recursive evaluat..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T18:38:29.397001+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "action_statement": "Vulnerability CVE-2026-34478 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34481 is fixed in version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2026-34481"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.17.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "action_statement": "Vulnerability CVE-2026-49844 affects version 2.17.2-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    }
  ]
}