{
  "@id": "urn:uuid:65296d14-0821-4cc5-a293-31884a8f4ee4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T12:50:32.466749+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:50:32.466749+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json. not_affected \u2014 CVE-2021-44832 is NOT present in this target. The vulnerability affects Apache Log4j2 versions 2.0-beta7 through 2.17.0, allowing RCE via JDBC Appender with malicious JNDI URI data sources. The target (version 2.20.0-tuxcare.3) contains the complete upstream fix from commit 05db5f9527, which was included in upstream 2.20.0 release. Both defense layers are present: (1) JNDI JDBC disabled by defa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-44832 is NOT present in this target. The vulnerability affects Apache Log4j2 versions 2.0-beta7 through 2.17.0, allowing RCE via JDBC Appender with malicious JNDI URI data sources. The target (version 2.20.0-tuxcare.3) contains the complete upstream fix from commit 05db5f9527, which was included in upstream 2.20.0 release. Both defense layers are present: (1) JNDI JDBC disabled by defa..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:36:25.736244+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json. not_affected \u2014 CVE-2021-45105 is not present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability was fixed in upstream Apache Log4j 2.17.0 (commit 806023265f, December 2021) and later refactored in 2.17.1 (commit 17a77f5c27, January 2022). Both commits were already present in the Apache Log4j 2.20.0 upstream release before TuxCare onboarded it. The fix prevents uncontrolled recursion from self-referential loo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-45105 is not present in Apache Log4j 2.20.0-tuxcare.3. The vulnerability was fixed in upstream Apache Log4j 2.17.0 (commit 806023265f, December 2021) and later refactored in 2.17.1 (commit 17a77f5c27, January 2022). Both commits were already present in the Apache Log4j 2.20.0 upstream release before TuxCare onboarded it. The fix prevents uncontrolled recursion from self-referential loo..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T19:20:00.402138+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T19:20:00.402138+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T18:38:29.397001+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "action_statement": "Vulnerability CVE-2026-34478 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T19:20:00.402138+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T19:18:49.373232+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      },
      "action_statement": "Vulnerability CVE-2026-34480 affects version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T19:20:00.402138+00:00",
      "status_notes": "Vulnerability CVE-2026-34481 is fixed in version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2026-34481"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.20.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T19:20:00.402138+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 is fixed in version 2.20.0-tuxcare.2 of org.apache.logging.log4j:log4j-layout-template-json.",
      "vulnerability": {
        "name": "CVE-2026-49844"
      }
    }
  ]
}