{
  "@id": "urn:uuid:10229043-fec7-4e3e-81dc-cdac77d7f20d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T12:47:41.880696+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:47:41.880696+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 does not affect version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web. not_affected \u2014 The target Apache Log4j2 version 2.23.1-tuxcare.4 is NOT AFFECTED by CVE-2021-44832. The vulnerability allowed attackers with configuration file write access to construct malicious JDBC Appender configurations using JNDI URIs pointing to attacker-controlled LDAP/RMI servers for remote code execution. The complete upstream security fix was already present in Apache Log4j2 version 2.17.1 (release...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "impact_statement": "not_affected \u2014 The target Apache Log4j2 version 2.23.1-tuxcare.4 is NOT AFFECTED by CVE-2021-44832. The vulnerability allowed attackers with configuration file write access to construct malicious JDBC Appender configurations using JNDI URIs pointing to attacker-controlled LDAP/RMI servers for remote code execution. The complete upstream security fix was already present in Apache Log4j2 version 2.17.1 (release..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:34:18.314121+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 does not affect version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web. not_affected \u2014 The target repository (Apache Log4j 2.23.1-tuxcare.4) is not affected by CVE-2021-45105. The vulnerability, which allowed uncontrolled recursion from self-referential lookups in Thread Context Map data, has been fixed by upstream Apache commits that were already present in the 2.23.1 release. The fix prevents recursive evaluation of runtime lookups (including Thread Context Map data) by using t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "impact_statement": "not_affected \u2014 The target repository (Apache Log4j 2.23.1-tuxcare.4) is not affected by CVE-2021-45105. The vulnerability, which allowed uncontrolled recursion from self-referential lookups in Thread Context Map data, has been fixed by upstream Apache commits that were already present in the 2.23.1 release. The fix prevents recursive evaluation of runtime lookups (including Thread Context Map data) by using t..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-07T12:29:00.086787+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 is fixed in version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-07T12:29:00.086787+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 is fixed in version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-07T12:14:00.139459+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web. Version not vulnerable (per prereq analysis); terminalized.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "Version not vulnerable (per prereq analysis); terminalized."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-07T12:14:00.139459+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-07T12:29:00.086787+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-web@2.23.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-07T12:14:00.139459+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 is fixed in version 2.23.1-tuxcare.2 of org.apache.logging.log4j:log4j-web.",
      "vulnerability": {
        "name": "CVE-2026-49844"
      }
    }
  ]
}