{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:46841649-52b5-5a82-9087-335c654ec93a", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3", "type": "library", "group": "org.apache.logging.log4j", "name": "log4j-cassandra", "version": "2.22.1-tuxcare.3", "purl": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:4d71ae0e-7253-5d8c-8499-cb0e7fc00c02", "id": "CVE-2014-8180", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2014-8180 is a false positive for org.apache.logging.log4j:log4j-cassandra 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9c0b7f84-a46e-5079-a989-2b97b1fc7ce1", "id": "CVE-2016-6494", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2016-6494 is a false positive for org.apache.logging.log4j:log4j-cassandra 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:36535740-32f1-5c8f-8119-3c2f876a23eb", "id": "CVE-2021-32036", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-32036 is a false positive for org.apache.logging.log4j:log4j-cassandra 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:34c1ffe4-3de9-5022-bb06-1787280dc983", "id": "CVE-2021-38295", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-38295 is a false positive for org.apache.logging.log4j:log4j-cassandra 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9801117d-0806-50cd-ac83-ebd1e99eac8b", "id": "CVE-2022-24706", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-24706 is a false positive for org.apache.logging.log4j:log4j-cassandra 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2275a73d-af74-568d-82ed-8e8540580dc8", "id": "CVE-2023-26268", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-26268 is a false positive for org.apache.logging.log4j:log4j-cassandra 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:767bb726-7c34-5f40-91a5-15b3d800dd9e", "id": "CVE-2023-45725", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-45725 is a false positive for org.apache.logging.log4j:log4j-cassandra 2.22.1-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:496b1edd-5cb4-5556-8264-811078db6ceb", "id": "CVE-2025-68161", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-68161 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-cassandra." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bc8365c8-14e6-529a-a016-8bb8240345ce", "id": "CVE-2026-34477", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34477 affects version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-cassandra." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4fdd4466-be56-5476-aab2-9602ea8538b6", "id": "CVE-2026-34478", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-34478 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-cassandra. Version not vulnerable (per prereq analysis); terminalized." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d38a9bd4-a76e-59dc-8b1f-4e3a46dec859", "id": "CVE-2026-34479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34479 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-cassandra." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:35788fc6-32c1-5ba3-a893-531f01ab5a13", "id": "CVE-2026-34480", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-34480 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-cassandra. Version 2.22.1 is not vulnerable. Summary: The target repository version 2.22.1-tuxcare.1 is NOT VULNERABLE to CVE-2026-34480. While the XmlLayout feature exists, the sanitization fix that addresses the vulnerability has been backported and is fully implemented in the current codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:25c7e8f5-2f9e-5f3e-b865-d0687b6632bb", "id": "CVE-2026-34481", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34481 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-cassandra." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:521673ce-84b7-56d6-b40e-76d5154969fd", "id": "CVE-2026-49844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49844 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-cassandra." }, "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-cassandra@2.22.1-tuxcare.3" } ] }