@intentius/chant 0.41.20 → 0.44.1

package/src/codegen/okf-lexicon.ts

@@ -0,0 +1,303 @@
+/**
+ * Lexicon OKF knowledge bundle (#1060, epic #1057) — projects a packaged
+ * lexicon's resource-type registry and lint rules into an Open Knowledge
+ * Format v0.2 bundle, emitted alongside the other build artifacts
+ * (`dist/meta.json`, `dist/types/`) as `dist/okf/`.
+ *
+ * Vocabulary, resolved against the project bundle (#1058, ../okf.ts): there a
+ * concept's `type` IS the entity's resource type; here `type` is the concept
+ * *category* — `resource-type`, `lint-rule`, `post-synth-check` — and the
+ * resource type string rides in `resource_type`. A consumer tells the two
+ * bundle kinds apart by exactly that.
+ *
+ * Cross-links run both directions: a resource concept lists the rules that
+ * govern it under "Governed by", a rule concept lists the types it applies to
+ * under "Applies to". The association is derived from the rule's source text
+ * (rules match on identifiers, not declared type lists), so it is a textual
+ * over-approximation — acceptable for knowledge, wrong for enforcement.
+ */
+
+import * as ts from "typescript";
+import { frontmatter, slug, OKF_VERSION, type OkfFile } from "../okf";
+import type { ScannedRule } from "./docs-rule-scanning";
+
+export interface LexiconOkfInput {
+  /** Lexicon name as the manifest states it, e.g. "aws". */
+  name: string;
+  /** The registry JSON — the exact content of `dist/meta.json`. */
+  registry: string;
+  /** The generated declarations — the content of `dist/types/index.d.ts`. */
+  typesDTS: string;
+  /** Scanned rules with their sources, for metadata and type association. */
+  rules: ScannedRule[];
+}
+
+interface RegistryEntry {
+  resourceType?: unknown;
+  kind?: unknown;
+  description?: unknown;
+  properties?: Record<string, { type?: string; description?: string }>;
+  attrs?: Record<string, string>;
+}
+
+interface ConceptProperty {
+  name: string;
+  type?: string;
+  required?: boolean;
+  description?: string;
+}
+
+interface TypeConcept {
+  className: string;
+  resourceType: string;
+  description?: string;
+  properties: ConceptProperty[];
+  attributes: string[];
+  path: string;
+}
+
+/** Collapse whitespace so a description fits a frontmatter scalar or a list line. */
+function oneLine(text: string): string {
+  return text.replace(/\s+/g, " ").trim();
+}
+
+function truncate(text: string, max: number): string {
+  return text.length <= max ? text : `${text.slice(0, max - 3).trimEnd()}...`;
+}
+
+/**
+ * Per-class constructor property docs, parsed out of the generated
+ * declarations. This is where CloudFormation- and OpenAPI-derived lexicons
+ * carry their spec-sourced property descriptions (the registry carries them
+ * only for hand-authored lexicons like docker).
+ */
+function parseDtsProperties(typesDTS: string): Map<string, ConceptProperty[]> {
+  const out = new Map<string, ConceptProperty[]>();
+  if (!typesDTS.includes("constructor")) return out;
+  const sf = ts.createSourceFile("types.d.ts", typesDTS, ts.ScriptTarget.Latest, false, ts.ScriptKind.TS);
+  for (const stmt of sf.statements) {
+    if (!ts.isClassDeclaration(stmt) || !stmt.name) continue;
+    const ctor = stmt.members.find(ts.isConstructorDeclaration);
+    const param = ctor?.parameters[0];
+    if (!param?.type || !ts.isTypeLiteralNode(param.type)) continue;
+    const props: ConceptProperty[] = [];
+    for (const member of param.type.members) {
+      if (!ts.isPropertySignature(member) || !member.name) continue;
+      const name =
+        ts.isIdentifier(member.name) || ts.isStringLiteral(member.name)
+          ? member.name.text
+          : member.name.getText(sf);
+      const raw = (member as unknown as { jsDoc?: ts.JSDoc[] }).jsDoc?.[0]?.comment;
+      const doc = typeof raw === "string" ? raw : raw ? ts.getTextOfJSDocComment(raw) : undefined;
+      props.push({
+        name,
+        type: member.type?.getText(sf),
+        required: member.questionToken === undefined,
+        // Undo the `*\/` escaping generate-typescript applies inside JSDoc.
+        description: doc?.replace(/\*\\\//g, "*/"),
+      });
+    }
+    if (props.length > 0) out.set(stmt.name.text, props);
+  }
+  return out;
+}
+
+/**
+ * The resource types a rule's source mentions — by class name as a whole
+ * word, or by the resource type string anywhere.
+ */
+function ruleAppliesTo(source: string, concepts: TypeConcept[]): TypeConcept[] {
+  const words = new Set(source.match(/[A-Za-z0-9_$]+/g) ?? []);
+  return concepts.filter((c) => words.has(c.className) || source.includes(c.resourceType));
+}
+
+function propertyLine(prop: ConceptProperty): string {
+  const facts: string[] = [];
+  if (prop.type) facts.push(`\`${oneLine(prop.type)}\``);
+  if (prop.required === true) facts.push("required");
+  if (prop.required === false) facts.push("optional");
+  const head = facts.length > 0 ? `- \`${prop.name}\` (${facts.join(", ")})` : `- \`${prop.name}\``;
+  return prop.description ? `${head}: ${oneLine(prop.description)}` : head;
+}
+
+/**
+ * Build the OKF bundle for a packaged lexicon. Pure and deterministic: the
+ * same registry, declarations, and rules yield byte-identical files.
+ */
+export function buildLexiconOkfBundle(input: LexiconOkfInput): OkfFile[] {
+  let registry: Record<string, RegistryEntry>;
+  try {
+    registry = JSON.parse(input.registry) as Record<string, RegistryEntry>;
+  } catch {
+    registry = {};
+  }
+  const dtsProps = parseDtsProperties(input.typesDTS);
+
+  // One concept per resource type: alias entries share a resourceType, the
+  // first class name in sorted order names the concept.
+  const byType = new Map<string, { className: string; entry: RegistryEntry }>();
+  for (const className of Object.keys(registry).sort((a, b) => a.localeCompare(b))) {
+    const entry = registry[className];
+    if (entry?.kind !== "resource" || typeof entry.resourceType !== "string") continue;
+    if (!byType.has(entry.resourceType)) byType.set(entry.resourceType, { className, entry });
+  }
+
+  const concepts: TypeConcept[] = [];
+  const takenPaths = new Set<string>();
+  for (const { className, entry } of [...byType.values()].sort((a, b) => a.className.localeCompare(b.className))) {
+    const base = `types/${slug(className)}`;
+    let path = `${base}.md`;
+    for (let n = 2; takenPaths.has(path); n++) path = `${base}-${n}.md`;
+    takenPaths.add(path);
+
+    // Registry-carried property docs (hand-authored lexicons) win; the
+    // generated declarations fill in for spec-derived lexicons.
+    let properties: ConceptProperty[];
+    if (entry.properties && Object.keys(entry.properties).length > 0) {
+      properties = Object.entries(entry.properties).map(([name, p]) => ({
+        name,
+        type: p.type,
+        description: p.description,
+      }));
+    } else {
+      properties = dtsProps.get(className) ?? [];
+    }
+
+    concepts.push({
+      className,
+      resourceType: entry.resourceType as string,
+      description: typeof entry.description === "string" ? entry.description : undefined,
+      properties,
+      attributes: entry.attrs ? Object.values(entry.attrs).sort((a, b) => a.localeCompare(b)) : [],
+      path,
+    });
+  }
+
+  // One concept per rule id, first scan wins.
+  const rulesById = new Map<string, ScannedRule>();
+  for (const rule of input.rules) {
+    if (!rulesById.has(rule.meta.id)) rulesById.set(rule.meta.id, rule);
+  }
+  const rules = [...rulesById.values()].sort((a, b) => a.meta.id.localeCompare(b.meta.id));
+  const rulePath = (id: string): string => `rules/${slug(id)}.md`;
+
+  // Association, both directions.
+  const governedBy = new Map<string, ScannedRule[]>();
+  const appliesTo = new Map<string, TypeConcept[]>();
+  for (const rule of rules) {
+    const targets = ruleAppliesTo(rule.source, concepts);
+    appliesTo.set(rule.meta.id, targets);
+    for (const target of targets) {
+      if (!governedBy.has(target.resourceType)) governedBy.set(target.resourceType, []);
+      governedBy.get(target.resourceType)!.push(rule);
+    }
+  }
+
+  const docsUrl = `https://intentius.io/chant/lexicons/${input.name}/rules/`;
+  const files: OkfFile[] = [];
+
+  for (const concept of concepts) {
+    const head = frontmatter({
+      type: "resource-type",
+      title: concept.className,
+      description: truncate(
+        oneLine(concept.description ?? `${input.name} resource type ${concept.resourceType}`),
+        200,
+      ),
+      name: concept.className,
+      lexicon: input.name,
+      resource_type: concept.resourceType,
+    });
+
+    const body: string[] = [""];
+    body.push(
+      concept.description
+        ? oneLine(concept.description)
+        : `\`${concept.resourceType}\`, a resource type of the ${input.name} lexicon.`,
+    );
+
+    if (concept.properties.length > 0) {
+      body.push("", "## Properties", "");
+      for (const prop of concept.properties) body.push(propertyLine(prop));
+    }
+
+    if (concept.attributes.length > 0) {
+      body.push("", "## Attributes", "");
+      for (const attr of concept.attributes) body.push(`- \`${attr}\``);
+    }
+
+    const governing = governedBy.get(concept.resourceType) ?? [];
+    if (governing.length > 0) {
+      body.push("", "## Governed by", "");
+      for (const rule of governing) {
+        body.push(`- [${rule.meta.id}](/${rulePath(rule.meta.id)}): ${oneLine(rule.meta.description)}`);
+      }
+    }
+
+    body.push("");
+    files.push({ path: concept.path, content: head + body.join("\n") });
+  }
+
+  for (const rule of rules) {
+    const head = frontmatter({
+      type: rule.meta.type === "post-synth" ? "post-synth-check" : "lint-rule",
+      title: rule.meta.id,
+      description: truncate(oneLine(rule.meta.description), 200),
+      id: rule.meta.id,
+      severity: rule.meta.severity,
+      category: rule.meta.category,
+      lexicon: input.name,
+      docs: docsUrl,
+    });
+
+    const body: string[] = ["", oneLine(rule.meta.description)];
+    const targets = appliesTo.get(rule.meta.id) ?? [];
+    if (targets.length > 0) {
+      body.push("", "## Applies to", "");
+      for (const target of targets) {
+        body.push(`- [${target.className}](/${target.path})`);
+      }
+    }
+    body.push("");
+    files.push({ path: rulePath(rule.meta.id), content: head + body.join("\n") });
+  }
+
+  files.push({ path: "index.md", content: buildIndex(input.name, concepts, rules, rulePath) });
+  files.sort((a, b) => a.path.localeCompare(b.path));
+  return files;
+}
+
+/**
+ * The bundle-root `index.md`: resource types and rules as sections of linked
+ * entries, `okf_version` its only frontmatter (spec §12).
+ */
+function buildIndex(
+  name: string,
+  concepts: TypeConcept[],
+  rules: ScannedRule[],
+  rulePath: (id: string) => string,
+): string {
+  const lines: string[] = ["---", `okf_version: '${OKF_VERSION}'`, "---", ""];
+
+  if (concepts.length > 0) {
+    lines.push("# Resource types", "");
+    for (const concept of concepts) {
+      lines.push(`* [${concept.className}](/${concept.path}) - ${concept.resourceType}`);
+    }
+    lines.push("");
+  }
+
+  if (rules.length > 0) {
+    lines.push("# Rules", "");
+    for (const rule of rules) {
+      lines.push(`* [${rule.meta.id}](/${rulePath(rule.meta.id)}) - ${truncate(oneLine(rule.meta.description), 160)}`);
+    }
+    lines.push("");
+  }
+
+  if (concepts.length === 0 && rules.length === 0) {
+    lines.push(`The ${name} lexicon declares no resource types or rules.`, "");
+  }
+
+  return lines.join("\n");
+}

package/src/codegen/package.ts

@@ -5,11 +5,13 @@
  * assemble BundleSpec → compute integrity → attach metadata.
  */
 
-import { readFileSync, readdirSync, writeFileSync, mkdirSync } from "fs";
-import { join } from "path";
+import { readFileSync, readdirSync, writeFileSync, mkdirSync, rmSync } from "fs";
+import { dirname, join } from "path";
 import type { BundleSpec, LexiconManifest } from "../lexicon";
 import { computeIntegrity } from "../lexicon-integrity";
 import type { GenerateResult } from "./generate";
+import { scanRulesWithSources } from "./docs-rule-scanning";
+import { buildLexiconOkfBundle } from "./okf-lexicon";
 
 // ── Types ──────────────────────────────────────────────────────────
 
@@ -73,13 +75,24 @@ export async function packagePipeline(
   log("Collecting skills...");
   const skills = config.collectSkills();
 
-  // Step 5: Assemble BundleSpec
+  // Step 5: Assemble BundleSpec, with the OKF knowledge bundle over the same
+  // artifacts (#1060) — derived here so it cannot drift from the registry and
+  // rules it describes.
+  log("Building OKF knowledge bundle...");
+  const okf = buildLexiconOkfBundle({
+    name: manifest.name,
+    registry: result.lexiconJSON,
+    typesDTS: result.typesDTS,
+    rules: scanRulesWithSources(config.srcDir),
+  });
+
   const spec: BundleSpec = {
     manifest,
     registry: result.lexiconJSON,
     typesDTS: result.typesDTS,
     rules,
     skills,
+    okf,
   };
 
   // Step 6: Compute integrity
@@ -151,7 +164,8 @@ export function collectRules(
  * Write a BundleSpec to the given dist directory.
  *
  * Creates the directory structure and writes all artifacts:
- * manifest.json, meta.json, types/index.d.ts, rules/*, skills/*, integrity.json.
+ * manifest.json, meta.json, types/index.d.ts, rules/*, skills/*, okf/*,
+ * integrity.json.
  */
 export function writeBundleSpec(spec: BundleSpec, distDir: string): void {
   mkdirSync(join(distDir, "types"), { recursive: true });
@@ -169,6 +183,17 @@ export function writeBundleSpec(spec: BundleSpec, distDir: string): void {
     writeFileSync(join(distDir, "skills", name), content);
   }
 
+  if (spec.okf) {
+    // Replace rather than merge — a concept whose resource type was removed
+    // upstream must not survive as a stale file.
+    rmSync(join(distDir, "okf"), { recursive: true, force: true });
+    for (const file of spec.okf) {
+      const target = join(distDir, "okf", file.path);
+      mkdirSync(dirname(target), { recursive: true });
+      writeFileSync(target, file.content);
+    }
+  }
+
   if (spec.integrity) {
     writeFileSync(join(distDir, "integrity.json"), JSON.stringify(spec.integrity, null, 2));
   }

package/src/components/config-defaults.test.ts

@@ -200,6 +200,36 @@ describe("applyConfigDefaults", () => {
     expect(step.policy?.warnSeverity).toBe("medium");
   });
 
+  test("vuln-gate: exploitability fields (#1466) reach a step with no per-step policy written", () => {
+    const config: ChantConfig = { vulnPolicy: { failOnKev: true, failEpssAtOrAbove: 0.1, warnEpssAtOrAbove: 0.01, exploitabilityFixableOnly: false } };
+    const comp = component([
+      { phase: "Gate", steps: [{ kind: "vuln-gate", sbom: { bytes: "", mediaType: "", packageCount: 0, generator: "x", format: "spdx" } }] },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { policy?: { failOnKev?: boolean; failEpssAtOrAbove?: number; warnEpssAtOrAbove?: number; exploitabilityFixableOnly?: boolean } };
+    expect(step.policy).toEqual({ failOnKev: true, failEpssAtOrAbove: 0.1, warnEpssAtOrAbove: 0.01, exploitabilityFixableOnly: false });
+  });
+
+  test("vuln-gate: a per-step failOnKev: false beats a config-level true, field-by-field", () => {
+    const config: ChantConfig = { vulnPolicy: { failOnKev: true, failEpssAtOrAbove: 0.1 } };
+    const comp = component([
+      {
+        phase: "Gate",
+        steps: [{
+          kind: "vuln-gate",
+          sbom: { bytes: "", mediaType: "", packageCount: 0, generator: "x", format: "spdx" },
+          policy: { failOnKev: false },
+        }],
+      },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { policy?: { failOnKev?: boolean; failEpssAtOrAbove?: number } };
+    expect(step.policy?.failOnKev).toBe(false);
+    expect(step.policy?.failEpssAtOrAbove).toBe(0.1);
+  });
+
   test("recurses into nested fan-out phases and onFailure compensation phases", () => {
     const config: ChantConfig = { sbom: { format: "cyclonedx" } };
     const comp = component([

package/src/components/deploy-units.test.ts

@@ -23,6 +23,19 @@ describe("deployUnits (#1495 piece 1)", () => {
     ]);
   });
 
+  test("resolves the GitOps verbs to their stack — the CR is the unit (#1549 piece 2)", () => {
+    const deploy = [
+      phase("Apply", [
+        { kind: "argo-app", manifest: "argo/app.yaml", stack: "gitops-argo" },
+        { kind: "flux-reconcile", manifest: "flux/", stack: "gitops-flux" },
+      ]),
+    ];
+    expect(deployUnits(deploy)).toEqual([
+      { unit: "gitops-argo", lexicon: "k8s" },
+      { unit: "gitops-flux", lexicon: "k8s" },
+    ]);
+  });
+
   test("walks nested phases, dedupes per lexicon, and skips unitless steps", () => {
     const deploy = [
       phase("Outer", [

package/src/components/deploy-units.ts

@@ -40,6 +40,11 @@ export const DEPLOY_UNIT_RULES: readonly DeployUnitRule[] = [
   // kustomize renders, then applies through the same stack-labelled pipeline —
   // so its unit is observed by the identical label sweep (#1548).
   { kind: "kustomize-apply", field: "stack", lexicon: "k8s" },
+  // GitOps verbs apply the controller's CR through that same pipeline — the
+  // unit is the CR itself under its stack label, observed by the identical
+  // label sweep (#1549 piece 2).
+  { kind: "argo-app", field: "stack", lexicon: "k8s" },
+  { kind: "flux-reconcile", field: "stack", lexicon: "k8s" },
   { kind: "helm-upgrade", field: "release", lexicon: "helm" },
 ];
 

package/src/components/verbs/__fixtures__/grype-with-kev-epss.json

@@ -0,0 +1 @@
+{"matches":[{"vulnerability":{"id":"GHSA-jfh8-c2jp-5v3q","dataSource":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","namespace":"github:language:java","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44228","https://github.com/apache/logging-log4j2/pull/608","https://github.com/tangxiaofeng7/apache-log4j-poc","https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0","https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup","https://issues.apache.org/jira/browse/LOG4J2-3198","https://issues.apache.org/jira/browse/LOG4J2-3201","https://logging.apache.org/log4j/2.x/manual/migration.html","https://logging.apache.org/log4j/2.x/security.html","http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2021/12/10/1","http://www.openwall.com/lists/oss-security/2021/12/10/2","http://www.openwall.com/lists/oss-security/2021/12/10/3","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://issues.apache.org/jira/browse/LOG4J2-3214","https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","http://www.openwall.com/lists/oss-security/2021/12/13/1","http://www.openwall.com/lists/oss-security/2021/12/13/2","https://issues.apache.org/jira/browse/LOG4J2-3221","https://github.com/advisories/GHSA-7rjr-3q55-vv33","https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html","https://twitter.com/kurtseifried/status/1469345530182455296","https://www.debian.org/security/2021/dsa-5020","http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html","http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html","http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2021/12/14/4","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","https://www.kb.cert.org/vuls/id/930724","http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html","http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html","http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html","http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html","http://www.openwall.com/lists/oss-security/2021/12/15/3","https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html","http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html","https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md","http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://github.com/cisagov/log4j-affected-db","https://support.apple.com/kb/HT213189","https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001","https://www.oracle.com/security-alerts/cpuapr2022.html","https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228","https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html","http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2","https://security.netapp.com/advisory/ntap-20211210-0007","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM","https://github.com/github/advisory-database/pull/5501","https://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","https://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","https://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","https://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://seclists.org/fulldisclosure/2022/Dec/2","https://seclists.org/fulldisclosure/2022/Jul/11","https://seclists.org/fulldisclosure/2022/Mar/23","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM","http://seclists.org/fulldisclosure/2022/Dec/2","http://seclists.org/fulldisclosure/2022/Jul/11","http://seclists.org/fulldisclosure/2022/Mar/23"],"description":"Remote code injection in Log4j","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2021-44228","vendorProject":"Apache","product":"Log4j2","dateAdded":"2021-12-10","requiredAction":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","dueDate":"2021-12-24","knownRansomwareCampaignUse":"known","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44228"],"cwes":["CWE-20","CWE-400","CWE-502"]}],"epss":[{"cve":"CVE-2021-44228","epss":0.99999,"percentile":1,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2021-44228","cwe":"CWE-20","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44228","cwe":"CWE-400","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44228","cwe":"CWE-502","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44228","cwe":"CWE-917","source":"nvd@nist.gov","type":"Secondary"}],"fix":{"versions":["2.15.0"],"state":"fixed","available":[{"version":"2.15.0","date":"2021-12-10","kind":"first-observed"}]},"advisories":[],"risk":100},"relatedVulnerabilities":[{"id":"CVE-2021-44228","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","namespace":"nvd:cpe","severity":"Critical","urls":["http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html","http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html","http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html","http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html","http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html","http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html","http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html","http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html","http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","http://seclists.org/fulldisclosure/2022/Dec/2","http://seclists.org/fulldisclosure/2022/Jul/11","http://seclists.org/fulldisclosure/2022/Mar/23","http://www.openwall.com/lists/oss-security/2021/12/10/1","http://www.openwall.com/lists/oss-security/2021/12/10/2","http://www.openwall.com/lists/oss-security/2021/12/10/3","http://www.openwall.com/lists/oss-security/2021/12/13/1","http://www.openwall.com/lists/oss-security/2021/12/13/2","http://www.openwall.com/lists/oss-security/2021/12/14/4","http://www.openwall.com/lists/oss-security/2021/12/15/3","https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","https://github.com/cisagov/log4j-affected-db","https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md","https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228","https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/","https://logging.apache.org/log4j/2.x/security.html","https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://security.netapp.com/advisory/ntap-20211210-0007/","https://support.apple.com/kb/HT213189","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://twitter.com/kurtseifried/status/1469345530182455296","https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001","https://www.debian.org/security/2021/dsa-5020","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","https://www.kb.cert.org/vuls/id/930724","https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html","https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228"],"description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"exploitabilityScore":8.6,"impactScore":10.1},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2021-44228","vendorProject":"Apache","product":"Log4j2","dateAdded":"2021-12-10","requiredAction":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","dueDate":"2021-12-24","knownRansomwareCampaignUse":"known","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44228"],"cwes":["CWE-20","CWE-400","CWE-502"]}],"epss":[{"cve":"CVE-2021-44228","epss":0.99999,"percentile":1,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2021-44228","cwe":"CWE-20","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44228","cwe":"CWE-400","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44228","cwe":"CWE-502","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44228","cwe":"CWE-917","source":"nvd@nist.gov","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-jfh8-c2jp-5v3q","versionConstraint":">=2.13.0,<2.15.0 (unknown)"},"fix":{"suggestedVersion":"2.15.0"}}],"artifact":{"id":"14c1fd57de411ba0","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":null,"language":"java","licenses":[],"cpes":[],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":null}}},{"vulnerability":{"id":"GHSA-7rjr-3q55-vv33","dataSource":"https://github.com/advisories/GHSA-7rjr-3q55-vv33","namespace":"github:language:java","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-45046","https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","https://logging.apache.org/log4j/2.x/security.html","https://www.openwall.com/lists/oss-security/2021/12/14/4","https://www.cve.org/CVERecord?id=CVE-2021-44228","http://www.openwall.com/lists/oss-security/2021/12/14/4","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","http://www.openwall.com/lists/oss-security/2021/12/15/3","https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","https://www.kb.cert.org/vuls/id/930724","https://www.debian.org/security/2021/dsa-5022","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","http://www.openwall.com/lists/oss-security/2021/12/18/1","https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.gentoo.org/glsa/202310-16","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY"],"description":"Incomplete fix for Apache Log4j vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H","metrics":{"baseScore":9,"exploitabilityScore":2.3,"impactScore":6.1},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2021-45046","vendorProject":"Apache","product":"Log4j2","dateAdded":"2023-05-01","requiredAction":"Apply updates per vendor instructions.","dueDate":"2023-05-22","knownRansomwareCampaignUse":"known","urls":["https://logging.apache.org/log4j/2.x/security.html","https://nvd.nist.gov/vuln/detail/CVE-2021-45046"],"cwes":["CWE-917"]}],"epss":[{"cve":"CVE-2021-45046","epss":0.99977,"percentile":0.9998,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2021-45046","cwe":"CWE-917","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-45046","cwe":"CWE-917","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.16.0"],"state":"fixed","available":[{"version":"2.16.0","date":"2021-12-15","kind":"first-observed"}]},"advisories":[],"risk":99.00000000000001},"relatedVulnerabilities":[{"id":"CVE-2021-45046","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-45046","namespace":"nvd:cpe","severity":"Critical","urls":["http://www.openwall.com/lists/oss-security/2021/12/14/4","http://www.openwall.com/lists/oss-security/2021/12/15/3","http://www.openwall.com/lists/oss-security/2021/12/18/1","https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/","https://logging.apache.org/log4j/2.x/security.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://security.gentoo.org/glsa/202310-16","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://www.cve.org/CVERecord?id=CVE-2021-44228","https://www.debian.org/security/2021/dsa-5022","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","https://www.kb.cert.org/vuls/id/930724","https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046"],"description":"It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"exploitabilityScore":2.3,"impactScore":6.1},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"exploitabilityScore":5,"impactScore":6.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"exploitabilityScore":2.3,"impactScore":6.1},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2021-45046","vendorProject":"Apache","product":"Log4j2","dateAdded":"2023-05-01","requiredAction":"Apply updates per vendor instructions.","dueDate":"2023-05-22","knownRansomwareCampaignUse":"known","urls":["https://logging.apache.org/log4j/2.x/security.html","https://nvd.nist.gov/vuln/detail/CVE-2021-45046"],"cwes":["CWE-917"]}],"epss":[{"cve":"CVE-2021-45046","epss":0.99977,"percentile":0.9998,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2021-45046","cwe":"CWE-917","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-45046","cwe":"CWE-917","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-7rjr-3q55-vv33","versionConstraint":">=2.13.0,<2.16.0 (unknown)"},"fix":{"suggestedVersion":"2.16.0"}}],"artifact":{"id":"14c1fd57de411ba0","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":null,"language":"java","licenses":[],"cpes":[],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":null}}},{"vulnerability":{"id":"GHSA-p6xc-xr62-6r2g","dataSource":"https://github.com/advisories/GHSA-p6xc-xr62-6r2g","namespace":"github:language:java","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-45105","https://logging.apache.org/log4j/2.x/security.html","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf","https://lists.debian.org/debian-lts-announce/2021/12/msg00017.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://www.debian.org/security/2021/dsa-5024","https://www.kb.cert.org/vuls/id/930724","http://www.openwall.com/lists/oss-security/2021/12/19/1","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://security.netapp.com/advisory/ntap-20211218-0001","https://www.zerodayinitiative.com/advisories/ZDI-21-1541","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"],"description":"Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-45105","epss":0.99999,"percentile":0.9999,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2021-45105","cwe":"CWE-20","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-45105","cwe":"CWE-674","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-45105","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2021-45105","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.17.0"],"state":"fixed","available":[{"version":"2.17.0","date":"2021-12-19","kind":"first-observed"}]},"advisories":[],"risk":80.499195},"relatedVulnerabilities":[{"id":"CVE-2021-45105","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-45105","namespace":"nvd:cpe","severity":"Medium","urls":["http://www.openwall.com/lists/oss-security/2021/12/19/1","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf","https://logging.apache.org/log4j/2.x/security.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://security.netapp.com/advisory/ntap-20211218-0001/","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://www.debian.org/security/2021/dsa-5024","https://www.kb.cert.org/vuls/id/930724","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1541/"],"description":"Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-45105","epss":0.99999,"percentile":0.9999,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2021-45105","cwe":"CWE-20","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-45105","cwe":"CWE-674","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-45105","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2021-45105","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-p6xc-xr62-6r2g","versionConstraint":">=2.13.0,<2.17.0 (unknown)"},"fix":{"suggestedVersion":"2.17.0"}}],"artifact":{"id":"14c1fd57de411ba0","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":null,"language":"java","licenses":[],"cpes":[],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":null}}},{"vulnerability":{"id":"GHSA-8489-44mv-ggj8","dataSource":"https://github.com/advisories/GHSA-8489-44mv-ggj8","namespace":"github:language:java","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44832","https://issues.apache.org/jira/browse/LOG4J2-3293","https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143","https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf","https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html","http://www.openwall.com/lists/oss-security/2021/12/28/1","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://security.netapp.com/advisory/ntap-20220104-0001","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"],"description":"Improper Input Validation and Injection in Apache Log4j2","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44832","epss":0.97906,"percentile":0.99903,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2021-44832","cwe":"CWE-20","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44832","cwe":"CWE-74","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44832","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.17.1"],"state":"fixed","available":[{"version":"2.17.1","date":"2022-01-05","kind":"first-observed"}]},"advisories":[],"risk":56.78548},"relatedVulnerabilities":[{"id":"CVE-2021-44832","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44832","namespace":"nvd:cpe","severity":"Medium","urls":["http://www.openwall.com/lists/oss-security/2021/12/28/1","https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf","https://issues.apache.org/jira/browse/LOG4J2-3293","https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143","https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC/","https://security.netapp.com/advisory/ntap-20220104-0001/","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","metrics":{"baseScore":8.5,"exploitabilityScore":6.9,"impactScore":10.1},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44832","epss":0.97906,"percentile":0.99903,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2021-44832","cwe":"CWE-20","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44832","cwe":"CWE-74","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44832","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-8489-44mv-ggj8","versionConstraint":">=2.13.0,<2.17.1 (unknown)"},"fix":{"suggestedVersion":"2.17.1"}}],"artifact":{"id":"14c1fd57de411ba0","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":null,"language":"java","licenses":[],"cpes":[],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":null}}},{"vulnerability":{"id":"GHSA-3pxv-7cmr-fjr4","dataSource":"https://github.com/advisories/GHSA-3pxv-7cmr-fjr4","namespace":"github:language:java","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-34480","https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"description":"Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34480","epss":0.0086,"percentile":0.55043,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","source":"security@apache.org","type":"Secondary"}],"fix":{"versions":["2.25.4"],"state":"fixed","available":[{"version":"2.25.4","date":"2026-04-11","kind":"first-observed"}]},"advisories":[],"risk":0.5117},"relatedVulnerabilities":[{"id":"CVE-2026-34480","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34480","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"description":"Apache Log4j Core's  XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n  *  JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n  *  Alternative StAX implementations (e.g.,  Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security@apache.org","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34480","epss":0.0086,"percentile":0.55043,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","source":"security@apache.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-3pxv-7cmr-fjr4","versionConstraint":">=2.0-alpha1,<2.25.4 (unknown)"},"fix":{"suggestedVersion":"2.25.4"}}],"artifact":{"id":"14c1fd57de411ba0","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":null,"language":"java","licenses":[],"cpes":[],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":null}}},{"vulnerability":{"id":"GHSA-vc5p-v9hr-52mj","dataSource":"https://github.com/advisories/GHSA-vc5p-v9hr-52mj","namespace":"github:language:java","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-68161","https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578","http://www.openwall.com/lists/oss-security/2025/12/18/1"],"description":"Apache Log4j does not verify the TLS hostname in its Socket Appender","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68161","epss":0.00756,"percentile":0.51685,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2025-68161","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.25.3"],"state":"fixed","available":[{"version":"2.25.3","date":"2025-12-20","kind":"first-observed"}]},"advisories":[],"risk":0.42713999999999996},"relatedVulnerabilities":[{"id":"CVE-2025-68161","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68161","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","http://www.openwall.com/lists/oss-security/2025/12/18/1","https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html"],"description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}},{"source":"security@apache.org","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68161","epss":0.00756,"percentile":0.51685,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2025-68161","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-vc5p-v9hr-52mj","versionConstraint":">=2.0-beta9,<2.25.3 (unknown)"},"fix":{"suggestedVersion":"2.25.3"}}],"artifact":{"id":"14c1fd57de411ba0","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":null,"language":"java","licenses":[],"cpes":[],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":null}}},{"vulnerability":{"id":"GHSA-6hg6-v5c8-fphq","dataSource":"https://github.com/advisories/GHSA-6hg6-v5c8-fphq","namespace":"github:language:java","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-34477","https://github.com/apache/logging-log4j2/pull/4075","https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/security.html#CVE-2026-34477"],"description":"Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34477","epss":0.0041,"percentile":0.33733,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2026-34477","cwe":"CWE-297","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2026-34477","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.25.4"],"state":"fixed","available":[{"version":"2.25.4","date":"2026-04-14","kind":"first-observed"}]},"advisories":[],"risk":0.23165},"relatedVulnerabilities":[{"id":"CVE-2026-34477","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34477","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/apache/logging-log4j2/pull/4075","https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/security.html#CVE-2026-34477"],"description":"The fix for  CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161  was incomplete: it addressed hostname verification only when enabled via the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property, but not when configured through the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  attribute of the <Ssl> element.\n\nAlthough the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.\n\nA network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:\n\n  *  An SMTP, Socket, or Syslog appender is in use.\n  *  TLS is configured via a nested <Ssl> element.\n  *  The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.\nThis issue does not affect users of the HTTP appender, which uses a separate  verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName  attribute that was not subject to this bug and verifies host names by default.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security@apache.org","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34477","epss":0.0041,"percentile":0.33733,"date":"2026-08-06"}],"cwes":[{"cve":"CVE-2026-34477","cwe":"CWE-297","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2026-34477","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-6hg6-v5c8-fphq","versionConstraint":">=2.12.0,<2.25.4 (unknown)"},"fix":{"suggestedVersion":"2.25.4"}}],"artifact":{"id":"14c1fd57de411ba0","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":null,"language":"java","licenses":[],"cpes":[],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":null}}}],"source":{"type":"sbom-file","target":"/private/tmp/claude-501/-Users-alex-Documents-checkouts-intentius-chant/406f2906-e1f1-488c-a98a-e79ee1f2e062/scratchpad/log4j.cdx.json"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.116.1","configuration":{"output":["json"],"file":"","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"/Users/alex/Library/Caches/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.9","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.9_2026-08-07T01:17:58Z_1786084371.tar.zst?checksum=sha256%3Ac567db13cde70e1caa677a4d8423b693c427ebc7c2a37f2946629a93d3fdb2c2","built":"2026-08-07T06:32:51Z","path":"/Users/alex/Library/Caches/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-08-07T01:18:09Z","input":"xxh64:128887b63e83640f"},"alpine":{"captured":"2026-08-07T01:18:10Z","input":"xxh64:2ecc1b561b86cb8d"},"amazon":{"captured":"2026-08-07T01:18:10Z","input":"xxh64:d668a591ee2bca06"},"arch":{"captured":"2026-08-07T01:18:06Z","input":"xxh64:8ecb0e8f71b0e571"},"bitnami":{"captured":"2026-08-07T01:18:13Z","input":"xxh64:ea999419043c798f"},"chainguard":{"captured":"2026-08-07T01:18:23Z","input":"xxh64:fa982cab855cc7f0"},"chainguard-libraries":{"captured":"2026-08-07T01:18:04Z","input":"xxh64:711ae24c8069918f"},"debian":{"captured":"2026-08-07T01:18:18Z","input":"xxh64:edc35605319da5c5"},"echo":{"captured":"2026-08-07T01:18:02Z","input":"xxh64:f6933304d0f51f96"},"eol":{"captured":"2026-08-07T01:18:01Z","input":"xxh64:bc5253144321b368"},"epss":{"captured":"2026-08-07T01:18:07Z","input":"xxh64:a91a128d39c4daab"},"fedora":{"captured":"2026-08-07T01:18:09Z","input":"xxh64:08cfefa858eef2c5"},"github":{"captured":"2026-08-07T01:19:06Z","input":"xxh64:79f81b2cffd8dbed"},"govulndb":{"captured":"2026-08-07T01:18:11Z","input":"xxh64:4218e3d3f068a1d8"},"hummingbird":{"captured":"2026-08-07T01:19:55Z","input":"xxh64:676c8a7b3706f91c"},"kev":{"captured":"2026-08-07T01:18:05Z","input":"xxh64:ef8fdafbe562fe4a"},"mariner":{"captured":"2026-08-07T01:17:58Z","input":"xxh64:c4749ffcfca6418c"},"minimos":{"captured":"2026-08-07T01:17:59Z","input":"xxh64:93b585ed0e5b9c48"},"nvd":{"captured":"2026-08-07T01:18:56Z","input":"xxh64:8fc444b55cb56507"},"oracle":{"captured":"2026-08-07T01:18:06Z","input":"xxh64:07641ba05ea34e54"},"photon":{"captured":"2026-08-07T01:18:00Z","input":"xxh64:b24ef819de3e090e"},"rhel":{"captured":"2026-08-07T01:19:15Z","input":"xxh64:be9e16181b7af424"},"secureos":{"captured":"2026-08-07T01:18:37Z","input":"xxh64:aa64dac440292218"},"sles":{"captured":"2026-08-07T01:18:39Z","input":"xxh64:5a56de1d28b9e0f2"},"ubuntu":{"captured":"2026-08-07T01:20:25Z","input":"xxh64:3f045d2e0bb1444f"},"wolfi":{"captured":"2026-08-07T01:18:19Z","input":"xxh64:a40627b8fcd62074"}}},"timestamp":"2026-08-07T15:43:35.78149-06:00"}}