From 645cf89ad4405b018bed70710a6423f538f90e7e Mon Sep 17 00:00:00 2001 From: Christopher Langton Date: Sat, 14 Nov 2026 13:08:15 +1100 Subject: [PATCH] chore(vex): record not_affected for log4j-core 2.14.1 fixture strings log4j-core is not a dependency of this Go module. The 2.14.1 matches for CVE-2021-44228, CVE-2021-45046, CVE-2021-45105 and CVE-2021-44832 come from example strings in test fixtures, golden files, help text and docs, which are kept as they are. Commit OpenVEX statements under .vulnetix/vex and add a VexSource in .vulnetix/config so every Vulnetix scan applies them before its gates. --- .gitignore | 5 ++-- .vulnetix/config/vex.yaml | 13 ++++++++++ .vulnetix/vex/CVE-2021-44228.openvex.json | 29 +++++++++++++++++++++++ .vulnetix/vex/CVE-2021-44832.openvex.json | 29 +++++++++++++++++++++++ .vulnetix/vex/CVE-2021-45046.openvex.json | 29 +++++++++++++++++++++++ .vulnetix/vex/CVE-2021-45105.openvex.json | 29 +++++++++++++++++++++++ 6 files changed, 132 insertions(+), 2 deletions(-) create mode 100644 .vulnetix/config/vex.yaml create mode 100644 .vulnetix/vex/CVE-2021-44228.openvex.json create mode 100644 .vulnetix/vex/CVE-2021-44832.openvex.json create mode 100644 .vulnetix/vex/CVE-2021-45046.openvex.json create mode 100644 .vulnetix/vex/CVE-2021-45105.openvex.json diff --git a/.gitignore b/.gitignore index 55e3e22f88..a000d29aca 100644 --- a/.gitignore +++ b/.gitignore @@ -52,7 +52,7 @@ src/@iconify/icons-bundle.js **/vulnetix.db # Vulnetix credentials -.vulnetix/ +.vulnetix/* .claude/ **/credentials.json **/vdb.json @@ -81,4 +81,5 @@ result /secrets.sarif internal/sast/secretsgen/batches/ !.vulnetix/workflow.yaml -!.vulnetix/workflow.yaml +!.vulnetix/vex/ +!.vulnetix/config/ diff --git a/.vulnetix/config/vex.yaml b/.vulnetix/config/vex.yaml new file mode 100644 index 0000000000..684d876a70 --- /dev/null +++ b/.vulnetix/config/vex.yaml @@ -0,0 +1,13 @@ +# Committed VEX statements for this repository. Every Vulnetix scan (local and +# CI) reads the documents under .vulnetix/vex/ before its gates, so a finding a +# statement closes is reported as not_affected or fixed instead of open. +apiVersion: vulnetix.com/v1 +kind: VexSource +metadata: + name: repo-vex +spec: + path: + path: .vulnetix/vex + scope: + repos: + - Vulnetix/cli diff --git a/.vulnetix/vex/CVE-2021-44228.openvex.json b/.vulnetix/vex/CVE-2021-44228.openvex.json new file mode 100644 index 0000000000..ab34be4fa4 --- /dev/null +++ b/.vulnetix/vex/CVE-2021-44228.openvex.json @@ -0,0 +1,29 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://github.com/Vulnetix/cli/blob/main/.vulnetix/vex/CVE-2021-44228.openvex.json", + "author": "Vulnetix", + "role": "Maintainer", + "timestamp": "2026-11-14T00:00:00Z", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2021-44228" + }, + "products": [ + { + "@id": "pkg:github/Vulnetix/cli", + "subcomponents": [ + { + "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1" + } + ] + } + ], + "status": "not_affected", + "justification": "component_not_present", + "impact_statement": "log4j-core is not a dependency of this Go module (go.mod and go.sum only; no Maven or Gradle build and no JAR in the shipped CLI). log4j-core 2.14.1 appears only as example strings in test fixtures, golden files, help text and documentation, and as SAST rule-efficacy test data under internal/sast/testdata.", + "status_notes": "Issues #215, #216 and #304. The fixtures are kept on purpose; they exercise the report and defence renderers with a well-known KEV advisory." + } + ] +} diff --git a/.vulnetix/vex/CVE-2021-44832.openvex.json b/.vulnetix/vex/CVE-2021-44832.openvex.json new file mode 100644 index 0000000000..f864413bf8 --- /dev/null +++ b/.vulnetix/vex/CVE-2021-44832.openvex.json @@ -0,0 +1,29 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://github.com/Vulnetix/cli/blob/main/.vulnetix/vex/CVE-2021-44832.openvex.json", + "author": "Vulnetix", + "role": "Maintainer", + "timestamp": "2026-11-14T00:00:00Z", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2021-44832" + }, + "products": [ + { + "@id": "pkg:github/Vulnetix/cli", + "subcomponents": [ + { + "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1" + } + ] + } + ], + "status": "not_affected", + "justification": "component_not_present", + "impact_statement": "log4j-core is not a dependency of this Go module (go.mod and go.sum only; no Maven or Gradle build and no JAR in the shipped CLI). log4j-core 2.14.1 appears only as example strings in test fixtures, golden files, help text and documentation, and as SAST rule-efficacy test data under internal/sast/testdata.", + "status_notes": "Issues #215, #216 and #304. The fixtures are kept on purpose; they exercise the report and defence renderers with a well-known KEV advisory." + } + ] +} diff --git a/.vulnetix/vex/CVE-2021-45046.openvex.json b/.vulnetix/vex/CVE-2021-45046.openvex.json new file mode 100644 index 0000000000..6bda7c7131 --- /dev/null +++ b/.vulnetix/vex/CVE-2021-45046.openvex.json @@ -0,0 +1,29 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://github.com/Vulnetix/cli/blob/main/.vulnetix/vex/CVE-2021-45046.openvex.json", + "author": "Vulnetix", + "role": "Maintainer", + "timestamp": "2026-11-14T00:00:00Z", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2021-45046" + }, + "products": [ + { + "@id": "pkg:github/Vulnetix/cli", + "subcomponents": [ + { + "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1" + } + ] + } + ], + "status": "not_affected", + "justification": "component_not_present", + "impact_statement": "log4j-core is not a dependency of this Go module (go.mod and go.sum only; no Maven or Gradle build and no JAR in the shipped CLI). log4j-core 2.14.1 appears only as example strings in test fixtures, golden files, help text and documentation, and as SAST rule-efficacy test data under internal/sast/testdata.", + "status_notes": "Issues #215, #216 and #304. The fixtures are kept on purpose; they exercise the report and defence renderers with a well-known KEV advisory." + } + ] +} diff --git a/.vulnetix/vex/CVE-2021-45105.openvex.json b/.vulnetix/vex/CVE-2021-45105.openvex.json new file mode 100644 index 0000000000..e87be4625c --- /dev/null +++ b/.vulnetix/vex/CVE-2021-45105.openvex.json @@ -0,0 +1,29 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://github.com/Vulnetix/cli/blob/main/.vulnetix/vex/CVE-2021-45105.openvex.json", + "author": "Vulnetix", + "role": "Maintainer", + "timestamp": "2026-11-14T00:00:00Z", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2021-45105" + }, + "products": [ + { + "@id": "pkg:github/Vulnetix/cli", + "subcomponents": [ + { + "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1" + } + ] + } + ], + "status": "not_affected", + "justification": "component_not_present", + "impact_statement": "log4j-core is not a dependency of this Go module (go.mod and go.sum only; no Maven or Gradle build and no JAR in the shipped CLI). log4j-core 2.14.1 appears only as example strings in test fixtures, golden files, help text and documentation, and as SAST rule-efficacy test data under internal/sast/testdata.", + "status_notes": "Issues #215, #216 and #304. The fixtures are kept on purpose; they exercise the report and defence renderers with a well-known KEV advisory." + } + ] +}