{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"RED"}},"lang":"en","notes":[{"category":"summary","text":"Generated from an analysis of SBOM demo-sbom.cdx.json (cyclonedx-json, sha256 20c0635ac7bbc1658b9c2ca077f889099c1f940ee1a20f606b05b0541374c090)."},{"category":"general","text":"This advisory is based on an INCOMPLETE analysis. The following analyzers did not produce results, so components they would have covered may carry vulnerabilities not listed here: shieldbom (fail).","title":"Analysis coverage"}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory","url":"https://ndaal.eu/csaf/ndaal-sba-2298-0009"}],"title":"Vulnerabilities found in SBOM demo-sbom.cdx.json","tracking":{"current_release_date":"2026-09-20T19:32:02Z","generator":{"engine":{"name":"ndaal SBOM Auditor","version":"1.6.26"}},"id":"ndaal-sba-2298-0009","initial_release_date":"2026-09-20T19:32:02Z","revision_history":[{"date":"2026-09-20T19:32:02Z","number":"1.0.0","summary":"Initial advisory generated from an SBOM analysis."}],"status":"final","version":"1.0.0"}},"product_tree":{"full_product_names":[{"name":"log4j-core@2.14.1","product_id":"CSAFPID-0001"}]},"vulnerabilities":[{"cve":"CVE-2026-34477","notes":[{"category":"description","text":"Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration"}],"product_status":{"known_affected":["CSAFPID-0001"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.25.4 or later.","product_ids":["CSAFPID-0001"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"title":"GHSA-6hg6-v5c8-fphq"}]}