{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"RED"}},"lang":"en","notes":[{"category":"summary","text":"Generated from an analysis of SBOM demo-sbom.cdx.json (cyclonedx-json, sha256 20c0635ac7bbc1658b9c2ca077f889099c1f940ee1a20f606b05b0541374c090)."},{"category":"general","text":"This advisory is based on an INCOMPLETE analysis. The following analyzers did not produce results, so components they would have covered may carry vulnerabilities not listed here: shieldbom (fail).","title":"Analysis coverage"}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory","url":"https://ndaal.eu/csaf/ndaal-sba-2298"}],"title":"Vulnerabilities found in SBOM demo-sbom.cdx.json","tracking":{"current_release_date":"2026-10-01T06:43:17Z","generator":{"engine":{"name":"ndaal SBOM Auditor","version":"1.6.26"}},"id":"ndaal-sba-2298","initial_release_date":"2026-09-20T19:32:02Z","revision_history":[{"date":"2026-09-20T19:32:02Z","number":"1.0.0","summary":"Initial advisory generated from an SBOM analysis."},{"date":"2026-10-01T06:43:17Z","number":"2.0.0","summary":"Triage applied: 1 not affected."}],"status":"final","version":"2.0.0"}},"product_tree":{"full_product_names":[{"name":"lodash@4.17.15","product_id":"CSAFPID-0002"},{"name":"log4j-core@2.14.1","product_id":"CSAFPID-0001"},{"name":"org.apache.logging.log4j:log4j-core@2.14.1","product_id":"CSAFPID-0003"},{"name":"unknown","product_id":"CSAFPID-0004"},{"name":"unknown@4.17.15","product_id":"CSAFPID-0005"}]},"vulnerabilities":[{"cve":"CVE-2020-28500","notes":[{"category":"description","text":"Regular Expression Denial of Service (ReDoS) in lodash"}],"product_status":{"known_affected":["CSAFPID-0002","CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 4.17.21 or later.","product_ids":["CSAFPID-0002","CSAFPID-0004"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"}},"products":["CSAFPID-0002","CSAFPID-0004"]}],"title":"GHSA-29mw-wpgm-hmr9"},{"cve":"CVE-2020-8203","notes":[{"category":"description","text":"Prototype Pollution in lodash"}],"product_status":{"known_affected":["CSAFPID-0002","CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 4.17.19 or later.","product_ids":["CSAFPID-0002","CSAFPID-0004"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"products":["CSAFPID-0002","CSAFPID-0004"]}],"title":"GHSA-p6mc-m468-83gw"},{"cve":"CVE-2021-23337","notes":[{"category":"description","text":"Command Injection in lodash"}],"product_status":{"known_affected":["CSAFPID-0002","CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 4.17.21 or later.","product_ids":["CSAFPID-0002","CSAFPID-0004"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"products":["CSAFPID-0002","CSAFPID-0004"]}],"title":"GHSA-35jh-r3h4-6jhm"},{"cve":"CVE-2021-44228","notes":[{"category":"description","text":"Remote code injection in Log4j"},{"category":"other","text":"Pipeline live test: JNDI lookups disabled","title":"Triage decision"}],"product_status":{"known_not_affected":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.15.0 or later.","product_ids":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"products":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"threats":[{"category":"impact","details":"Pipeline live test: JNDI lookups disabled","product_ids":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"title":"GHSA-jfh8-c2jp-5v3q","flags":[{"label":"vulnerable_code_not_in_execute_path","product_ids":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}]},{"cve":"CVE-2021-44832","notes":[{"category":"description","text":"Improper Input Validation and Injection in Apache Log4j2"}],"product_status":{"known_affected":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.17.1 or later.","product_ids":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"products":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"title":"GHSA-8489-44mv-ggj8"},{"cve":"CVE-2021-45046","notes":[{"category":"description","text":"Incomplete fix for Apache Log4j vulnerability"}],"product_status":{"known_affected":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.16.0 or later.","product_ids":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"products":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"title":"GHSA-7rjr-3q55-vv33"},{"cve":"CVE-2021-45105","notes":[{"category":"description","text":"Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion"}],"product_status":{"known_affected":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.17.0 or later.","product_ids":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},"products":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"title":"GHSA-p6xc-xr62-6r2g"},{"cve":"CVE-2025-13465","notes":[{"category":"description","text":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions"}],"product_status":{"known_affected":["CSAFPID-0002","CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 4.17.23 or later.","product_ids":["CSAFPID-0002","CSAFPID-0004"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH"}},"products":["CSAFPID-0002","CSAFPID-0004"]}],"title":"GHSA-xxjr-mmjv-4gpg"},{"cve":"CVE-2025-68161","notes":[{"category":"description","text":"Apache Log4j does not verify the TLS hostname in its Socket Appender"}],"product_status":{"known_affected":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.25.3 or later.","product_ids":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"title":"GHSA-vc5p-v9hr-52mj"},{"cve":"CVE-2026-2950","notes":[{"category":"description","text":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`"}],"product_status":{"known_affected":["CSAFPID-0002","CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 4.18.0 or later.","product_ids":["CSAFPID-0002","CSAFPID-0004"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"}},"products":["CSAFPID-0002","CSAFPID-0004"]}],"title":"GHSA-f23m-r3pf-42rh"},{"cve":"CVE-2026-34477","notes":[{"category":"description","text":"Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration"}],"product_status":{"known_affected":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.25.4 or later.","product_ids":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"title":"GHSA-6hg6-v5c8-fphq"},{"cve":"CVE-2026-34480","notes":[{"category":"description","text":"Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"}],"product_status":{"known_affected":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.25.4 or later.","product_ids":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"}},"products":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0004"]}],"title":"GHSA-3pxv-7cmr-fjr4"},{"cve":"CVE-2026-4800","notes":[{"category":"description","text":"lodash vulnerable to Code Injection via `_.template` imports key names"}],"product_status":{"known_affected":["CSAFPID-0002","CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 4.18.0 or later.","product_ids":["CSAFPID-0002","CSAFPID-0004"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"products":["CSAFPID-0002","CSAFPID-0004"]}],"title":"GHSA-r5fr-rjxr-66jc"},{"notes":[{"category":"description","text":"Allocation of Resources Without Limits or Throttling"}],"product_status":{"known_affected":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to >=4.17.19 or later.","product_ids":["CSAFPID-0002"]}],"title":"NSWG-ECO-516"},{"notes":[{"category":"description","text":"GHSA-7rjr-3q55-vv33 (CRITICAL) affects pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1. Review the advisory and update or pin a patched version."}],"product_status":{"known_affected":["CSAFPID-0004"]},"title":"bomdrift.cve"},{"notes":[{"category":"description","text":"`lodash` is deprecated upstream: Bad release. Please use lodash@4.17.21 instead."}],"product_status":{"known_affected":["CSAFPID-0005"]},"title":"bomdrift.deprecated"}]}