{
  "@id": "urn:uuid:4727e431-fa5e-4226-a7a4-ae55fe359f3e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 49,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:15:51.446651+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:10:32.786596+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.10.0, which was released after the fixed versions and already contains the upstream fix. The vulnerability involves unrestricted polymorphic deserialization allowing malicious classes to be instantiated. The fix (blacklist of dangerous classes in SubTypeValidator) was present in the upstream 2.10.0 release that TuxCare onboarded. All classes from CVE-2017-15095 issue #1737 are blacklisted: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, plus special handling for AbstractBeanFactoryPointcutAdvisor and c3p0 DataSource classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.10.0, which was released after the fixed versions and already contains the upstream fix. The vulnerability involves unrestricted polymorphic deserialization allowing malicious classes to be instantiated. The fix (blacklist of dangerous classes in SubTypeValidator) was present in the upstream 2.10.0 release that TuxCare onboarded. All classes from CVE-2017-15095 issue #1737 are blacklisted: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, plus special handling for AbstractBeanFactoryPointcutAdvisor and c3p0 DataSource classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:45:35.958455+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.10.0 is NOT affected by CVE-2017-17485. The vulnerability was fixed in upstream jackson-databind versions 2.8.11 and 2.9.4 (released December 2017) via introduction of SubTypeValidator class with comprehensive blacklist and pattern matching for dangerous deserialization gadgets. The target version 2.10.0 (released September 2019) includes these fixes from the upstream release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta, not by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "Target version 2.10.0 is NOT affected by CVE-2017-17485. The vulnerability was fixed in upstream jackson-databind versions 2.8.11 and 2.9.4 (released December 2017) via introduction of SubTypeValidator class with comprehensive blacklist and pattern matching for dangerous deserialization gadgets. The target version 2.10.0 (released September 2019) includes these fixes from the upstream release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta, not by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:29:21.349678+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is NOT present in jackson-databind 2.10.0. The vulnerability allowed arbitrary code execution through unsafe deserialization of attacker-specified class names when default typing was enabled. The upstream fix (SubTypeValidator with comprehensive class blocklist) was already included in the upstream jackson-databind 2.10.0 release before TuxCare onboarded this version. The defense blocks instantiation of known-dangerous classes (TemplatesImpl, InvokerTransformer, etc.) during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is NOT present in jackson-databind 2.10.0. The vulnerability allowed arbitrary code execution through unsafe deserialization of attacker-specified class names when default typing was enabled. The upstream fix (SubTypeValidator with comprehensive class blocklist) was already included in the upstream jackson-databind 2.10.0 release before TuxCare onboarded this version. The defense blocks instantiation of known-dangerous classes (TemplatesImpl, InvokerTransformer, etc.) during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:20:11.775734+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5 via polymorphic deserialization of org.apache.ibatis.parsing.XPathParser gadget class enabling data exfiltration. The target (jackson-databind 2.10.0-tuxcare.1) is NOT AFFECTED because the upstream fix was already present in the 2.10.0 release before TuxCare onboarded it. The fix adds \"org.apache.ibatis.parsing.XPathParser\" to the SubTypeValidator blacklist (line 62 of SubTypeValidator.java), preventing instantiation during polymorphic deserialization. Fix commit 27b4defc270 by upstream author Tatu Saloranta is an ancestor of the first TuxCare onboarding commit, confirming this was an upstream vendor fix shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5 via polymorphic deserialization of org.apache.ibatis.parsing.XPathParser gadget class enabling data exfiltration. The target (jackson-databind 2.10.0-tuxcare.1) is NOT AFFECTED because the upstream fix was already present in the 2.10.0 release before TuxCare onboarded it. The fix adds \"org.apache.ibatis.parsing.XPathParser\" to the SubTypeValidator blacklist (line 62 of SubTypeValidator.java), preventing instantiation during polymorphic deserialization. Fix commit 27b4defc270 by upstream author Tatu Saloranta is an ancestor of the first TuxCare onboarding commit, confirming this was an upstream vendor fix shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:20:54.241430+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is not affecting the target repository. The vulnerability involves polymorphic deserialization of dangerous classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that enable LDAP-based remote code execution when Default Typing is enabled. The upstream vendor fix (commit 28badf7ef6) added these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix shipped in upstream version 2.10.0 before TuxCare onboarded the repository, so the vulnerable pattern has never been present in any TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 is not affecting the target repository. The vulnerability involves polymorphic deserialization of dangerous classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that enable LDAP-based remote code execution when Default Typing is enabled. The upstream vendor fix (commit 28badf7ef6) added these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix shipped in upstream version 2.10.0 before TuxCare onboarded the repository, so the vulnerable pattern has never been present in any TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:21:53.187202+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 does not affect jackson-databind 2.10.0. The vulnerability involves deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled, allowing remote code execution via JNDI/LDAP injection. The fix was already present in the upstream 2.10.0 release - these Oracle JDBC classes are blacklisted in SubTypeValidator.java (lines 67-69), preventing their deserialization. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the original 2.10.0 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 does not affect jackson-databind 2.10.0. The vulnerability involves deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled, allowing remote code execution via JNDI/LDAP injection. The fix was already present in the upstream 2.10.0 release - these Oracle JDBC classes are blacklisted in SubTypeValidator.java (lines 67-69), preventing their deserialization. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the original 2.10.0 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:54:41.040148+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.10.0-tuxcare.1 is NOT AFFECTED by CVE-2018-14718. The upstream fix that adds org.slf4j.ext.EventData to the polymorphic deserialization blacklist was already included in the upstream jackson-databind 2.10.0 release that TuxCare onboarded. The vulnerable pattern is not present because the upstream vendor (FasterXML) fixed it before the 2.10.0 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "Target version 2.10.0-tuxcare.1 is NOT AFFECTED by CVE-2018-14718. The upstream fix that adds org.slf4j.ext.EventData to the polymorphic deserialization blacklist was already included in the upstream jackson-databind 2.10.0 release that TuxCare onboarded. The vulnerable pattern is not present because the upstream vendor (FasterXML) fixed it before the 2.10.0 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:01:11.316675+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.10.0-tuxcare.1) is not affected by CVE-2018-14719. The vulnerability involves polymorphic deserialization of dangerous blaze-ds classes that can lead to arbitrary code execution. The fix, which adds these classes to a deserialization blocklist, was already present in the upstream jackson-databind 2.10.0 release that TuxCare onboarded. The blocklist entries are found in SubTypeValidator.java lines 71-75, blocking flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related dangerous classes. The fix commit (87d29af25e) was authored by the upstream maintainer (tatu.saloranta@iki.fi) and shipped in the 2.10.0 release before TuxCare's onboarding commit (8b2b6c8ad4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "The target repository (jackson-databind 2.10.0-tuxcare.1) is not affected by CVE-2018-14719. The vulnerability involves polymorphic deserialization of dangerous blaze-ds classes that can lead to arbitrary code execution. The fix, which adds these classes to a deserialization blocklist, was already present in the upstream jackson-databind 2.10.0 release that TuxCare onboarded. The blocklist entries are found in SubTypeValidator.java lines 71-75, blocking flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related dangerous classes. The fix commit (87d29af25e) was authored by the upstream maintainer (tatu.saloranta@iki.fi) and shipped in the 2.10.0 release before TuxCare's onboarding commit (8b2b6c8ad4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:08:55.717276+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 affects jackson-databind 2.x before 2.9.7. The target is version 2.10.0-tuxcare.1, which already contains the upstream fix from commit 87d29af25e. The fix adds four dangerous classes to the polymorphic deserialization blacklist in SubTypeValidator.java (lines 72-75): org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. This fix was authored by Tatu Saloranta (upstream Jackson maintainer) and was already present in jackson-databind 2.10.0 when TuxCare onboarded it via commit 8b2b6c8ad4 (\"Onboard version 2.10.0\"). The vulnerable pattern was never present in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 affects jackson-databind 2.x before 2.9.7. The target is version 2.10.0-tuxcare.1, which already contains the upstream fix from commit 87d29af25e. The fix adds four dangerous classes to the polymorphic deserialization blacklist in SubTypeValidator.java (lines 72-75): org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. This fix was authored by Tatu Saloranta (upstream Jackson maintainer) and was already present in jackson-databind 2.10.0 when TuxCare onboarded it via commit 8b2b6c8ad4 (\"Onboard version 2.10.0\"). The vulnerable pattern was never present in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:39:17.858992+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.10.0-tuxcare.1 is NOT AFFECTED by CVE-2018-14721. The vulnerability, which allows SSRF attacks via polymorphic deserialization of the org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl class, is not present because the upstream fix was already included in the 2.10.0 release. The CVE affects versions before 2.9.7; target version 2.10.0 is after the fixed version. The blocklist entry for the dangerous class exists in SubTypeValidator.java:75 and is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "Target version 2.10.0-tuxcare.1 is NOT AFFECTED by CVE-2018-14721. The vulnerability, which allows SSRF attacks via polymorphic deserialization of the org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl class, is not present because the upstream fix was already included in the 2.10.0 release. The CVE affects versions before 2.9.7; target version 2.10.0 is after the fixed version. The blocklist entry for the dangerous class exists in SubTypeValidator.java:75 and is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:50:52.202330+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. The target version 2.10.0-tuxcare.1 already contains the upstream fix (commit 72cd4025a2) that was shipped in the original 2.10.0 release. The vulnerable code pattern is not present because the fix predates TuxCare's onboarding of version 2.10.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. The target version 2.10.0-tuxcare.1 already contains the upstream fix (commit 72cd4025a2) that was shipped in the original 2.10.0 release. The vulnerable code pattern is not present because the fix predates TuxCare's onboarding of version 2.10.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:57:30.465792+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to missing blacklist entries for openjpa classes in polymorphic deserialization. The target repository is jackson-databind version 2.10.0-tuxcare.1, which already contains the upstream fix (commit 72cd4025a229fb28ec133235003dd4616f70afaa by Tatu Saloranta). The openjpa classes org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime are blacklisted in SubTypeValidator.java lines 79-80, preventing their polymorphic deserialization. This fix was shipped in upstream version 2.10.0 and imported by TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to missing blacklist entries for openjpa classes in polymorphic deserialization. The target repository is jackson-databind version 2.10.0-tuxcare.1, which already contains the upstream fix (commit 72cd4025a229fb28ec133235003dd4616f70afaa by Tatu Saloranta). The openjpa classes org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime are blacklisted in SubTypeValidator.java lines 79-80, preventing their polymorphic deserialization. This fix was shipped in upstream version 2.10.0 and imported by TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:25:39.175944+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.10.0 is not affected by CVE-2018-19362. The vulnerability involves unsafe polymorphic deserialization of the jboss-common-core class `org.jboss.util.propertyeditor.DocumentEditor`. The upstream fix (adding this class to the SubTypeValidator blocklist) was already present in the 2.10.0 release. Git history analysis confirms the fix commit (72cd4025a22) authored by upstream maintainer Tatu Saloranta was merged before TuxCare onboarded version 2.10.0. The blocklist entry at SubTypeValidator.java:78 prevents deserialization of the dangerous class, throwing a JsonMappingException during validation. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "Target version 2.10.0 is not affected by CVE-2018-19362. The vulnerability involves unsafe polymorphic deserialization of the jboss-common-core class `org.jboss.util.propertyeditor.DocumentEditor`. The upstream fix (adding this class to the SubTypeValidator blocklist) was already present in the 2.10.0 release. Git history analysis confirms the fix commit (72cd4025a22) authored by upstream maintainer Tatu Saloranta was merged before TuxCare onboarded version 2.10.0. The blocklist entry at SubTypeValidator.java:78 prevents deserialization of the dangerous class, throwing a JsonMappingException during validation. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via deserialization gadgets org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory. The target version 2.10.0 already contains the upstream fix (commit 038b471e2e by Tatu Saloranta) which blacklists both gadget classes in SubTypeValidator.java lines 59-60. This fix was included in the jackson-databind-2.10.0 upstream release tag and was onboarded by TuxCare. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via deserialization gadgets org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory. The target version 2.10.0 already contains the upstream fix (commit 038b471e2e by Tatu Saloranta) which blacklists both gadget classes in SubTypeValidator.java lines 59-60. This fix was included in the jackson-databind-2.10.0 upstream release tag and was onboarded by TuxCare. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:51:14.737145+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 fix is already present in jackson-databind 2.10.0. The vulnerability allowed remote code execution via c3p0 DataSource gadgets in polymorphic deserialization. The fix (commit 6799f8f10c by upstream maintainer Tatu Saloranta) blocks any class starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\" in SubTypeValidator.validateSubType(). This fix shipped in upstream release 2.10.0 and was included when TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 fix is already present in jackson-databind 2.10.0. The vulnerability allowed remote code execution via c3p0 DataSource gadgets in polymorphic deserialization. The fix (commit 6799f8f10c by upstream maintainer Tatu Saloranta) blocks any class starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\" in SubTypeValidator.validateSubType(). This fix shipped in upstream release 2.10.0 and was included when TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:34:22.136729+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 does not affect jackson-databind 2.10.0. The vulnerability (arbitrary file read via com.mysql.cj.jdbc.admin.MiniAdmin gadget in polymorphic deserialization) was fixed by upstream FasterXML in commit dda513bd72 (May 2019) before the 2.10.0 release. The fix adds MiniAdmin to the SubTypeValidator blocklist (SubTypeValidator.java:84), preventing deserialization of this gadget class. This upstream fix shipped in the original 2.10.0 release that TuxCare later onboarded (commit 8b2b6c8ad4 \"Onboard version 2.10.0\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 does not affect jackson-databind 2.10.0. The vulnerability (arbitrary file read via com.mysql.cj.jdbc.admin.MiniAdmin gadget in polymorphic deserialization) was fixed by upstream FasterXML in commit dda513bd72 (May 2019) before the 2.10.0 release. The fix adds MiniAdmin to the SubTypeValidator blocklist (SubTypeValidator.java:84), preventing deserialization of this gadget class. This upstream fix shipped in the original 2.10.0 release that TuxCare later onboarded (commit 8b2b6c8ad4 \"Onboard version 2.10.0\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T18:38:23.112681+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository (jackson-databind 2.10.0-tuxcare.1) is NOT AFFECTED by CVE-2019-12384. The vulnerability concerns polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to remote code execution. The upstream fix (commit c9ef4a10d6, authored by Tatu Saloranta on Jun 12, 2019) adds this class to the deserialization deny l...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 The target repository (jackson-databind 2.10.0-tuxcare.1) is NOT AFFECTED by CVE-2019-12384. The vulnerability concerns polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to remote code execution. The upstream fix (commit c9ef4a10d6, authored by Tatu Saloranta on Jun 12, 2019) adds this class to the deserialization deny l..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T07:20:00.097137+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository (jackson-databind 2.10.0) is NOT affected by CVE-2019-12814. The vulnerability, which allowed arbitrary file reading via JDOM XSLTransformer gadget classes when polymorphic typing is enabled, has been fixed by blocking these classes in the deserialization blacklist. This fix (commit 5f7c69bba0) was authored by upstream maintainer Tatu Saloranta and was already present in t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 The target repository (jackson-databind 2.10.0) is NOT affected by CVE-2019-12814. The vulnerability, which allowed arbitrary file reading via JDOM XSLTransformer gadget classes when polymorphic typing is enabled, has been fixed by blocking these classes in the deserialization blacklist. This fix (commit 5f7c69bba0) was authored by upstream maintainer Tatu Saloranta and was already present in t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:13:29.842653+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.10.0. The upstream fix (commit ad418eeb97) that adds net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blocklist was already included in the 2.10.0 release that TuxCare onboarded. The vulnerable code pattern (ability to deserialize the dangerous ehcache class) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.10.0. The upstream fix (commit ad418eeb97) that adds net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blocklist was already included in the 2.10.0 release that TuxCare onboarded. The vulnerable code pattern (ability to deserialize the dangerous ehcache class) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:32:59.098532+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.0-tuxcare.1 is NOT affected by CVE-2019-14439. The upstream vendor (Tatu Saloranta) fixed this polymorphic deserialization vulnerability by adding the dangerous class 'ch.qos.logback.core.db.JNDIConnectionSource' to the deserialization blocklist in commit ad418eeb97 (dated 2019-07-25), which was already included in the jackson-databind 2.10.0 upstream release that TuxCare onboarded. The fix prevents instantiation of this JNDI-capable logback class during polymorphic type handling, blocking the attack vector for remote code execution when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "The target jackson-databind 2.10.0-tuxcare.1 is NOT affected by CVE-2019-14439. The upstream vendor (Tatu Saloranta) fixed this polymorphic deserialization vulnerability by adding the dangerous class 'ch.qos.logback.core.db.JNDIConnectionSource' to the deserialization blocklist in commit ad418eeb97 (dated 2019-07-25), which was already included in the jackson-databind 2.10.0 upstream release that TuxCare onboarded. The fix prevents instantiation of this JNDI-capable logback class during polymorphic type handling, blocking the attack vector for remote code execution when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to missing blacklist entries for HikariConfig and HikariDataSource classes that enable polymorphic deserialization attacks. The target repository is jackson-databind 2.10.0, which was released on September 25, 2019. Both fix commits (d4983c740f adding HikariConfig and 73c1c2cc76 adding HikariDataSource) were made in August-September 2019 by upstream maintainer Tatu Saloranta and are ancestors of the TuxCare onboarding commit. The fixes were already present in the upstream 2.10.0 release. The blacklist entries are confirmed present in SubTypeValidator.java at lines 101 and 103, blocking deserialization of both com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to missing blacklist entries for HikariConfig and HikariDataSource classes that enable polymorphic deserialization attacks. The target repository is jackson-databind 2.10.0, which was released on September 25, 2019. Both fix commits (d4983c740f adding HikariConfig and 73c1c2cc76 adding HikariDataSource) were made in August-September 2019 by upstream maintainer Tatu Saloranta and are ancestors of the TuxCare onboarding commit. The fixes were already present in the upstream 2.10.0 release. The blacklist entries are confirmed present in SubTypeValidator.java at lines 101 and 103, blocking deserialization of both com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:57:03.771822+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target is version 2.10.0, which already contains the upstream fix (commit 41b7f9b901) that adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blacklist in SubTypeValidator.java. The fix was present in the upstream 2.10.0 release when TuxCare onboarded it (first TuxCare commit 8b2b6c8ad4 \"Onboard version 2.10.0\"). The vulnerable pattern (ability to deserialize JNDIConfiguration classes for JNDI injection) is not present because the upstream vendor already fixed it before this version was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target is version 2.10.0, which already contains the upstream fix (commit 41b7f9b901) that adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blacklist in SubTypeValidator.java. The fix was present in the upstream 2.10.0 release when TuxCare onboarded it (first TuxCare commit 8b2b6c8ad4 \"Onboard version 2.10.0\"). The vulnerable pattern (ability to deserialize JNDIConfiguration classes for JNDI injection) is not present because the upstream vendor already fixed it before this version was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:40:02.474913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "action_statement": "Vulnerability CVE-2019-14893 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:07:57.029053+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is NOT present in jackson-databind 2.10.0. The vulnerability involves a polymorphic typing gadget (com.zaxxer.hikari.HikariDataSource) that could enable remote code execution via deserialization. The upstream vendor (FasterXML) fixed this in commit 73c1c2cc76 by adding HikariDataSource to SubTypeValidator's blocklist. This fix was already included in the upstream 2.10.0 release (released after the affected versions: before 2.9.10, 2.8.11.5, 2.6.7.3), which TuxCare onboarded. The target contains the fix at SubTypeValidator.java:102-103.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 is NOT present in jackson-databind 2.10.0. The vulnerability involves a polymorphic typing gadget (com.zaxxer.hikari.HikariDataSource) that could enable remote code execution via deserialization. The upstream vendor (FasterXML) fixed this in commit 73c1c2cc76 by adding HikariDataSource to SubTypeValidator's blocklist. This fix was already included in the upstream 2.10.0 release (released after the affected versions: before 2.9.10, 2.8.11.5, 2.6.7.3), which TuxCare onboarded. The target contains the fix at SubTypeValidator.java:102-103.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "action_statement": "Vulnerability CVE-2019-16942 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "action_statement": "Vulnerability CVE-2019-16943 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:29:31.146838+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.10.0-tuxcare.1 is not affected by CVE-2019-17267. The vulnerability concerns polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup, which could enable code execution. The upstream fix (commit 191a4cdf87) adds this class to the SubTypeValidator blocklist at line 95, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in jackson-databind 2.10.0, which TuxCare then onboarded. The blocklist entry is actively enforced by BeanDeserializerFactory during bean deserialization, blocking the dangerous class before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "Target jackson-databind 2.10.0-tuxcare.1 is not affected by CVE-2019-17267. The vulnerability concerns polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup, which could enable code execution. The upstream fix (commit 191a4cdf87) adds this class to the SubTypeValidator blocklist at line 95, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in jackson-databind 2.10.0, which TuxCare then onboarded. The blocklist entry is actively enforced by BeanDeserializerFactory during bean deserialization, blocking the dangerous class before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "action_statement": "Vulnerability CVE-2019-17531 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "action_statement": "Vulnerability CVE-2019-20330 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "action_statement": "Vulnerability CVE-2020-10650 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:42:25.602958+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "action_statement": "Vulnerability CVE-2020-10672 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "action_statement": "Vulnerability CVE-2020-10673 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:41:52.105869+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "action_statement": "Vulnerability CVE-2020-10968 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:38:21.395921+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "action_statement": "Vulnerability CVE-2020-10969 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:40:44.036745+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "action_statement": "Vulnerability CVE-2020-11111 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:38:21.395921+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "action_statement": "Vulnerability CVE-2020-11112 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:43:15.137789+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "action_statement": "Vulnerability CVE-2020-11113 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:40:44.036745+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "action_statement": "Vulnerability CVE-2020-11619 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:43:40.464789+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "action_statement": "Vulnerability CVE-2020-11620 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:41:27.206714+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "action_statement": "Vulnerability CVE-2020-14060 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:38:21.395921+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "action_statement": "Vulnerability CVE-2020-14061 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:42:45.805756+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "action_statement": "Vulnerability CVE-2020-14062 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:39:12.873936+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "action_statement": "Vulnerability CVE-2020-14195 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "action_statement": "Vulnerability CVE-2020-24616 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "action_statement": "Vulnerability CVE-2020-24750 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-25649"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "action_statement": "Vulnerability CVE-2020-35490 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "action_statement": "Vulnerability CVE-2020-35491 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "action_statement": "Vulnerability CVE-2020-35728 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "action_statement": "Vulnerability CVE-2020-36179 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "action_statement": "Vulnerability CVE-2020-36180 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "action_statement": "Vulnerability CVE-2020-36181 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "action_statement": "Vulnerability CVE-2020-36182 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "action_statement": "Vulnerability CVE-2020-36183 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "action_statement": "Vulnerability CVE-2020-36184 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "action_statement": "Vulnerability CVE-2020-36185 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "action_statement": "Vulnerability CVE-2020-36186 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "action_statement": "Vulnerability CVE-2020-36187 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "action_statement": "Vulnerability CVE-2020-36188 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "action_statement": "Vulnerability CVE-2020-36189 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "action_statement": "Vulnerability CVE-2020-36518 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "action_statement": "Vulnerability CVE-2020-8840 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:39:12.873936+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "action_statement": "Vulnerability CVE-2020-9546 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "action_statement": "Vulnerability CVE-2020-9547 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "action_statement": "Vulnerability CVE-2020-9548 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "action_statement": "Vulnerability CVE-2021-20190 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "action_statement": "Vulnerability CVE-2021-46877 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "action_statement": "Vulnerability CVE-2022-42004 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T01:07:55.976356+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "action_statement": "Vulnerability CVE-2026-54512 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Version 2.10.0 is not affected by CVE-2026-54513. The vulnerable method allowIfSubTypeIsArray() does not exist in this version - it was added upstream in commit 533fe319a and first shipped in 2.10.1. The advisory range starting at 2.10.0 is therefore off by one patch release; the vulnerability begins at 2.10.1, where the method was added with an unsafe implementation that checked only clazz.isArray() without validating component types. Version 2.10.0 has no array-handling logic in BasicPolymorphicTypeValidator and cannot be exploited via the described attack vector.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54513"
      },
      "impact_statement": "Version 2.10.0 is not affected by CVE-2026-54513. The vulnerable method allowIfSubTypeIsArray() does not exist in this version - it was added upstream in commit 533fe319a and first shipped in 2.10.1. The advisory range starting at 2.10.0 is therefore off by one patch release; the vulnerability begins at 2.10.1, where the method was added with an unsafe implementation that checked only clazz.isArray() without validating component types. Version 2.10.0 has no array-handling logic in BasicPolymorphicTypeValidator and cannot be exploited via the described attack vector."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:26:05.576051+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      },
      "action_statement": "Vulnerability CVE-2026-54515 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:34:13.910240+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.10.0 is NOT AFFECTED by CVE-2026-54517. While the view check is missing in the property buffering code path (BeanDeserializer.java:449), the vulnerability cannot manifest because setterless properties cannot be successfully buffered and applied in property-based creator deserialization in this version. The buffering mechanism stores properties as PropertyValue.Regular which calls set(...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Version 2.10.0 is NOT AFFECTED by CVE-2026-54517. While the view check is missing in the property buffering code path (BeanDeserializer.java:449), the vulnerability cannot manifest because setterless properties cannot be successfully buffered and applied in property-based creator deserialization in this version. The buffering mechanism stores properties as PropertyValue.Regular which calls set(..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:04:21.221888+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.10.0 explicitly does not support @JsonUnwrapped on creator parameters. The vulnerable method processUnwrappedCreatorProperties() does not exist in this version. Any attempt to use @JsonUnwrapped on a constructor/factory parameter is rejected with error \"Cannot define Creator parameter as @JsonUnwrapped: combination not yet supported\" before any deserialization occurs. The feature (and...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.10.0 explicitly does not support @JsonUnwrapped on creator parameters. The vulnerable method processUnwrappedCreatorProperties() does not exist in this version. Any attempt to use @JsonUnwrapped on a constructor/factory parameter is rejected with error \"Cannot define Creator parameter as @JsonUnwrapped: combination not yet supported\" before any deserialization occurs. The feature (and..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:35:00.332127+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-59888 affects Java Records with @JsonIgnore annotations and PropertyNamingStrategy in jackson-databind versions 2.15.0+. The vulnerability allows bypassing @JsonIgnore by deserializing data under the renamed property key (e.g., \"internal_role\" for \"internalRole\" with snake_case naming). However, target version 2.10.0-tuxcare.1 does not have Java Records support, as it targets JDK 7 and...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-59888 affects Java Records with @JsonIgnore annotations and PropertyNamingStrategy in jackson-databind versions 2.15.0+. The vulnerability allows bypassing @JsonIgnore by deserializing data under the renamed property key (e.g., \"internal_role\" for \"internalRole\" with snake_case naming). However, target version 2.10.0-tuxcare.1 does not have Java Records support, as it targets JDK 7 and..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:26:05.576051+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:12:47.728703+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:26:05.576051+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.10.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.10.0-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}