{ "@id": "urn:uuid:a03f9317-4cb2-473d-8cd1-3527c9e3abe2", "role": "Document Creator", "author": "https://tuxcare.com", "version": 57, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T11:21:00.050861+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T13:20:48.274952+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.10.2-tuxcare.3 is NOT AFFECTED because it is based on upstream jackson-databind 2.10.2 (released 2020-01-04), which already contains all fixes for this CVE. The vulnerable classes from databind#1680 and databind#1737 are blacklisted in SubTypeValidator.java, and the validation is properly enforced during deserialization. This is an upstream fix shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.10.2-tuxcare.3 is NOT AFFECTED because it is based on upstream jackson-databind 2.10.2 (released 2020-01-04), which already contains all fixes for this CVE. The vulnerable classes from databind#1680 and databind#1737 are blacklisted in SubTypeValidator.java, and the validation is properly enforced during deserialization. This is an upstream fix shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T15:51:12.642270+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3 via incomplete deserialization blacklist allowing RCE when Spring libraries are present. Target version 2.10.2-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) already applied the fix in version 2.10.2 (released January 2020, after CVE disclosure in December 2017). The fix introduced SubTypeValidator class with comprehensive blacklist including all CVE-2017-17485 gadget classes: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, plus sophisticated Spring class detection blocking AbstractPointcutAdvisor and AbstractApplicationContext subclasses. Validation is mandatory, runs in BeanDeserializerFactory.createBeanDeserializer() before deserialization, and cannot be bypassed. TuxCare onboarded upstream 2.10.2 which already contained these protections.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3 via incomplete deserialization blacklist allowing RCE when Spring libraries are present. Target version 2.10.2-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) already applied the fix in version 2.10.2 (released January 2020, after CVE disclosure in December 2017). The fix introduced SubTypeValidator class with comprehensive blacklist including all CVE-2017-17485 gadget classes: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, plus sophisticated Spring class detection blocking AbstractPointcutAdvisor and AbstractApplicationContext subclasses. Validation is mandatory, runs in BeanDeserializerFactory.createBeanDeserializer() before deserialization, and cannot be bypassed. TuxCare onboarded upstream 2.10.2 which already contained these protections.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T14:40:05.423100+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.10.2-tuxcare.3 is not affected by CVE-2017-7525. The upstream jackson-databind project fixed this vulnerability in version 2.8.11 by introducing SubTypeValidator with a blocklist of dangerous gadget classes including TemplatesImpl, InvokerTransformer, and others. This fix was already present in the upstream 2.10.2 release that TuxCare onboarded. The SubTypeValidator.validateSubType() method is unconditionally called from BeanDeserializerFactory.createBeanDeserializer() before any bean deserialization occurs, blocking all dangerous classes specified in CVE-2017-7525.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "Target version 2.10.2-tuxcare.3 is not affected by CVE-2017-7525. The upstream jackson-databind project fixed this vulnerability in version 2.8.11 by introducing SubTypeValidator with a blocklist of dangerous gadget classes including TemplatesImpl, InvokerTransformer, and others. This fix was already present in the upstream 2.10.2 release that TuxCare onboarded. The SubTypeValidator.validateSubType() method is unconditionally called from BeanDeserializerFactory.createBeanDeserializer() before any bean deserialization occurs, blocking all dangerous classes specified in CVE-2017-7525.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T13:25:51.798724+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.2-tuxcare.3 is NOT affected by CVE-2018-11307. The fix (blacklisting org.apache.ibatis.parsing.XPathParser) was already present in the upstream jackson-databind 2.10.2 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target because the upstream fix (commit 27b4defc27) was included in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "The target jackson-databind 2.10.2-tuxcare.3 is NOT affected by CVE-2018-11307. The fix (blacklisting org.apache.ibatis.parsing.XPathParser) was already present in the upstream jackson-databind 2.10.2 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target because the upstream fix (commit 27b4defc27) was included in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.10.2-tuxcare.3) is not affected by CVE-2018-12022. The vulnerability involves polymorphic deserialization of dangerous classes from Jodd-db and Oracle JDBC libraries that can lead to remote code execution via LDAP/JNDI lookups. The fix, which adds these class names to a blacklist in SubTypeValidator.java, was already present in the upstream jackson-databind 2.10.2 release that TuxCare onboarded. The fix commit (28badf7ef6) authored by upstream maintainer Tatu Saloranta is an ancestor of the TuxCare onboarding commit (0d3ab6edb3), confirming it shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "The target repository (jackson-databind 2.10.2-tuxcare.3) is not affected by CVE-2018-12022. The vulnerability involves polymorphic deserialization of dangerous classes from Jodd-db and Oracle JDBC libraries that can lead to remote code execution via LDAP/JNDI lookups. The fix, which adds these class names to a blacklist in SubTypeValidator.java, was already present in the upstream jackson-databind 2.10.2 release that TuxCare onboarded. The fix commit (28badf7ef6) authored by upstream maintainer Tatu Saloranta is an ancestor of the TuxCare onboarding commit (0d3ab6edb3), confirming it shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T16:30:36.061493+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6 due to polymorphic deserialization of Oracle JDBC classes enabling JNDI/LDAP attacks when Default Typing is enabled. The target (jackson-databind 2.10.2) contains the upstream fix: Oracle JDBC class names (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) are blocklisted in SubTypeValidator.java lines 67-69. The fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.10.2 before TuxCare onboarded the version. Verdict: not_affected (upstream fix present in shipped version).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6 due to polymorphic deserialization of Oracle JDBC classes enabling JNDI/LDAP attacks when Default Typing is enabled. The target (jackson-databind 2.10.2) contains the upstream fix: Oracle JDBC class names (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) are blocklisted in SubTypeValidator.java lines 67-69. The fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.10.2 before TuxCare onboarded the version. Verdict: not_affected (upstream fix present in shipped version).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T14:07:13.542936+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.10.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of the slf4j-ext class \"org.slf4j.ext.EventData\" that could lead to arbitrary code execution. The fix (adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java) was already present in the upstream jackson-databind 2.10.2 release that TuxCare onboarded. The blacklist entry at lines 71-75 of SubTypeValidator.java blocks deserialization of the dangerous class, and the validation is properly enforced through BeanDeserializerFactory._validateSubType() at line 141. This is an upstream fix by FasterXML maintainer Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.10.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of the slf4j-ext class \"org.slf4j.ext.EventData\" that could lead to arbitrary code execution. The fix (adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java) was already present in the upstream jackson-databind 2.10.2 release that TuxCare onboarded. The blacklist entry at lines 71-75 of SubTypeValidator.java blocks deserialization of the dangerous class, and the validation is properly enforced through BeanDeserializerFactory._validateSubType() at line 141. This is an upstream fix by FasterXML maintainer Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T16:07:05.916705+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.2 is NOT affected by CVE-2018-14719. The upstream fix (commit 87d29af25e) that blocks the four vulnerable classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) from polymorphic deserialization was already shipped in the upstream jackson-databind 2.10.2 release. The blocklist is present in SubTypeValidator.java (lines 72-75) and properly enforced via BeanDeserializerFactory._validateSubType (line 141). This fix predates the TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "The target jackson-databind 2.10.2 is NOT affected by CVE-2018-14719. The upstream fix (commit 87d29af25e) that blocks the four vulnerable classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) from polymorphic deserialization was already shipped in the upstream jackson-databind 2.10.2 release. The blocklist is present in SubTypeValidator.java (lines 72-75) and properly enforced via BeanDeserializerFactory._validateSubType (line 141). This fix predates the TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T14:13:29.562378+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.10.2-tuxcare.3. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that enable XXE attacks via polymorphic deserialization are already blacklisted in SubTypeValidator.java:72-75. The fix was authored by upstream maintainer Tatu Saloranta (commit 87d29af) and shipped in the upstream 2.10.2 release before TuxCare's onboarding. The blacklist is enforced by default via SubTypeValidator.validateSubType() called from BeanDeserializerFactory._validateSubType() during bean deserializer creation, blocking instantiation of these gadget classes and preventing the attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.10.2-tuxcare.3. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that enable XXE attacks via polymorphic deserialization are already blacklisted in SubTypeValidator.java:72-75. The fix was authored by upstream maintainer Tatu Saloranta (commit 87d29af) and shipped in the upstream 2.10.2 release before TuxCare's onboarding. The blacklist is enforced by default via SubTypeValidator.validateSubType() called from BeanDeserializerFactory._validateSubType() during bean deserializer creation, blocking instantiation of these gadget classes and preventing the attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T14:41:44.946655+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is not present in jackson-databind 2.10.2. The vulnerability concerns polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl, which could enable SSRF attacks. The upstream vendor (FasterXML) fixed this in commit 87d29af25e (August 2018) by adding the class to a deserialization blocklist in SubTypeValidator. This fix was included in upstream release 2.10.2 (January 2020) before TuxCare onboarded the version. The target contains the complete defense: SubTypeValidator.java lines 71-75 block the four classes from CVE-2018-14721 (databind#2097), and the validation is enforced on all bean deserialization paths through BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 is not present in jackson-databind 2.10.2. The vulnerability concerns polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl, which could enable SSRF attacks. The upstream vendor (FasterXML) fixed this in commit 87d29af25e (August 2018) by adding the class to a deserialization blocklist in SubTypeValidator. This fix was included in upstream release 2.10.2 (January 2020) before TuxCare onboarded the version. The target contains the complete defense: SubTypeValidator.java lines 71-75 block the four classes from CVE-2018-14721 (databind#2097), and the validation is enforced on all bean deserialization paths through BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T13:02:11.032230+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is NOT present in jackson-databind 2.10.2. The vulnerability involves polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo. The upstream vendor fix (commit 72cd4025a2, dated Nov 19, 2018) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in the upstream release 2.10.2 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (0d3ab6edb3, \"Onboard version 2.10.2\"). The target code at SubTypeValidator.java lines 77-81 contains the blocklist entries, and the validateSubType method enforces the blocklist by throwing JsonMappingException for illegal types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 is NOT present in jackson-databind 2.10.2. The vulnerability involves polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo. The upstream vendor fix (commit 72cd4025a2, dated Nov 19, 2018) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in the upstream release 2.10.2 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (0d3ab6edb3, \"Onboard version 2.10.2\"). The target code at SubTypeValidator.java lines 77-81 contains the blocklist entries, and the validateSubType method enforces the blocklist by throwing JsonMappingException for illegal types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T17:07:57.029053+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind 2.x before 2.9.8. Target version 2.10.2-tuxcare.3 already contains the upstream fix (commit 72cd4025a2, Nov 2018) that adds OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime) to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. The fix was shipped in upstream 2.10.2 release before TuxCare onboarded it (Sep 2026). Vulnerable pattern not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 affects jackson-databind 2.x before 2.9.8. Target version 2.10.2-tuxcare.3 already contains the upstream fix (commit 72cd4025a2, Nov 2018) that adds OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime) to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. The fix was shipped in upstream 2.10.2 release before TuxCare onboarded it (Sep 2026). Vulnerable pattern not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T15:31:44.936589+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.10.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of the jboss-common-core class `org.jboss.util.propertyeditor.DocumentEditor`. The upstream fix (commit 72cd4025a2 by Tatu Saloranta, 2018-11-19) added this class to the SubTypeValidator blacklist, preventing its deserialization. This fix was already present in upstream release 2.10.2, which TuxCare onboarded via commit 0d3ab6edb3 (\"Onboard version 2.10.2\"). The target repository contains the complete fix at SubTypeValidator.java lines 78-81, and the validation is active in the deserialization path via BeanDeserializerFactory line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.10.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of the jboss-common-core class `org.jboss.util.propertyeditor.DocumentEditor`. The upstream fix (commit 72cd4025a2 by Tatu Saloranta, 2018-11-19) added this class to the SubTypeValidator blacklist, preventing its deserialization. This fix was already present in upstream release 2.10.2, which TuxCare onboarded via commit 0d3ab6edb3 (\"Onboard version 2.10.2\"). The target repository contains the complete fix at SubTypeValidator.java lines 78-81, and the validation is active in the deserialization path via BeanDeserializerFactory line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.10.2. The vulnerability involved two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed Jackson's default typing blacklist. The target repository already contains the fix - both gadget classes are blacklisted in SubTypeValidator.java at lines 59-60. This fix was authored by Tatu Saloranta (upstream Jackson maintainer) and shipped in the upstream release 2.8.11.1/2.9.4, which predates the TuxCare onboarding of version 2.10.2 by 1345+ commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.10.2. The vulnerability involved two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed Jackson's default typing blacklist. The target repository already contains the fix - both gadget classes are blacklisted in SubTypeValidator.java at lines 59-60. This fix was authored by Tatu Saloranta (upstream Jackson maintainer) and shipped in the upstream release 2.8.11.1/2.9.4, which predates the TuxCare onboarding of version 2.10.2 by 1345+ commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T14:06:34.485186+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.10.2. The vulnerability concerns insufficient blacklist validation allowing deserialization of c3p0 DataSource gadget classes to achieve remote code execution. The upstream fix (commit 6799f8f10c by Tatu Saloranta) was already included in the upstream 2.10.2 release and is present in SubTypeValidator.java lines 171-181, which blocks any class starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\". This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.10.2. The vulnerability concerns insufficient blacklist validation allowing deserialization of c3p0 DataSource gadget classes to achieve remote code execution. The upstream fix (commit 6799f8f10c by Tatu Saloranta) was already included in the upstream 2.10.2 release and is present in SubTypeValidator.java lines 171-181, which blocks any class starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\". This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T16:40:07.551074+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.2-tuxcare.3 is NOT affected by CVE-2019-12086. The vulnerability was fixed in upstream version 2.9.9 by adding \"com.mysql.cj.jdbc.admin.MiniAdmin\" to the deserialization blocklist. This fix was already present in the upstream 2.10.2 release that TuxCare onboarded, as confirmed by git history showing the fix commit (dda513bd725) by upstream maintainer Tatu Saloranta predates the first TuxCare commit. The vulnerable pattern (ability to deserialize MiniAdmin class) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "The target jackson-databind 2.10.2-tuxcare.3 is NOT affected by CVE-2019-12086. The vulnerability was fixed in upstream version 2.9.9 by adding \"com.mysql.cj.jdbc.admin.MiniAdmin\" to the deserialization blocklist. This fix was already present in the upstream 2.10.2 release that TuxCare onboarded, as confirmed by git history showing the fix commit (dda513bd725) by upstream maintainer Tatu Saloranta predates the first TuxCare commit. The vulnerable pattern (ability to deserialize MiniAdmin class) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-01T18:59:00.095619+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.10.2 is NOT AFFECTED by CVE-2019-12384. The vulnerability concerns polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to remote code execution. The fix (blocking this class from deserialization) was included in upstream release 2.9.9.1 and is present in version 2.10.2. The blocklist entry exi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 The target jackson-databind 2.10.2 is NOT AFFECTED by CVE-2019-12384. The vulnerability concerns polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to remote code execution. The fix (blocking this class from deserialization) was included in upstream release 2.9.9.1 and is present in version 2.10.2. The blocklist entry exi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-02T07:41:00.094163+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.10.2-tuxcare.3. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes that can read arbitrary local files. The upstream fix (commit 5f7c69bba0 by Tatu Saloranta) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. This fix was ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.10.2-tuxcare.3. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes that can read arbitrary local files. The upstream fix (commit 5f7c69bba0 by Tatu Saloranta) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. This fix was ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T12:23:26.744347+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.10.2-tuxcare.3. The vulnerability involves unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when Jackson's polymorphic type handling (default typing) is enabled, leading to remote code execution. The fix (blacklisting this dangerous gadget class in SubTypeValidator.java) was already present in the upstream 2.10.2 release that TuxCare onboarded. The upstream fix commit (ad418eeb by Tatu Saloranta) predates all TuxCare backport activity on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.10.2-tuxcare.3. The vulnerability involves unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when Jackson's polymorphic type handling (default typing) is enabled, leading to remote code execution. The fix (blacklisting this dangerous gadget class in SubTypeValidator.java) was already present in the upstream 2.10.2 release that TuxCare onboarded. The upstream fix commit (ad418eeb by Tatu Saloranta) predates all TuxCare backport activity on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T13:56:28.350475+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind when Default Typing is enabled and logback is in the classpath, allowing JNDI injection via ch.qos.logback.core.db.JNDIConnectionSource. The target jackson-databind 2.10.2-tuxcare.3 is NOT AFFECTED because the upstream fix (commit ad418eeb97) was already present in the 2.10.2 release that TuxCare onboarded. The fix adds ch.qos.logback.core.db.JNDIConnectionSource to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing its deserialization. The defense is active by default and integrated into the BeanDeserializerFactory deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 affects jackson-databind when Default Typing is enabled and logback is in the classpath, allowing JNDI injection via ch.qos.logback.core.db.JNDIConnectionSource. The target jackson-databind 2.10.2-tuxcare.3 is NOT AFFECTED because the upstream fix (commit ad418eeb97) was already present in the 2.10.2 release that TuxCare onboarded. The fix adds ch.qos.logback.core.db.JNDIConnectionSource to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing its deserialization. The defense is active by default and integrated into the BeanDeserializerFactory deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T16:55:18.943377+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.10.2 is not affected by CVE-2019-14540. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes, which could lead to arbitrary code execution. The fix (blocklisting these classes in SubTypeValidator) was applied by upstream maintainer Tatu Saloranta in commits d4983c740f (Aug 2019) and 73c1c2cc76 (Sep 2019), both of which shipped in upstream release 2.10.2 before TuxCare onboarded it. The blocklist entries are present at SubTypeValidator.java:100-103, and the defense is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "Target version 2.10.2 is not affected by CVE-2019-14540. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes, which could lead to arbitrary code execution. The fix (blocklisting these classes in SubTypeValidator) was applied by upstream maintainer Tatu Saloranta in commits d4983c740f (Aug 2019) and 73c1c2cc76 (Sep 2019), both of which shipped in upstream release 2.10.2 before TuxCare onboarded it. The blocklist entries are present at SubTypeValidator.java:100-103, and the defense is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T16:03:43.787457+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 does not affect jackson-databind version 2.10.2. The vulnerability involves polymorphic deserialization of malicious objects using commons-configuration 1 and 2 JNDI classes. The upstream vendor (FasterXML) fixed this in commit 41b7f9b901 by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blocklist. This fix was already present in the upstream 2.10.2 release when TuxCare onboarded it (commit 0d3ab6edb3). The CVE explicitly states versions \"before 2.9.10, 2.8.11.5, and 2.6.7.3\" are affected, and 2.10.2 is after 2.9.10.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 does not affect jackson-databind version 2.10.2. The vulnerability involves polymorphic deserialization of malicious objects using commons-configuration 1 and 2 JNDI classes. The upstream vendor (FasterXML) fixed this in commit 41b7f9b901 by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blocklist. This fix was already present in the upstream 2.10.2 release when TuxCare onboarded it (commit 0d3ab6edb3). The CVE explicitly states versions \"before 2.9.10, 2.8.11.5, and 2.6.7.3\" are affected, and 2.10.2 is after 2.9.10.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.10.2-tuxcare.3 is not affected by CVE-2019-14893. The vulnerability, which allowed polymorphic deserialization of malicious objects using the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool), was fixed in upstream versions 2.9.10 and 2.10.0. The fix adds the xalan JNDI class to the blacklist in SubTypeValidator.java and is present in the target at line 113. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.10.2 release that TuxCare onboarded, predating all TuxCare modifications to this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "The target jackson-databind version 2.10.2-tuxcare.3 is not affected by CVE-2019-14893. The vulnerability, which allowed polymorphic deserialization of malicious objects using the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool), was fixed in upstream versions 2.9.10 and 2.10.0. The fix adds the xalan JNDI class to the blacklist in SubTypeValidator.java and is present in the target at line 113. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.10.2 release that TuxCare onboarded, predating all TuxCare modifications to this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T17:11:18.856766+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is NOT present in jackson-databind 2.10.2-tuxcare.3. The vulnerability relates to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which was blocked by adding it to SubTypeValidator's blocklist. This fix (commit 73c1c2cc76) was authored by upstream maintainer Tatu Saloranta on 2019-09-12 and shipped in the upstream jackson-databind 2.10.2 release (2020-01-04). TuxCare onboarded version 2.10.2, which already contained the fix. The target is not affected because the vulnerable code pattern was never present in the onboarded version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 is NOT present in jackson-databind 2.10.2-tuxcare.3. The vulnerability relates to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which was blocked by adding it to SubTypeValidator's blocklist. This fix (commit 73c1c2cc76) was authored by upstream maintainer Tatu Saloranta on 2019-09-12 and shipped in the upstream jackson-databind 2.10.2 release (2020-01-04). TuxCare onboarded version 2.10.2, which already contained the fix. The target is not affected because the vulnerable code pattern was never present in the onboarded version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T15:15:02.250684+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.10.2-tuxcare.3 is NOT affected by CVE-2019-16942. The vulnerability was fixed in upstream version 2.10.1 (released 2019-11-09) by adding three class names to the deserialization blocklist in SubTypeValidator.java. The fix was already present when TuxCare onboarded version 2.10.2 in 2026. The vulnerable code pattern (missing blocklist entries for org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "The target jackson-databind version 2.10.2-tuxcare.3 is NOT affected by CVE-2019-16942. The vulnerability was fixed in upstream version 2.10.1 (released 2019-11-09) by adding three class names to the deserialization blocklist in SubTypeValidator.java. The fix was already present when TuxCare onboarded version 2.10.2 in 2026. The vulnerable code pattern (missing blocklist entries for org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T17:22:22.486046+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 concerns a polymorphic deserialization vulnerability in jackson-databind where attackers could instantiate dangerous gadget classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource) when Default Typing is enabled. The target repository jackson-databind version 2.10.2-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability in commit 9593e16cf5 (dated 2019-09-28) by adding these gadget classes to a blocklist in SubTypeValidator.java. This fix was included in the upstream 2.10.2 release that TuxCare subsequently onboarded via commit 0d3ab6edb3. The vulnerable pattern is not present in the target because the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 concerns a polymorphic deserialization vulnerability in jackson-databind where attackers could instantiate dangerous gadget classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource) when Default Typing is enabled. The target repository jackson-databind version 2.10.2-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability in commit 9593e16cf5 (dated 2019-09-28) by adding these gadget classes to a blocklist in SubTypeValidator.java. This fix was included in the upstream 2.10.2 release that TuxCare subsequently onboarded via commit 0d3ab6edb3. The vulnerable pattern is not present in the target because the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T15:31:44.936589+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267: Target version 2.10.2-tuxcare.3 is NOT AFFECTED. The vulnerability involves polymorphic deserialization of the dangerous gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf87 by tatu.saloranta@iki.fi) was already included in the upstream 2.10.2 release before TuxCare onboarded it. The fix adds this class to SubTypeValidator's blocklist (line 95), preventing its instantiation during polymorphic type resolution. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267: Target version 2.10.2-tuxcare.3 is NOT AFFECTED. The vulnerability involves polymorphic deserialization of the dangerous gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf87 by tatu.saloranta@iki.fi) was already included in the upstream 2.10.2 release before TuxCare onboarded it. The fix adds this class to SubTypeValidator's blocklist (line 95), preventing its instantiation during polymorphic type resolution. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T14:52:04.486756+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is a polymorphic typing vulnerability in jackson-databind affecting versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. The target version 2.10.2-tuxcare.3 contains the upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0) that blocks deserialization of org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource classes. This fix was included in the upstream 2.10.2 release that TuxCare onboarded, meaning the vulnerable code pattern was never present in this version. The fix is confirmed at SubTypeValidator.java:120-122.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is a polymorphic typing vulnerability in jackson-databind affecting versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. The target version 2.10.2-tuxcare.3 contains the upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0) that blocks deserialization of org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource classes. This fix was included in the upstream 2.10.2 release that TuxCare onboarded, meaning the vulnerable code pattern was never present in this version. The fix is confirmed at SubTypeValidator.java:120-122.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 targets jackson-databind versions lacking blocklist entries for two ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector). The target version 2.10.2-tuxcare.3 contains the upstream fix (commit fc4214a883d by Tatu Saloranta, November 2019) that adds both classes to DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix shipped in the upstream 2.10.2 release and was onboarded by TuxCare. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 targets jackson-databind versions lacking blocklist entries for two ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector). The target version 2.10.2-tuxcare.3 contains the upstream fix (commit fc4214a883d by Tatu Saloranta, November 2019) that adds both classes to DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix shipped in the upstream 2.10.2 release and was onboarded by TuxCare. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-05T09:23:00.090239+00:00", "status_notes": "Vulnerability CVE-2020-10650 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4.", "vulnerability": { "name": "CVE-2020-10650" }, "action_statement": "Vulnerability CVE-2020-10650 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-10T11:21:00.050861+00:00", "status_notes": "Vulnerability CVE-2020-10672 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.6.", "vulnerability": { "name": "CVE-2020-10672" }, "action_statement": "Vulnerability CVE-2020-10672 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-09T13:19:56.319269+00:00", "status_notes": "Vulnerability CVE-2020-10673 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5.", "vulnerability": { "name": "CVE-2020-10673" }, "action_statement": "Vulnerability CVE-2020-10673 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-29T01:42:37.118833+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-09T13:20:20.076692+00:00", "status_notes": "Vulnerability CVE-2020-10969 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5.", "vulnerability": { "name": "CVE-2020-10969" }, "action_statement": "Vulnerability CVE-2020-10969 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-09T13:21:00.261264+00:00", "status_notes": "Vulnerability CVE-2020-11111 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11111" }, "action_statement": "Vulnerability CVE-2020-11111 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-09T13:20:20.076692+00:00", "status_notes": "Vulnerability CVE-2020-11112 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11112" }, "action_statement": "Vulnerability CVE-2020-11112 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-09T13:21:00.261264+00:00", "status_notes": "Vulnerability CVE-2020-11113 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11113" }, "action_statement": "Vulnerability CVE-2020-11113 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-09T13:20:20.076692+00:00", "status_notes": "Vulnerability CVE-2020-11619 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11619" }, "action_statement": "Vulnerability CVE-2020-11619 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-10T11:21:00.050861+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-09T13:21:00.261264+00:00", "status_notes": "Vulnerability CVE-2020-14060 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5.", "vulnerability": { "name": "CVE-2020-14060" }, "action_statement": "Vulnerability CVE-2020-14060 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-09T13:20:20.076692+00:00", "status_notes": "Vulnerability CVE-2020-14061 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5.", "vulnerability": { "name": "CVE-2020-14061" }, "action_statement": "Vulnerability CVE-2020-14061 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-09T13:21:00.261264+00:00", "status_notes": "Vulnerability CVE-2020-14062 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5.", "vulnerability": { "name": "CVE-2020-14062" }, "action_statement": "Vulnerability CVE-2020-14062 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-09T13:20:20.076692+00:00", "status_notes": "Vulnerability CVE-2020-14195 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5.", "vulnerability": { "name": "CVE-2020-14195" }, "action_statement": "Vulnerability CVE-2020-14195 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-05T09:23:00.090239+00:00", "status_notes": "Vulnerability CVE-2020-24616 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4.", "vulnerability": { "name": "CVE-2020-24616" }, "action_statement": "Vulnerability CVE-2020-24616 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-05T09:23:00.090239+00:00", "status_notes": "Vulnerability CVE-2020-24750 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4.", "vulnerability": { "name": "CVE-2020-24750" }, "action_statement": "Vulnerability CVE-2020-24750 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-20T16:48:00.068690+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-05T09:23:00.090239+00:00", "status_notes": "Vulnerability CVE-2020-35491 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4.", "vulnerability": { "name": "CVE-2020-35491" }, "action_statement": "Vulnerability CVE-2020-35491 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2020-35728 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" }, "action_statement": "Vulnerability CVE-2020-35728 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-05T09:23:00.090239+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-05T09:23:00.090239+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2020-36183 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" }, "action_statement": "Vulnerability CVE-2020-36183 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-05T09:23:00.090239+00:00", "status_notes": "Vulnerability CVE-2020-36184 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36184" }, "action_statement": "Vulnerability CVE-2020-36184 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-05T09:23:00.090239+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2020-36187 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" }, "action_statement": "Vulnerability CVE-2020-36187 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-05T09:23:00.090239+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-05T09:23:00.090239+00:00", "status_notes": "Vulnerability CVE-2020-36189 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36189" }, "action_statement": "Vulnerability CVE-2020-36189 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-20T16:47:00.088739+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-05T09:23:00.090239+00:00", "status_notes": "Vulnerability CVE-2020-8840 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4.", "vulnerability": { "name": "CVE-2020-8840" }, "action_statement": "Vulnerability CVE-2020-8840 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-29T01:39:12.873936+00:00", "status_notes": "Vulnerability CVE-2020-9546 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9546" }, "action_statement": "Vulnerability CVE-2020-9546 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-09T13:19:56.319269+00:00", "status_notes": "Vulnerability CVE-2020-9547 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5.", "vulnerability": { "name": "CVE-2020-9547" }, "action_statement": "Vulnerability CVE-2020-9547 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2021-20190 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" }, "action_statement": "Vulnerability CVE-2021-20190 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-29T06:23:58.168173+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.2.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-20T16:48:00.068690+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-20T16:47:00.088739+00:00", "status_notes": "Vulnerability CVE-2022-42004 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" }, "action_statement": "Vulnerability CVE-2022-42004 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-28T01:07:55.976356+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-20T16:48:00.068690+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-20T16:48:00.068690+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-29T06:23:58.168173+00:00", "status_notes": "Vulnerability CVE-2026-54512 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.2.", "vulnerability": { "name": "CVE-2026-54512" }, "action_statement": "Vulnerability CVE-2026-54512 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-20T16:48:00.068690+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-20T16:48:00.068690+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-29T06:23:58.168173+00:00", "status_notes": "Vulnerability CVE-2026-54515 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.2.", "vulnerability": { "name": "CVE-2026-54515" }, "action_statement": "Vulnerability CVE-2026-54515 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-09T13:20:20.076692+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.5." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T02:51:56.632543+00:00", "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.10.2 is NOT AFFECTED by CVE-2026-54517. The vulnerability requires the isMerging() mechanism (introduced in databind#5237, August 2025) that routes setterless collection/map properties through an unguarded property-buffering path in property-based creators. Version 2.10.2 lacks this mechanism entirely\u2014confirmed by grep searches showing no isMerging() method, no _propNameMatcher/_props...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54517" }, "impact_statement": "not_affected \u2014 Version 2.10.2 is NOT AFFECTED by CVE-2026-54517. The vulnerability requires the isMerging() mechanism (introduced in databind#5237, August 2025) that routes setterless collection/map properties through an unguarded property-buffering path in property-based creators. Version 2.10.2 lacks this mechanism entirely\u2014confirmed by grep searches showing no isMerging() method, no _propNameMatcher/_props..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T02:18:39.504835+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.10.2 is NOT AFFECTED by CVE-2026-54518. The vulnerability requires @JsonUnwrapped on creator parameters, a feature that does not exist in 2.10.2. The codebase explicitly rejects this combination with error message \"Cannot define Creator property as @JsonUnwrapped: combination not yet supported\" (BeanDeserializerBase.java:836-842). The vulnerable method processUnwrappedCreatorPropertie...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Version 2.10.2 is NOT AFFECTED by CVE-2026-54518. The vulnerability requires @JsonUnwrapped on creator parameters, a feature that does not exist in 2.10.2. The codebase explicitly rejects this combination with error message \"Cannot define Creator property as @JsonUnwrapped: combination not yet supported\" (BeanDeserializerBase.java:836-842). The vulnerable method processUnwrappedCreatorPropertie..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-03T01:53:00.060903+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Jackson 2.10.2 does not support Java Records (introduced in Java 14/16), which are required for CVE-2026-59888 to manifest. The vulnerability specifically affects Record deserialization with @JsonIgnore annotations and PropertyNamingStrategy. Version 2.10.2 (released January 2020, before Records existed) contains no Record-handling code. The affected version range per CVE is >= 2.15.0. This is ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 Jackson 2.10.2 does not support Java Records (introduced in Java 14/16), which are required for CVE-2026-59888 to manifest. The vulnerability specifically affects Record deserialization with @JsonIgnore annotations and PropertyNamingStrategy. Version 2.10.2 (released January 2020, before Records existed) contains no Record-handling code. The affected version range per CVE is >= 2.15.0. This is ..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-20T16:48:00.068690+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-30T13:06:00.106831+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.3.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-30T13:06:00.106831+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.3.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-11-05T09:23:00.090239+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-29T06:23:58.168173+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.2.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-30T13:06:00.106831+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.3.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.2-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-20T16:48:00.068690+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.10.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2-tuxcare.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.10.2-tuxcare.1.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }