{ "@id": "urn:uuid:6aadedb5-f5b0-466f-a9f5-89f7a36c6f9e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 44, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T18:17:00.039316+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:18:44.496921+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.10.3-tuxcare.3 is well beyond the fixed versions. The upstream jackson-databind 2.10.3 release (March 2020) already contains SubTypeValidator with comprehensive blacklist protection including all classes mentioned in issues #1680 and #1737 (the issues for CVE-2017-15095). The fixes were authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream 2.10.3 release that TuxCare onboarded. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.10.3-tuxcare.3 is well beyond the fixed versions. The upstream jackson-databind 2.10.3 release (March 2020) already contains SubTypeValidator with comprehensive blacklist protection including all classes mentioned in issues #1680 and #1737 (the issues for CVE-2017-15095). The fixes were authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream 2.10.3 release that TuxCare onboarded. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:49:18.906233+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.10.3-tuxcare.3 contains the complete fix for CVE-2017-17485. The vulnerability required blacklisting Spring framework classes (AbstractPointcutAdvisor, AbstractApplicationContext) and other gadget classes to prevent polymorphic deserialization exploits. SubTypeValidator in HEAD (lines 46-196) includes all required blacklist entries from databind#1737 and #1855, plus sophisticated Spring prefix checking. The fixes were authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream 2.10.3 release that TuxCare onboarded in commit 18e2fcedb1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "Target jackson-databind 2.10.3-tuxcare.3 contains the complete fix for CVE-2017-17485. The vulnerability required blacklisting Spring framework classes (AbstractPointcutAdvisor, AbstractApplicationContext) and other gadget classes to prevent polymorphic deserialization exploits. SubTypeValidator in HEAD (lines 46-196) includes all required blacklist entries from databind#1737 and #1855, plus sophisticated Spring prefix checking. The fixes were authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream 2.10.3 release that TuxCare onboarded in commit 18e2fcedb1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:38:50.686696+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 deserialization vulnerability is NOT present in jackson-databind 2.10.3-tuxcare.3. The target version includes comprehensive protection via SubTypeValidator that blocks deserialization of dangerous classes including TemplatesImpl and other gadget classes. This fix was shipped in the upstream Jackson 2.10.3 release (March 2020), well after the vulnerability was patched in 2017 (versions 2.6.7.1, 2.7.9.1, 2.8.9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 deserialization vulnerability is NOT present in jackson-databind 2.10.3-tuxcare.3. The target version includes comprehensive protection via SubTypeValidator that blocks deserialization of dangerous classes including TemplatesImpl and other gadget classes. This fix was shipped in the upstream Jackson 2.10.3 release (March 2020), well after the vulnerability was patched in 2017 (versions 2.6.7.1, 2.7.9.1, 2.8.9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:25:51.798724+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.10.3 is not affected by CVE-2018-11307. The vulnerability (missing org.apache.ibatis.parsing.XPathParser blacklist entry) is not present because the upstream vendor's fix (commit 27b4defc by Tatu Saloranta) was already included in the upstream 2.10.3 release that TuxCare onboarded. The fix adds XPathParser to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing deserialization attacks using this iBatis gadget class. The CVE affected versions 2.0.0-2.9.5 and was fixed in 2.7.9.4, 2.8.11.2, and 2.9.6; version 2.10.3 naturally includes all these fixes from the upstream release lineage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "Target version 2.10.3 is not affected by CVE-2018-11307. The vulnerability (missing org.apache.ibatis.parsing.XPathParser blacklist entry) is not present because the upstream vendor's fix (commit 27b4defc by Tatu Saloranta) was already included in the upstream 2.10.3 release that TuxCare onboarded. The fix adds XPathParser to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing deserialization attacks using this iBatis gadget class. The CVE affected versions 2.0.0-2.9.5 and was fixed in 2.7.9.4, 2.8.11.2, and 2.9.6; version 2.10.3 naturally includes all these fixes from the upstream release lineage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Version 2.10.3 is not affected by CVE-2018-12022. The vulnerable pattern (missing blacklist entries for Jodd-db and Oracle JDBC gadget classes that enable polymorphic deserialization attacks via JNDI/LDAP) is not present in the target. The upstream vendor (Tatu Saloranta) added the necessary blacklist entries in commit 28badf7ef60 (June 2018) to SubTypeValidator.java, blocking deserialization of jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet. This fix was included in upstream releases 2.7.9.4, 2.8.11.2, and 2.9.6, and was inherited by the 2.10.0 release (September 2019) before TuxCare onboarded version 2.10.3. The blacklist is actively enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "Version 2.10.3 is not affected by CVE-2018-12022. The vulnerable pattern (missing blacklist entries for Jodd-db and Oracle JDBC gadget classes that enable polymorphic deserialization attacks via JNDI/LDAP) is not present in the target. The upstream vendor (Tatu Saloranta) added the necessary blacklist entries in commit 28badf7ef60 (June 2018) to SubTypeValidator.java, blocking deserialization of jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet. This fix was included in upstream releases 2.7.9.4, 2.8.11.2, and 2.9.6, and was inherited by the 2.10.0 release (September 2019) before TuxCare onboarded version 2.10.3. The blacklist is actively enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:28:12.870489+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is not present in jackson-databind 2.10.3-tuxcare.3. The vulnerability involves polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that can trigger JNDI/LDAP lookups leading to remote code execution. The upstream fix (commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a) adds these classes to SubTypeValidator's denylist, preventing their deserialization. This fix was already present in the upstream jackson-databind 2.10.3 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of both the upstream jackson-databind-2.10.3 tag and the TuxCare onboarding commit (18e2fcedb1).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is not present in jackson-databind 2.10.3-tuxcare.3. The vulnerability involves polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that can trigger JNDI/LDAP lookups leading to remote code execution. The upstream fix (commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a) adds these classes to SubTypeValidator's denylist, preventing their deserialization. This fix was already present in the upstream jackson-databind 2.10.3 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of both the upstream jackson-databind-2.10.3 tag and the TuxCare onboarding commit (18e2fcedb1).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:05:55.116892+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.10.3-tuxcare.3 is NOT vulnerable to CVE-2018-14718. The fix that blocks slf4j-ext's EventData class from polymorphic deserialization was already present in the upstream jackson-databind 2.10.3 release before TuxCare onboarded it. The blocklist containing org.slf4j.ext.EventData is actively enforced in SubTypeValidator.java lines 71-75, which is called during polymorphic deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "Target jackson-databind version 2.10.3-tuxcare.3 is NOT vulnerable to CVE-2018-14718. The fix that blocks slf4j-ext's EventData class from polymorphic deserialization was already present in the upstream jackson-databind 2.10.3 release before TuxCare onboarded it. The blocklist containing org.slf4j.ext.EventData is actively enforced in SubTypeValidator.java lines 71-75, which is called during polymorphic deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:06:01.860590+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is NOT present in jackson-databind 2.10.3-tuxcare.3. The vulnerability concerns polymorphic deserialization of dangerous BlazeDS classes (flex.messaging.*) and other gadget classes that could enable arbitrary code execution. The upstream fix (commit 87d29af25e by Tatu Saloranta) added these classes to a blacklist in SubTypeValidator.java, and this fix was already included in the upstream jackson-databind 2.10.3 release that TuxCare onboarded. The target version (2.10.3) is newer than all affected versions mentioned in the CVE (before 2.9.7, 2.8.11.3, and 2.7.9.5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 is NOT present in jackson-databind 2.10.3-tuxcare.3. The vulnerability concerns polymorphic deserialization of dangerous BlazeDS classes (flex.messaging.*) and other gadget classes that could enable arbitrary code execution. The upstream fix (commit 87d29af25e by Tatu Saloranta) added these classes to a blacklist in SubTypeValidator.java, and this fix was already included in the upstream jackson-databind 2.10.3 release that TuxCare onboarded. The target version (2.10.3) is newer than all affected versions mentioned in the CVE (before 2.9.7, 2.8.11.3, and 2.7.9.5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:12:02.519749+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not present in jackson-databind 2.10.3-tuxcare.3. The vulnerability concerns polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could lead to XXE attacks or other security compromises. The upstream vendor (FasterXML) applied fix commit 87d29af25e in jackson-databind 2.6.7.2, which added these four classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in the upstream 2.10.3 release that TuxCare onboarded, and is actively enforced via SubTypeValidator.validateSubType() during bean deserialization. The target is not affected because the vulnerable code pattern (unrestricted deserialization of these classes) was removed by the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 is not present in jackson-databind 2.10.3-tuxcare.3. The vulnerability concerns polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could lead to XXE attacks or other security compromises. The upstream vendor (FasterXML) applied fix commit 87d29af25e in jackson-databind 2.6.7.2, which added these four classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in the upstream 2.10.3 release that TuxCare onboarded, and is actively enforced via SubTypeValidator.validateSubType() during bean deserialization. The target is not affected because the vulnerable code pattern (unrestricted deserialization of these classes) was removed by the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:41:24.721852+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is not present in jackson-databind 2.10.3. The vulnerability concerns polymorphic deserialization of the axis2-jaxws HandlerResolverImpl class that could enable SSRF attacks. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by Tatu Saloranta) added this class to the deserialization blacklist and was already included in upstream release 2.10.3 before TuxCare onboarded it. The target repository contains the fix at SubTypeValidator.java:75 where \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" is explicitly blocked from deserialization. The validation logic throws an \"Illegal type to deserialize: prevented for security reasons\" error if an attempt is made to deserialize this class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 is not present in jackson-databind 2.10.3. The vulnerability concerns polymorphic deserialization of the axis2-jaxws HandlerResolverImpl class that could enable SSRF attacks. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by Tatu Saloranta) added this class to the deserialization blacklist and was already included in upstream release 2.10.3 before TuxCare onboarded it. The target repository contains the fix at SubTypeValidator.java:75 where \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" is explicitly blocked from deserialization. The validation logic throws an \"Illegal type to deserialize: prevented for security reasons\" error if an attempt is made to deserialize this class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:01:12.948527+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.10.3 is NOT affected by CVE-2018-19360. The vulnerability involves failure to block the axis2-transport-jms class from polymorphic deserialization, which could allow arbitrary code execution. The fix (adding org.apache.axis2.transport.jms.JMSOutTransportInfo to the deserialization blacklist) was shipped in the upstream 2.10.3 release and is present in the target at SubTypeValidator.java:81. This is an upstream fix by Tatu Saloranta, not a TuxCare backport. The vulnerable pattern is not present because the defense was already included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "Target version 2.10.3 is NOT affected by CVE-2018-19360. The vulnerability involves failure to block the axis2-transport-jms class from polymorphic deserialization, which could allow arbitrary code execution. The fix (adding org.apache.axis2.transport.jms.JMSOutTransportInfo to the deserialization blacklist) was shipped in the upstream 2.10.3 release and is present in the target at SubTypeValidator.java:81. This is an upstream fix by Tatu Saloranta, not a TuxCare backport. The vulnerable pattern is not present because the defense was already included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T17:05:23.635575+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 does not affect jackson-databind 2.10.3. The vulnerability requires the ability to deserialize openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) via polymorphic deserialization. These classes are already blocked in SubTypeValidator.java (lines 79-80) as part of the DEFAULT_NO_DESER_CLASS_NAMES blocklist. The fix was authored by upstream maintainer Tatu Saloranta in commit 72cd4025a2 and was already present in the upstream 2.10.3 release that TuxCare onboarded. The CVE affects versions before 2.9.8, and this target is 2.10.3, well after the fixed version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 does not affect jackson-databind 2.10.3. The vulnerability requires the ability to deserialize openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) via polymorphic deserialization. These classes are already blocked in SubTypeValidator.java (lines 79-80) as part of the DEFAULT_NO_DESER_CLASS_NAMES blocklist. The fix was authored by upstream maintainer Tatu Saloranta in commit 72cd4025a2 and was already present in the upstream 2.10.3 release that TuxCare onboarded. The CVE affects versions before 2.9.8, and this target is 2.10.3, well after the fixed version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:30:13.587550+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.10.3-tuxcare.3. The vulnerability concerns polymorphic deserialization of the dangerous class org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core. The fix (adding this class and 3 others to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was already present in the upstream release 2.10.3 when TuxCare onboarded it. The CVE affects versions \"2.x before 2.9.8\" and the target version 2.10.3 is after the fix threshold. The upstream fix commit 72cd4025a2 by tatu.saloranta@iki.fi (committed 2018-11-19) is an ancestor of the first TuxCare commit 18e2fcedb1 (Onboard version 2.10.3), confirming the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.10.3-tuxcare.3. The vulnerability concerns polymorphic deserialization of the dangerous class org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core. The fix (adding this class and 3 others to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was already present in the upstream release 2.10.3 when TuxCare onboarded it. The CVE affects versions \"2.x before 2.9.8\" and the target version 2.10.3 is after the fix threshold. The upstream fix commit 72cd4025a2 by tatu.saloranta@iki.fi (committed 2018-11-19) is an ancestor of the first TuxCare commit 18e2fcedb1 (Onboard version 2.10.3), confirming the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The target version 2.10.3 is NOT AFFECTED because the upstream fix (commit 038b471e2ef by Tatu Saloranta, dated 2018-01-21) was already present in the upstream 2.10.3 release (2020-03-02). Both gadget classes are in the blacklist at SubTypeValidator.java:59-60, blocking their deserialization. The vulnerable code pattern was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The target version 2.10.3 is NOT AFFECTED because the upstream fix (commit 038b471e2ef by Tatu Saloranta, dated 2018-01-21) was already present in the upstream 2.10.3 release (2020-03-02). Both gadget classes are in the blacklist at SubTypeValidator.java:59-60, blocking their deserialization. The vulnerable code pattern was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:04:28.993792+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.10.3-tuxcare.3 is not affected by CVE-2018-7489. The vulnerability allows remote code execution via polymorphic deserialization when c3p0 libraries are in the classpath. The upstream fix (commit 6799f8f by Tatu Saloranta) was already present in jackson-databind 2.10.3 when TuxCare onboarded it. SubTypeValidator.java lines 181-190 contain pattern-based blocking that rejects any class matching com.mchange.v2.c3p0.*DataSource during type validation. CVE-2018-7489 affects versions before 2.6.7.5, 2.7.9.3, 2.8.11.1, and 2.9.5; target version 2.10.3 is well beyond these ranges.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "Target version 2.10.3-tuxcare.3 is not affected by CVE-2018-7489. The vulnerability allows remote code execution via polymorphic deserialization when c3p0 libraries are in the classpath. The upstream fix (commit 6799f8f by Tatu Saloranta) was already present in jackson-databind 2.10.3 when TuxCare onboarded it. SubTypeValidator.java lines 181-190 contain pattern-based blocking that rejects any class matching com.mchange.v2.c3p0.*DataSource during type validation. CVE-2018-7489 affects versions before 2.6.7.5, 2.7.9.3, 2.8.11.1, and 2.9.5; target version 2.10.3 is well beyond these ranges.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:38:23.121558+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is not present in jackson-databind 2.10.3. The vulnerability required the ability to deserialize com.mysql.cj.jdbc.admin.MiniAdmin via polymorphic typing to achieve arbitrary file read. The upstream vendor (FasterXML) added MiniAdmin to the deserialization blocklist in version 2.9.9 (commit dda513bd72, May 2019). Since the target version 2.10.3 is newer than 2.9.9, it inherits this fix from the upstream release. The blocklist entry is present at SubTypeValidator.java:84 and is actively enforced during deserialization via BeanDeserializerFactory._validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 is not present in jackson-databind 2.10.3. The vulnerability required the ability to deserialize com.mysql.cj.jdbc.admin.MiniAdmin via polymorphic typing to achieve arbitrary file read. The upstream vendor (FasterXML) added MiniAdmin to the deserialization blocklist in version 2.9.9 (commit dda513bd72, May 2019). Since the target version 2.10.3 is newer than 2.9.9, it inherits this fix from the upstream release. The blocklist entry is present at SubTypeValidator.java:84 and is actively enforced during deserialization via BeanDeserializerFactory._validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-01T18:54:52.560482+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target repository jackson-databind version 2.10.3-tuxcare.3 is NOT affected by CVE-2019-12384. The vulnerability involves polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to remote code execution. The upstream fix (commit c9ef4a10d6f6633cf470d6a469514b68fa2be234) that blocks this class in SubTypeValidator was already pr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 Target repository jackson-databind version 2.10.3-tuxcare.3 is NOT affected by CVE-2019-12384. The vulnerability involves polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to remote code execution. The upstream fix (commit c9ef4a10d6f6633cf470d6a469514b68fa2be234) that blocks this class in SubTypeValidator was already pr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-02T07:36:00.279006+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 and involves polymorphic deserialization of JDOM XSLTransformer classes that can be exploited for arbitrary file read. The target version 2.10.3-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 5f7c69bba0 by Tatu Saloranta on June 13, 2019) was already present in jackson-databind 2.10.3 when TuxCare onboarded it. The fix adds o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 and involves polymorphic deserialization of JDOM XSLTransformer classes that can be exploited for arbitrary file read. The target version 2.10.3-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 5f7c69bba0 by Tatu Saloranta on June 13, 2019) was already present in jackson-databind 2.10.3 when TuxCare onboarded it. The fix adds o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T12:21:26.071673+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.3 is NOT affected by CVE-2019-14379. The fix blocking deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup was already present in the upstream 2.10.3 release (commit ad418eeb97 by Tatu Saloranta) before TuxCare onboarded it. The dangerous class is in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 94 of SubTypeValidator.java, and the validateSubType method enforces this blocklist, preventing the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "The target jackson-databind 2.10.3 is NOT affected by CVE-2019-14379. The fix blocking deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup was already present in the upstream 2.10.3 release (commit ad418eeb97 by Tatu Saloranta) before TuxCare onboarded it. The dangerous class is in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 94 of SubTypeValidator.java, and the validateSubType method enforces this blocklist, preventing the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:51:14.737145+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 due to missing blocklist entries for dangerous classes (ch.qos.logback.core.db.JNDIConnectionSource). The target version 2.10.3 already contains the upstream fix that was committed on July 25, 2019 by Tatu Saloranta and shipped in the upstream 2.10.3 release. The fix adds the dangerous logback class to the SubTypeValidator blocklist, preventing polymorphic deserialization attacks. This fix was already present when TuxCare onboarded version 2.10.3 on commit 18e2fcedb1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 due to missing blocklist entries for dangerous classes (ch.qos.logback.core.db.JNDIConnectionSource). The target version 2.10.3 already contains the upstream fix that was committed on July 25, 2019 by Tatu Saloranta and shipped in the upstream 2.10.3 release. The fix adds the dangerous logback class to the SubTypeValidator blocklist, preventing polymorphic deserialization attacks. This fix was already present when TuxCare onboarded version 2.10.3 on commit 18e2fcedb1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:54:24.400671+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is not present in jackson-databind 2.10.3-tuxcare.3. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource, which could enable remote code execution. The fix (adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist) was implemented by upstream maintainer Tatu Saloranta in commit d4983c740f (August 2019) and shipped in upstream release 2.10.0. The target version 2.10.3 inherited this fix from upstream when TuxCare onboarded it in September 2026. Lines 100-103 of SubTypeValidator.java confirm both blocklist entries are present and active.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 is not present in jackson-databind 2.10.3-tuxcare.3. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource, which could enable remote code execution. The fix (adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist) was implemented by upstream maintainer Tatu Saloranta in commit d4983c740f (August 2019) and shipped in upstream release 2.10.0. The target version 2.10.3 inherited this fix from upstream when TuxCare onboarded it in September 2026. Lines 100-103 of SubTypeValidator.java confirm both blocklist entries are present and active.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:02:25.196465+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.10.3-tuxcare.3. The vulnerability allowed polymorphic deserialization of malicious commons-configuration JNDI classes leading to arbitrary code execution. The upstream vendor (FasterXML) fixed this by adding two class names (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) to the SubTypeValidator blocklist in commit 41b7f9b901. This fix was already included in the upstream jackson-databind 2.10.3 release that TuxCare onboarded, so the vulnerable pattern is not present in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.10.3-tuxcare.3. The vulnerability allowed polymorphic deserialization of malicious commons-configuration JNDI classes leading to arbitrary code execution. The upstream vendor (FasterXML) fixed this by adding two class names (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) to the SubTypeValidator blocklist in commit 41b7f9b901. This fix was already included in the upstream jackson-databind 2.10.3 release that TuxCare onboarded, so the vulnerable pattern is not present in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.10.3 is NOT affected by CVE-2019-14893. The vulnerability (polymorphic deserialization of org.apache.xalan.lib.sql.JNDIConnectionPool JNDI gadget) requires the absence of a blocklist entry. The fix commit 998efd7082 adding this blocklist entry was authored by upstream Jackson maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in upstream release 2.10.3 before TuxCare onboarded the version. The defense is present at SubTypeValidator.java:113, preventing instantiation of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "The target jackson-databind version 2.10.3 is NOT affected by CVE-2019-14893. The vulnerability (polymorphic deserialization of org.apache.xalan.lib.sql.JNDIConnectionPool JNDI gadget) requires the absence of a blocklist entry. The fix commit 998efd7082 adding this blocklist entry was authored by upstream Jackson maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in upstream release 2.10.3 before TuxCare onboarded the version. The defense is present at SubTypeValidator.java:113, preventing instantiation of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T17:10:09.687234+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.3-tuxcare.3 is NOT affected by CVE-2019-16335. The vulnerability pattern (missing blacklist entry for com.zaxxer.hikari.HikariDataSource in SubTypeValidator) is not present because the fix was already included in the upstream jackson-databind 2.10.3 release (commit 73c1c2cc76, authored by Tatu Saloranta on 2019-09-12). The CVE affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3; version 2.10.3 is well beyond the fixed threshold. TuxCare onboarded the already-patched upstream release on 2020-03-02 or later, inheriting the fix without requiring a separate backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "The target jackson-databind 2.10.3-tuxcare.3 is NOT affected by CVE-2019-16335. The vulnerability pattern (missing blacklist entry for com.zaxxer.hikari.HikariDataSource in SubTypeValidator) is not present because the fix was already included in the upstream jackson-databind 2.10.3 release (commit 73c1c2cc76, authored by Tatu Saloranta on 2019-09-12). The CVE affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3; version 2.10.3 is well beyond the fixed threshold. TuxCare onboarded the already-patched upstream release on 2020-03-02 or later, inheriting the fix without requiring a separate backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:14:13.800446+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.3-tuxcare.3 is not affected by CVE-2019-16942. The vulnerability fix was already present in the upstream jackson-databind 2.10.3 release before TuxCare onboarded it. All three dangerous classes identified in the CVE (org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource) are blocked in the SubTypeValidator deny-list at lines 116-118, preventing their deserialization when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "The target jackson-databind 2.10.3-tuxcare.3 is not affected by CVE-2019-16942. The vulnerability fix was already present in the upstream jackson-databind 2.10.3 release before TuxCare onboarded it. All three dangerous classes identified in the CVE (org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource) are blocked in the SubTypeValidator deny-list at lines 116-118, preventing their deserialization when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T17:21:51.506888+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 concerns jackson-databind's polymorphic deserialization vulnerability allowing instantiation of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes) when Default Typing is enabled. The vendor fix added these classes to a blocklist in SubTypeValidator.java. The target version (2.10.3-tuxcare.3) already contains this fix because it shipped in the upstream jackson-databind 2.10.3 release. The fix commit (9593e16cf5) was authored by Tatu Saloranta (upstream maintainer, tatu.saloranta@iki.fi) and was included in the 2.10.3 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 concerns jackson-databind's polymorphic deserialization vulnerability allowing instantiation of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes) when Default Typing is enabled. The vendor fix added these classes to a blocklist in SubTypeValidator.java. The target version (2.10.3-tuxcare.3) already contains this fix because it shipped in the upstream jackson-databind 2.10.3 release. The fix commit (9593e16cf5) was authored by Tatu Saloranta (upstream maintainer, tatu.saloranta@iki.fi) and was included in the 2.10.3 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:30:53.892571+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is NOT present in jackson-databind 2.10.3-tuxcare.3. The vulnerability involved the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup being exploitable via polymorphic deserialization. The upstream fix (commit 191a4cdf87) added this class to the SubTypeValidator blacklist, preventing its instantiation during JSON deserialization. This fix was already present in the upstream 2.10.3 release that TuxCare onboarded, as evidenced by the fix commit (191a4cdf87) being 1311 commits before the first TuxCare commit (18e2fcedb1 \"Onboard version 2.10.3\"). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not by TuxCare/CloudLinux.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 is NOT present in jackson-databind 2.10.3-tuxcare.3. The vulnerability involved the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup being exploitable via polymorphic deserialization. The upstream fix (commit 191a4cdf87) added this class to the SubTypeValidator blacklist, preventing its instantiation during JSON deserialization. This fix was already present in the upstream 2.10.3 release that TuxCare onboarded, as evidenced by the fix commit (191a4cdf87) being 1311 commits before the first TuxCare commit (18e2fcedb1 \"Onboard version 2.10.3\"). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not by TuxCare/CloudLinux.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:52:04.486756+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.10.3-tuxcare.3) is NOT AFFECTED by CVE-2019-17531. The fix for this vulnerability (blocking deserialization of org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource) was already present in the upstream jackson-databind 2.10.3 release that TuxCare onboarded. The vulnerable code pattern never existed in the TuxCare-maintained version. Fix commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by upstream maintainer Tatu Saloranta was included in the upstream release before TuxCare's first commit (18e2fcedb11b8f24af04288ef4580cac41844024).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "The target repository (jackson-databind 2.10.3-tuxcare.3) is NOT AFFECTED by CVE-2019-17531. The fix for this vulnerability (blocking deserialization of org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource) was already present in the upstream jackson-databind 2.10.3 release that TuxCare onboarded. The vulnerable code pattern never existed in the TuxCare-maintained version. Fix commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by upstream maintainer Tatu Saloranta was included in the upstream release before TuxCare's first commit (18e2fcedb11b8f24af04288ef4580cac41844024).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is not present in jackson-databind 2.10.3-tuxcare.3. The fix that adds net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector to the deserialization blocklist was already included in the upstream 2.10.3 release. The vulnerable pattern does not exist in this version because the upstream vendor (FasterXML) shipped the fix before TuxCare onboarded the 2.10.3 codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 is not present in jackson-databind 2.10.3-tuxcare.3. The fix that adds net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector to the deserialization blocklist was already included in the upstream 2.10.3 release. The vulnerable pattern does not exist in this version because the upstream vendor (FasterXML) shipped the fix before TuxCare onboarded the 2.10.3 codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-10T11:10:00.036907+00:00", "status_notes": "Vulnerability CVE-2020-10650 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-10650" }, "action_statement": "Vulnerability CVE-2020-10650 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-10T11:10:00.036907+00:00", "status_notes": "Vulnerability CVE-2020-10672 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-10672" }, "action_statement": "Vulnerability CVE-2020-10672 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-10T11:10:00.036907+00:00", "status_notes": "Vulnerability CVE-2020-10673 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-10673" }, "action_statement": "Vulnerability CVE-2020-10673 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-10T11:10:00.036907+00:00", "status_notes": "Vulnerability CVE-2020-10969 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-10969" }, "action_statement": "Vulnerability CVE-2020-10969 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-09T13:25:00.209872+00:00", "status_notes": "Vulnerability CVE-2020-11111 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11111" }, "action_statement": "Vulnerability CVE-2020-11111 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-10T11:10:00.036907+00:00", "status_notes": "Vulnerability CVE-2020-11112 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11112" }, "action_statement": "Vulnerability CVE-2020-11112 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-09T13:25:49.956211+00:00", "status_notes": "Vulnerability CVE-2020-11113 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11113" }, "action_statement": "Vulnerability CVE-2020-11113 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-09T13:24:51.468170+00:00", "status_notes": "Vulnerability CVE-2020-11619 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11619" }, "action_statement": "Vulnerability CVE-2020-11619 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-10T11:10:00.036907+00:00", "status_notes": "Vulnerability CVE-2020-14060 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-14060" }, "action_statement": "Vulnerability CVE-2020-14060 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.6." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. jackson-databind 2.10.3-tuxcare.3 is NOT AFFECTED by CVE-2020-14061. While the SubTypeValidator lacks the oracle.jms.AQjms* blocklist entries that the upstream patch adds, this vulnerability is only exploitable when polymorphic deserialization is explicitly enabled. jackson-databind is a library with polymorphic typing (default typing) DISABLED by default. Without polymorphic typing enabled, attacker-controlled JSON cannot specify arbitrary classes for instantiation - the application code determines types, not the JSON payload. Per the Mandatory Reachability Audit (MRA) rules for LIB targets: the vulnerable code path is not reachable from the library's production surface in its default configuration. Exploitation requires downstream applications to explicitly call activateDefaultTyping() or use @JsonTypeInfo annotations. The attack chain from INPUT (JSON with polymorphic type info) to GOAL (arbitrary code execution) is broken in the default state.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "jackson-databind 2.10.3-tuxcare.3 is NOT AFFECTED by CVE-2020-14061. While the SubTypeValidator lacks the oracle.jms.AQjms* blocklist entries that the upstream patch adds, this vulnerability is only exploitable when polymorphic deserialization is explicitly enabled. jackson-databind is a library with polymorphic typing (default typing) DISABLED by default. Without polymorphic typing enabled, attacker-controlled JSON cannot specify arbitrary classes for instantiation - the application code determines types, not the JSON payload. Per the Mandatory Reachability Audit (MRA) rules for LIB targets: the vulnerable code path is not reachable from the library's production surface in its default configuration. Exploitation requires downstream applications to explicitly call activateDefaultTyping() or use @JsonTypeInfo annotations. The attack chain from INPUT (JSON with polymorphic type info) to GOAL (arbitrary code execution) is broken in the default state.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-09T13:25:15.567976+00:00", "status_notes": "Vulnerability CVE-2020-14062 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-14062" }, "action_statement": "Vulnerability CVE-2020-14062 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-09T13:24:51.468170+00:00", "status_notes": "Vulnerability CVE-2020-14195 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-14195" }, "action_statement": "Vulnerability CVE-2020-14195 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:26:00.083425+00:00", "status_notes": "Vulnerability CVE-2020-24616 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4.", "vulnerability": { "name": "CVE-2020-24616" }, "action_statement": "Vulnerability CVE-2020-24616 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:26:00.083425+00:00", "status_notes": "Vulnerability CVE-2020-24750 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4.", "vulnerability": { "name": "CVE-2020-24750" }, "action_statement": "Vulnerability CVE-2020-24750 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:26:00.083425+00:00", "status_notes": "Vulnerability CVE-2020-35491 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4.", "vulnerability": { "name": "CVE-2020-35491" }, "action_statement": "Vulnerability CVE-2020-35491 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2020-35728 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" }, "action_statement": "Vulnerability CVE-2020-35728 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:26:00.083425+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:26:00.083425+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2020-36183 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" }, "action_statement": "Vulnerability CVE-2020-36183 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:26:00.083425+00:00", "status_notes": "Vulnerability CVE-2020-36184 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36184" }, "action_statement": "Vulnerability CVE-2020-36184 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:26:00.083425+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2020-36187 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" }, "action_statement": "Vulnerability CVE-2020-36187 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:26:00.083425+00:00", "status_notes": "Vulnerability CVE-2020-36189 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36189" }, "action_statement": "Vulnerability CVE-2020-36189 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:16:13.062310+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.3-tuxcare.3 is not affected by CVE-2020-8840. The vulnerability requires the ability to deserialize org.apache.xbean.propertyeditor.JndiConverter to trigger JNDI injection. The upstream jackson-databind 2.10.3 release (which TuxCare onboarded) already contains the fix: JndiConverter is blocked in SubTypeValidator.java line 129. The CVE affects versions before 2.6.7.4, 2.7.9.7, 2.8.11.5, and 2.9.10.2; version 2.10.3 is after the fixed versions and shipped with the protection. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 914e7c9f and was present in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "The target jackson-databind 2.10.3-tuxcare.3 is not affected by CVE-2020-8840. The vulnerability requires the ability to deserialize org.apache.xbean.propertyeditor.JndiConverter to trigger JNDI injection. The upstream jackson-databind 2.10.3 release (which TuxCare onboarded) already contains the fix: JndiConverter is blocked in SubTypeValidator.java line 129. The CVE affects versions before 2.6.7.4, 2.7.9.7, 2.8.11.5, and 2.9.10.2; version 2.10.3 is after the fixed versions and shipped with the protection. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 914e7c9f and was present in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig). The target version 2.10.3 already contains the upstream fix (commit 9f4e97019f) that blocks this gadget class in SubTypeValidator.java. This fix was present in the upstream release 2.10.3 when TuxCare onboarded it, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig). The target version 2.10.3 already contains the upstream fix (commit 9f4e97019f) that blocks this gadget class in SubTypeValidator.java. This fix was present in the upstream release 2.10.3 when TuxCare onboarded it, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:47:06.064229+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is not present in jackson-databind 2.10.3-tuxcare.3. The vulnerability affects jackson-databind versions that allow deserialization of the dangerous gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`, which can lead to arbitrary code execution. The target repository already contains the upstream fix: the gadget class is present in the deserialization blocklist at SubTypeValidator.java lines 134-136. The fix was authored by upstream developer Tatu Saloranta (commit 9f4e97019f) and was already included in the upstream 2.10.3 release that TuxCare onboarded, as confirmed by ancestry analysis showing the fix commit predates the TuxCare onboarding commit 18e2fcedb1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 is not present in jackson-databind 2.10.3-tuxcare.3. The vulnerability affects jackson-databind versions that allow deserialization of the dangerous gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`, which can lead to arbitrary code execution. The target repository already contains the upstream fix: the gadget class is present in the deserialization blocklist at SubTypeValidator.java lines 134-136. The fix was authored by upstream developer Tatu Saloranta (commit 9f4e97019f) and was already included in the upstream 2.10.3 release that TuxCare onboarded, as confirmed by ancestry analysis showing the fix commit predates the TuxCare onboarding commit 18e2fcedb1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:21:06.039557+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is not present in jackson-databind 2.10.3-tuxcare.3. The fix, which adds \"br.com.anteros.dbcp.AnterosDBCPConfig\" to the deserialization blocklist in SubTypeValidator.java, was already included in the upstream 2.10.3 release. The blocklist entry is present at line 136, preventing deserialization of this gadget class and blocking the attack chain from malicious polymorphic type specification to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 is not present in jackson-databind 2.10.3-tuxcare.3. The fix, which adds \"br.com.anteros.dbcp.AnterosDBCPConfig\" to the deserialization blocklist in SubTypeValidator.java, was already included in the upstream 2.10.3 release. The blocklist entry is present at line 136, preventing deserialization of this gadget class and blocking the attack chain from malicious polymorphic type specification to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2021-20190 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" }, "action_statement": "Vulnerability CVE-2021-20190 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2021-46877 is fixed in version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2022-42004 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" }, "action_statement": "Vulnerability CVE-2022-42004 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-10T18:17:00.039316+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.7.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T02:17:22.923716+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.10.3 is not affected by CVE-2026-54518 because the vulnerable feature (@JsonUnwrapped on @JsonCreator parameters) does not exist in this version. The feature was introduced in #1467 and first released in version 2.19.0, well after 2.10.3. The code explicitly documents that unwrapped values passed via CreatorProperty are \"not supported\" (BeanDeserializer.java lines 739-741). The CVE-sp...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Version 2.10.3 is not affected by CVE-2026-54518 because the vulnerable feature (@JsonUnwrapped on @JsonCreator parameters) does not exist in this version. The feature was introduced in #1467 and first released in version 2.19.0, well after 2.10.3. The code explicitly documents that unwrapped values passed via CreatorProperty are \"not supported\" (BeanDeserializer.java lines 739-741). The CVE-sp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-03T01:50:00.213840+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-59888 affects Jackson's Java Record deserialization when @JsonIgnore annotations are combined with PropertyNamingStrategy. The vulnerability exists in POJOPropertiesCollector._renameUsing() which fails to propagate ignored property names through the rename operation for Records. However, jackson-databind 2.10.3-tuxcare.3 does NOT support Java Records. Record support was introduced in j...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 CVE-2026-59888 affects Jackson's Java Record deserialization when @JsonIgnore annotations are combined with PropertyNamingStrategy. The vulnerability exists in POJOPropertiesCollector._renameUsing() which fails to propagate ignored property names through the rename operation for Records. However, jackson-databind 2.10.3-tuxcare.3 does NOT support Java Records. Record support was introduced in j..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-30T13:08:00.090368+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.3.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-30T13:08:00.090368+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.3.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:26:00.083425+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-30T13:08:00.090368+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.3.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.3-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T06:32:14.253219+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.10.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3-tuxcare.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.10.3-tuxcare.2.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }