{ "@id": "urn:uuid:c880510c-b22b-436b-a647-6962ad897c1d", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T11:16:20.048404+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability was a deserialization flaw allowing code execution via malicious class instantiation. The upstream fix (issue #1737) added java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and Spring/C3P0 classes to the deserialization blacklist. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit ddfddfba64 (Aug 2017) and shipped in jackson-databind 2.12.4 before TuxCare onboarded the version. The blacklist is enforced via SubTypeValidator.validateSubType() called during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability was a deserialization flaw allowing code execution via malicious class instantiation. The upstream fix (issue #1737) added java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and Spring/C3P0 classes to the deserialization blacklist. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit ddfddfba64 (Aug 2017) and shipped in jackson-databind 2.12.4 before TuxCare onboarded the version. The blacklist is enforced via SubTypeValidator.validateSubType() called during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.4-tuxcare.3 is not affected by CVE-2017-17485. The vulnerability required specific dangerous classes (Spring framework types, c3p0 datasources, tomcat dbcp, JDK types) to be missing from the deserialization blacklist. The target contains SubTypeValidator with all CVE-2017-17485 blacklist entries already applied. The fix (commit 2235894210) was authored by upstream maintainer Tatu Saloranta and shipped in upstream version 2.12.4, which TuxCare later onboarded. The validation mechanism blocks dangerous class deserialization at line 140 of BeanDeserializerFactory before instantiation occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "Target jackson-databind 2.12.4-tuxcare.3 is not affected by CVE-2017-17485. The vulnerability required specific dangerous classes (Spring framework types, c3p0 datasources, tomcat dbcp, JDK types) to be missing from the deserialization blacklist. The target contains SubTypeValidator with all CVE-2017-17485 blacklist entries already applied. The fix (commit 2235894210) was authored by upstream maintainer Tatu Saloranta and shipped in upstream version 2.12.4, which TuxCare later onboarded. The validation mechanism blocks dangerous class deserialization at line 140 of BeanDeserializerFactory before instantiation occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.4 is NOT affected by CVE-2017-7525. The upstream Jackson maintainer (Tatu Saloranta) added SubTypeValidator in commit 2235894210c75 (for issue #1855, @since 2.8.11), which implements a blacklist of dangerous classes that blocks deserialization-based RCE attacks. This fix was already present in the upstream 2.12.4 release before TuxCare onboarded it (first TuxCare commit: 174b7300751e). The SubTypeValidator blacklist contains all CVE-2017-7525 dangerous classes: TemplatesImpl, InvokerTransformer, InstantiateTransformer, ConvertedClosure, MethodClosure, and ObjectFactory. The defense is called in BeanDeserializerFactory.createBeanDeserializer (line 140) on all bean deserialization paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "Target version 2.12.4 is NOT affected by CVE-2017-7525. The upstream Jackson maintainer (Tatu Saloranta) added SubTypeValidator in commit 2235894210c75 (for issue #1855, @since 2.8.11), which implements a blacklist of dangerous classes that blocks deserialization-based RCE attacks. This fix was already present in the upstream 2.12.4 release before TuxCare onboarded it (first TuxCare commit: 174b7300751e). The SubTypeValidator blacklist contains all CVE-2017-7525 dangerous classes: TemplatesImpl, InvokerTransformer, InstantiateTransformer, ConvertedClosure, MethodClosure, and ObjectFactory. The defense is called in BeanDeserializerFactory.createBeanDeserializer (line 140) on all bean deserialization paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.12.4-tuxcare.3. The fix (blacklisting org.apache.ibatis.parsing.XPathParser and related gadget classes in SubTypeValidator) was already included in the upstream jackson-databind 2.12.4 release. The fix commit 27b4defc270454dea6842bd9279f17387eceb737 authored by upstream maintainer Tatu Saloranta is an ancestor of the first TuxCare onboarding commit, confirming it shipped with the base release. CVE-2018-11307 affects versions 2.0.0 through 2.9.5, and was fixed in 2.7.9.4, 2.8.11.2, and 2.9.6. Version 2.12.4 is well beyond the vulnerable range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.12.4-tuxcare.3. The fix (blacklisting org.apache.ibatis.parsing.XPathParser and related gadget classes in SubTypeValidator) was already included in the upstream jackson-databind 2.12.4 release. The fix commit 27b4defc270454dea6842bd9279f17387eceb737 authored by upstream maintainer Tatu Saloranta is an ancestor of the first TuxCare onboarding commit, confirming it shipped with the base release. CVE-2018-11307 affects versions 2.0.0 through 2.9.5, and was fixed in 2.7.9.4, 2.8.11.2, and 2.9.6. Version 2.12.4 is well beyond the vulnerable range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version (2.12.4) already contains the upstream fix that blacklists jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator.java. The fix was shipped in the upstream 2.12.4 release and is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version (2.12.4) already contains the upstream fix that blacklists jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator.java. The fix was shipped in the upstream 2.12.4 release and is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves polymorphic deserialization of Oracle JDBC and Jodd-db classes that can perform JNDI/LDAP lookups, enabling remote code execution when Default Typing is enabled. The upstream fix (commit 28badf7ef6 by Tatu Saloranta, June 2018) added blacklist entries for oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet, and jodd.db.connection.DataSourceConnectionProvider to SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.12.4 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (174b730075 \"Onboard version 2.12.4\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves polymorphic deserialization of Oracle JDBC and Jodd-db classes that can perform JNDI/LDAP lookups, enabling remote code execution when Default Typing is enabled. The upstream fix (commit 28badf7ef6 by Tatu Saloranta, June 2018) added blacklist entries for oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet, and jodd.db.connection.DataSourceConnectionProvider to SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.12.4 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (174b730075 \"Onboard version 2.12.4\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.12.4-tuxcare.3. The target repository contains the upstream fix that blocks org.slf4j.ext.EventData and related dangerous classes from polymorphic deserialization. The fix (commit 87d29af25e) shipped in the upstream jackson-databind 2.12.4 release that TuxCare onboarded, prior to any TuxCare-specific modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.12.4-tuxcare.3. The target repository contains the upstream fix that blocks org.slf4j.ext.EventData and related dangerous classes from polymorphic deserialization. The fix (commit 87d29af25e) shipped in the upstream jackson-databind 2.12.4 release that TuxCare onboarded, prior to any TuxCare-specific modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 due to missing blacklist entries for BlazeDS classes that enable arbitrary code execution via polymorphic deserialization. The target version 2.12.4-tuxcare.3 is NOT vulnerable because the upstream vendor (FasterXML) fixed this in upstream commit 87d29af by adding the dangerous BlazeDS classes to the deserialization blacklist. This fix was already present in upstream release 2.12.4 when TuxCare onboarded it. The fix is located in SubTypeValidator.java lines 74-78, which blocks flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes from polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 due to missing blacklist entries for BlazeDS classes that enable arbitrary code execution via polymorphic deserialization. The target version 2.12.4-tuxcare.3 is NOT vulnerable because the upstream vendor (FasterXML) fixed this in upstream commit 87d29af by adding the dangerous BlazeDS classes to the deserialization blacklist. This fix was already present in upstream release 2.12.4 when TuxCare onboarded it. The fix is located in SubTypeValidator.java lines 74-78, which blocks flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes from polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 affects jackson-databind versions before 2.9.7. The target repository is jackson-databind version 2.12.4, which already contains the upstream fix (commit 87d29af from August 2018) that adds four dangerous classes to the polymorphic deserialization blocklist. The fix was included in the upstream 2.12.4 release (July 2021) before TuxCare onboarded it (October 2026). The vulnerable pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 affects jackson-databind versions before 2.9.7. The target repository is jackson-databind version 2.12.4, which already contains the upstream fix (commit 87d29af from August 2018) that adds four dangerous classes to the polymorphic deserialization blocklist. The fix was included in the upstream 2.12.4 release (July 2021) before TuxCare onboarded it (October 2026). The vulnerable pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 affects jackson-databind 2.x before 2.9.7. The target version is 2.12.4-tuxcare.3, which is after the fixed version. The fix (blocking org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization) was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (missing blacklist entry) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 affects jackson-databind 2.x before 2.9.7. The target version is 2.12.4-tuxcare.3, which is after the fixed version. The fix (blocking org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization) was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (missing blacklist entry) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is NOT present in jackson-databind 2.12.4. The vulnerability concerns the failure to block \"org.apache.axis2.transport.jms.JMSOutTransportInfo\" from polymorphic deserialization. The target repository contains the upstream fix (commit 42912cac4753f3f718ece875e4d486f8264c2f2b by Tatu Saloranta) which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java at line 85. This fix was already present in the upstream 2.12.4 release that TuxCare onboarded, predating all TuxCare commits in this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 is NOT present in jackson-databind 2.12.4. The vulnerability concerns the failure to block \"org.apache.axis2.transport.jms.JMSOutTransportInfo\" from polymorphic deserialization. The target repository contains the upstream fix (commit 42912cac4753f3f718ece875e4d486f8264c2f2b by Tatu Saloranta) which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java at line 85. This fix was already present in the upstream 2.12.4 release that TuxCare onboarded, predating all TuxCare commits in this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.4-tuxcare.3 is not affected by CVE-2018-19361. The vulnerable openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) are already blocked in SubTypeValidator.java. The upstream fix was applied by Tatu Saloranta in commit 72cd4025a2 (Nov 19, 2018) and was included in jackson-databind 2.10.0 and later versions, including the 2.12.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "The target jackson-databind 2.12.4-tuxcare.3 is not affected by CVE-2018-19361. The vulnerable openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) are already blocked in SubTypeValidator.java. The upstream fix was applied by Tatu Saloranta in commit 72cd4025a2 (Nov 19, 2018) and was included in jackson-databind 2.10.0 and later versions, including the 2.12.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves deserialization of org.jboss.util.propertyeditor.DocumentEditor, which can lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 72cd4025a22 on 2018-11-19 by adding DocumentEditor to the deserialization blocklist in SubTypeValidator.java. This fix was included in jackson-databind 2.9.8 and all subsequent versions. The target version 2.12.4 was released in 2021, well after the fix, and TuxCare onboarded an already-fixed upstream release. The blocklist entry is present at line 81 of SubTypeValidator.java, and the validation logic at lines 269-270 actively blocks instantiation of listed classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves deserialization of org.jboss.util.propertyeditor.DocumentEditor, which can lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 72cd4025a22 on 2018-11-19 by adding DocumentEditor to the deserialization blocklist in SubTypeValidator.java. This fix was included in jackson-databind 2.9.8 and all subsequent versions. The target version 2.12.4 was released in 2021, well after the fix, and TuxCare onboarded an already-fixed upstream release. The blocklist entry is present at line 81 of SubTypeValidator.java, and the validation logic at lines 269-270 actively blocks instantiation of listed classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability exploited two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed the existing blacklist. Both classes are now present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java lines 62-63). The fix was authored by Tatu Saloranta (upstream FasterXML) in commit 038b471e and shipped in the upstream 2.12.4 release that TuxCare subsequently onboarded. The SubTypeValidator is invoked during bean deserialization (BeanDeserializerFactory line 140), confirming the defense is active.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability exploited two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed the existing blacklist. Both classes are now present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java lines 62-63). The fix was authored by Tatu Saloranta (upstream FasterXML) in commit 038b471e and shipped in the upstream 2.12.4 release that TuxCare subsequently onboarded. The SubTypeValidator is invoked during bean deserialization (BeanDeserializerFactory line 140), confirming the defense is active.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.4-tuxcare.3 is NOT affected by CVE-2018-7489. The vulnerability pattern is not present because the upstream fix (commit 6799f8f10c by Tatu Saloranta) was already included in upstream release 2.12.4 when TuxCare onboarded it. The fix blocks deserialization of any c3p0 class matching the pattern `com.mchange.v2.c3p0.*DataSource`, preventing the exploitation path described in the CVE. Target version 2.12.4 is significantly newer than the last affected version (2.9.5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "The target jackson-databind 2.12.4-tuxcare.3 is NOT affected by CVE-2018-7489. The vulnerability pattern is not present because the upstream fix (commit 6799f8f10c by Tatu Saloranta) was already included in upstream release 2.12.4 when TuxCare onboarded it. The fix blocks deserialization of any c3p0 class matching the pattern `com.mchange.v2.c3p0.*DataSource`, preventing the exploitation path described in the CVE. Target version 2.12.4 is significantly newer than the last affected version (2.9.5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.4 is NOT affected by CVE-2019-12086. The vulnerability (missing validation for com.mysql.cj.jdbc.admin.MiniAdmin during polymorphic deserialization) was fixed by upstream FasterXML in version 2.9.9 (May 2019). Version 2.12.4 was released with this fix already present. The MiniAdmin class is included in the SubTypeValidator blocklist (line 88), preventing its deserialization. This is an upstream fix that shipped in the original 2.12.4 release, confirmed by git ancestry showing the fix commit predates TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "Target version 2.12.4 is NOT affected by CVE-2019-12086. The vulnerability (missing validation for com.mysql.cj.jdbc.admin.MiniAdmin during polymorphic deserialization) was fixed by upstream FasterXML in version 2.9.9 (May 2019). Version 2.12.4 was released with this fix already present. The MiniAdmin class is included in the SubTypeValidator blocklist (line 88), preventing its deserialization. This is an upstream fix that shipped in the original 2.12.4 release, confirmed by git ancestry showing the fix commit predates TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability affects jackson-databind versions before 2.9.9.1 that fail to block the logback-core class `ch.qos.logback.core.db.DriverManagerConnectionSource` from polymorphic deserialization, potentially allowing remote code execution. The target repository contains the upstream fix (commit c9ef4a10d6) which adds this cla...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability affects jackson-databind versions before 2.9.9.1 that fail to block the logback-core class `ch.qos.logback.core.db.DriverManagerConnectionSource` from polymorphic deserialization, potentially allowing remote code execution. The target repository contains the upstream fix (commit c9ef4a10d6) which adds this cla..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository (jackson-databind 2.12.4-tuxcare.3) is NOT affected by CVE-2019-12814. The fix for this vulnerability was already present in the upstream release 2.12.4 before TuxCare onboarded it. The SubTypeValidator class contains the required blocklist entries for org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer at lines 94-95, preventing the deserialization of...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 The target repository (jackson-databind 2.12.4-tuxcare.3) is NOT affected by CVE-2019-12814. The fix for this vulnerability was already present in the upstream release 2.12.4 before TuxCare onboarded it. The SubTypeValidator class contains the required blocklist entries for org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer at lines 94-95, preventing the deserialization of..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.4-tuxcare.3 is not affected by CVE-2019-14379. The vulnerability required the absence of blacklist entries for net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource in SubTypeValidator.java. Both entries are present in the target (lines 98, 102), preventing deserialization of these gadget classes. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.12.4 release before TuxCare onboarding. CVE-2019-14379 affects versions before 2.9.9.2, 2.8.11.4, and 2.7.9.6; target version 2.12.4 is significantly newer and includes the fix from the vendor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "Target jackson-databind 2.12.4-tuxcare.3 is not affected by CVE-2019-14379. The vulnerability required the absence of blacklist entries for net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource in SubTypeValidator.java. Both entries are present in the target (lines 98, 102), preventing deserialization of these gadget classes. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.12.4 release before TuxCare onboarding. CVE-2019-14379 affects versions before 2.9.9.2, 2.8.11.4, and 2.7.9.6; target version 2.12.4 is significantly newer and includes the fix from the vendor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 due to unsafe deserialization of ch.qos.logback.core.db.JNDIConnectionSource when Default Typing is enabled. The target version 2.12.4-tuxcare.3 already contains the upstream fix (commit ad418eeb97) that adds JNDIConnectionSource to the deserialization blacklist in SubTypeValidator.java (line 102). This fix was included in the upstream 2.12.4 release (July 2021), nearly two years after the patch was created (July 2019). The vulnerable code path does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 due to unsafe deserialization of ch.qos.logback.core.db.JNDIConnectionSource when Default Typing is enabled. The target version 2.12.4-tuxcare.3 already contains the upstream fix (commit ad418eeb97) that adds JNDIConnectionSource to the deserialization blacklist in SubTypeValidator.java (line 102). This fix was included in the upstream 2.12.4 release (July 2021), nearly two years after the patch was created (July 2019). The vulnerable code path does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is not present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes that can enable gadget-chain attacks. The fix (blacklisting both classes in SubTypeValidator) was included in the upstream jackson-databind 2.12.4 release and is present in the target at lines 104-107 of SubTypeValidator.java. This is an upstream fix by tatu.saloranta@iki.fi, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 is not present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes that can enable gadget-chain attacks. The fix (blacklisting both classes in SubTypeValidator) was included in the upstream jackson-databind 2.12.4 release and is present in the target at lines 104-107 of SubTypeValidator.java. This is an upstream fix by tatu.saloranta@iki.fi, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.4-tuxcare.3 is not affected by CVE-2019-14892. The fix that blocks deserialization of commons-configuration JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) was already present in the upstream jackson-databind 2.12.4 release. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "The target jackson-databind version 2.12.4-tuxcare.3 is not affected by CVE-2019-14892. The fix that blocks deserialization of commons-configuration JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) was already present in the upstream jackson-databind 2.12.4 release. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is not present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) that enables arbitrary code execution. The fix\u2014adding this class to SubTypeValidator's blocklist\u2014was introduced in upstream version 2.10.0 (commit 998efd7082 by Tatu Saloranta, September 2019). The target version 2.12.4 (released July 2021) inherited this protection from upstream. The blocklist entry is present at SubTypeValidator.java:117 and is actively enforced during bean deserialization via BeanDeserializerFactory.java:1000.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893 is not present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) that enables arbitrary code execution. The fix\u2014adding this class to SubTypeValidator's blocklist\u2014was introduced in upstream version 2.10.0 (commit 998efd7082 by Tatu Saloranta, September 2019). The target version 2.12.4 (released July 2021) inherited this protection from upstream. The blocklist entry is present at SubTypeValidator.java:117 and is actively enforced during bean deserialization via BeanDeserializerFactory.java:1000.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is a polymorphic typing vulnerability in jackson-databind related to com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.12.4-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.12.4 when TuxCare onboarded it. The fix (commit 73c1c2cc76, authored by upstream maintainer Tatu Saloranta on 2019-09-12) adds HikariDataSource to the SubTypeValidator blocklist, preventing its use in polymorphic deserialization. This fix was included in upstream releases starting from 2.10.0, well before the 2.12.4 release that TuxCare onboarded in September 2026. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 is a polymorphic typing vulnerability in jackson-databind related to com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.12.4-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.12.4 when TuxCare onboarded it. The fix (commit 73c1c2cc76, authored by upstream maintainer Tatu Saloranta on 2019-09-12) adds HikariDataSource to the SubTypeValidator blocklist, preventing its use in polymorphic deserialization. This fix was included in upstream releases starting from 2.10.0, well before the 2.12.4 release that TuxCare onboarded in September 2026. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 targets jackson-databind versions 2.0.0 through 2.9.10 for polymorphic deserialization gadgets in commons-dbcp classes. The target (version 2.12.4-tuxcare.3) already contains the upstream vendor's fix. All three dangerous classes (org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource) are present in the SubTypeValidator.java blocklist (lines 124-127). This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and was already included in the upstream 2.12.4 release that TuxCare onboarded. The validation is active during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 targets jackson-databind versions 2.0.0 through 2.9.10 for polymorphic deserialization gadgets in commons-dbcp classes. The target (version 2.12.4-tuxcare.3) already contains the upstream vendor's fix. All three dangerous classes (org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource) are present in the SubTypeValidator.java blocklist (lines 124-127). This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and was already included in the upstream 2.12.4 release that TuxCare onboarded. The validation is active during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1 when polymorphic typing is enabled, allowing deserialization of com.p6spy.engine.spy.P6DataSource and related gadget classes leading to RCE. The target (jackson-databind 2.12.4-tuxcare.3) contains the upstream vendor fix that adds P6DataSource, SharedPoolDataSource, and PerUserPoolDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 124-127). This fix was authored by upstream vendor Tatu Saloranta (tatu.saloranta@iki.fi) in commit 9593e16cf5 and shipped in the upstream 2.12.4 release that TuxCare onboarded. The SubTypeValidator.validateSubType method enforces this blocklist during bean deserialization (invoked from BeanDeserializerFactory.java:140), throwing JsonMappingException when blocked types are specified in JSON payloads, preventing instantiation and blocking the attack chain before the gadget class reaches the exploitation goal.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1 when polymorphic typing is enabled, allowing deserialization of com.p6spy.engine.spy.P6DataSource and related gadget classes leading to RCE. The target (jackson-databind 2.12.4-tuxcare.3) contains the upstream vendor fix that adds P6DataSource, SharedPoolDataSource, and PerUserPoolDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 124-127). This fix was authored by upstream vendor Tatu Saloranta (tatu.saloranta@iki.fi) in commit 9593e16cf5 and shipped in the upstream 2.12.4 release that TuxCare onboarded. The SubTypeValidator.validateSubType method enforces this blocklist during bean deserialization (invoked from BeanDeserializerFactory.java:140), throwing JsonMappingException when blocked types are specified in JSON payloads, preventing instantiation and blocking the attack chain before the gadget class reaches the exploitation goal.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.12.4-tuxcare.3 is not affected by CVE-2019-17267. The upstream fix (commit 191a4cdf87) that adds the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup to the SubTypeValidator blocklist was already present in the upstream release 2.12.4 that TuxCare onboarded. The fix prevents polymorphic deserialization of the dangerous class by validating all class names against a blocklist during bean deserialization, rejecting any attempts to instantiate blocklisted types before they can be exploited.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "The target repository jackson-databind 2.12.4-tuxcare.3 is not affected by CVE-2019-17267. The upstream fix (commit 191a4cdf87) that adds the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup to the SubTypeValidator blocklist was already present in the upstream release 2.12.4 that TuxCare onboarded. The fix prevents polymorphic deserialization of the dangerous class by validating all class names against a blocklist during bean deserialization, rejecting any attempts to instantiate blocklisted types before they can be exploited.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involved deserialization of malicious log4j-extras classes (DriverManagerConnectionSource, JNDIConnectionSource) via polymorphic typing to achieve remote code execution through JNDI. The upstream vendor fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0, October 2019) added these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream jackson-databind 2.12.4 when TuxCare onboarded it in September 2026. The vulnerable pattern is not present because the upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involved deserialization of malicious log4j-extras classes (DriverManagerConnectionSource, JNDIConnectionSource) via polymorphic typing to achieve remote code execution through JNDI. The upstream vendor fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0, October 2019) added these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream jackson-databind 2.12.4 when TuxCare onboarded it in September 2026. The vulnerable pattern is not present because the upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.4-tuxcare.3 is NOT affected by CVE-2019-20330. The vulnerability concerns lack of blocking for net.sf.ehcache gadget classes (GenericJndiSelector and GlassfishSelector) that can perform JNDI lookups during polymorphic deserialization. The upstream fix, which adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, was already present in the upstream 2.12.4 release when TuxCare onboarded it. The vulnerable pattern does not exist in this version because the upstream vendor (FasterXML) fixed it in commit eb254813cc authored by Tatu Saloranta long before the 2.12.4 release. The CVE affects versions before 2.9.10.2; version 2.12.4 is significantly newer and includes the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "The target jackson-databind version 2.12.4-tuxcare.3 is NOT affected by CVE-2019-20330. The vulnerability concerns lack of blocking for net.sf.ehcache gadget classes (GenericJndiSelector and GlassfishSelector) that can perform JNDI lookups during polymorphic deserialization. The upstream fix, which adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, was already present in the upstream 2.12.4 release when TuxCare onboarded it. The vulnerable pattern does not exist in this version because the upstream vendor (FasterXML) fixed it in commit eb254813cc authored by Tatu Saloranta long before the 2.12.4 release. The CVE affects versions before 2.9.10.2; version 2.12.4 is significantly newer and includes the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind < 2.9.10.4 and involves unsafe deserialization of ignite-jta JNDI gadget classes. The target (jackson-databind 2.12.4-tuxcare.3) is NOT AFFECTED because the upstream vendor fix is present. The three gadget classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) are blocked in SubTypeValidator.java lines 158-160. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit a424c038ba and shipped in upstream release 2.12.4, which TuxCare then onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 affects jackson-databind < 2.9.10.4 and involves unsafe deserialization of ignite-jta JNDI gadget classes. The target (jackson-databind 2.12.4-tuxcare.3) is NOT AFFECTED because the upstream vendor fix is present. The three gadget classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) are blocked in SubTypeValidator.java lines 158-160. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit a424c038ba and shipped in upstream release 2.12.4, which TuxCare then onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.4 is not affected by CVE-2020-10672. The vulnerability concerns deserialization of the dangerous gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory in jackson-databind versions before 2.9.10.4. The target already contains the upstream fix that adds this class to the deserialization blocklist (SubTypeValidator.java lines 162-164). The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream jackson-databind 2.12.4 release that TuxCare onboarded, confirmed by ancestry analysis showing the fix commit (592872f4) predates the first TuxCare onboarding commit (174b7300).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "Target version 2.12.4 is not affected by CVE-2020-10672. The vulnerability concerns deserialization of the dangerous gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory in jackson-databind versions before 2.9.10.4. The target already contains the upstream fix that adds this class to the deserialization blocklist (SubTypeValidator.java lines 162-164). The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream jackson-databind 2.12.4 release that TuxCare onboarded, confirmed by ancestry analysis showing the fix commit (592872f4) predates the first TuxCare onboarding commit (174b7300).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves deserialization of the dangerous gadget class com.caucho.config.types.ResourceRef. The upstream vendor fix (commit 1645efbd39 by Tatu Saloranta, 2020-03-17) added this class to the blocklist in SubTypeValidator.java, preventing its deserialization. This fix was already present in the upstream Jackson 2.12.4 release before TuxCare onboarded it (onboarding commit 174b7300, 2026-09-20). The fix is located at line 167 of SubTypeValidator.java and provides comprehensive protection by blocking any attempt to deserialize this class when polymorphic type handling is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves deserialization of the dangerous gadget class com.caucho.config.types.ResourceRef. The upstream vendor fix (commit 1645efbd39 by Tatu Saloranta, 2020-03-17) added this class to the blocklist in SubTypeValidator.java, preventing its deserialization. This fix was already present in the upstream Jackson 2.12.4 release before TuxCare onboarded it (onboarding commit 174b7300, 2026-09-20). The fix is located at line 167 of SubTypeValidator.java and provides comprehensive protection by blocking any attempt to deserialize this class when polymorphic type handling is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind 2.x before 2.9.10.4, involving deserialization gadgets related to org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository is jackson-databind version 2.12.4-tuxcare.3, which is well beyond the affected version range. The fix (blocklisting the two RmiProvider classes) was applied by upstream maintainer Tatu Saloranta in commit 05d7e0e13f on 2020-03-25 and shipped in upstream release 2.9.10.4. When TuxCare onboarded version 2.12.4, this fix was already present in the upstream codebase. The vulnerable pattern is not present in the target because the fix was included in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 affects jackson-databind 2.x before 2.9.10.4, involving deserialization gadgets related to org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository is jackson-databind version 2.12.4-tuxcare.3, which is well beyond the affected version range. The fix (blocklisting the two RmiProvider classes) was applied by upstream maintainer Tatu Saloranta in commit 05d7e0e13f on 2020-03-25 and shipped in upstream release 2.9.10.4. When TuxCare onboarded version 2.12.4, this fix was already present in the upstream codebase. The vulnerable pattern is not present in the target because the fix was included in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 is not present in jackson-databind 2.12.4-tuxcare.3. The vulnerability was fixed by upstream author Tatu Saloranta in commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60 (March 3, 2020), which added javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.12.4 release when TuxCare onboarded it (commit 174b7300751ec12750eae4bdd7b2dd80b886ee68). The target code at line 150 of SubTypeValidator.java confirms the blocklist entry is present and active.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "CVE-2020-10969 is not present in jackson-databind 2.12.4-tuxcare.3. The vulnerability was fixed by upstream author Tatu Saloranta in commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60 (March 3, 2020), which added javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.12.4 release when TuxCare onboarded it (commit 174b7300751ec12750eae4bdd7b2dd80b886ee68). The target code at line 150 of SubTypeValidator.java confirms the blocklist entry is present and active.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2020-11111. The vulnerability concerns deserialization gadgets in org.apache.activemq.* classes. The upstream vendor (FasterXML) already fixed this in the 2.12.4 release by adding all affected activemq classes to the SubTypeValidator blocklist (commit c14c9f99ed, March 2020). When TuxCare onboarded version 2.12.4 (commit 174b730075), the fix was already present in the upstream codebase. The defense blocks deserialization of activemq classes by checking the DEFAULT_NO_DESER_CLASS_NAMES set during type validation, preventing the gadget chain from instantiating.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "The target jackson-databind 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2020-11111. The vulnerability concerns deserialization gadgets in org.apache.activemq.* classes. The upstream vendor (FasterXML) already fixed this in the 2.12.4 release by adding all affected activemq classes to the SubTypeValidator blocklist (commit c14c9f99ed, March 2020). When TuxCare onboarded version 2.12.4 (commit 174b730075), the fix was already present in the upstream codebase. The defense blocks deserialization of activemq classes by checking the DEFAULT_NO_DESER_CLASS_NAMES set during type validation, preventing the gadget chain from instantiating.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is not present in jackson-databind 2.12.4-tuxcare.3. The upstream fix (commit 05d7e0e13f) that adds org.apache.commons.proxy.provider.remoting.RmiProvider to the deserialization blacklist was already included in the jackson-databind 2.12.4 release that TuxCare onboarded. The vulnerable pattern (missing blacklist entry) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 is not present in jackson-databind 2.12.4-tuxcare.3. The upstream fix (commit 05d7e0e13f) that adds org.apache.commons.proxy.provider.remoting.RmiProvider to the deserialization blacklist was already included in the jackson-databind 2.12.4 release that TuxCare onboarded. The vulnerable pattern (missing blacklist entry) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is not present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves unsafe deserialization of the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix (adding this class to the SubTypeValidator blacklist) was authored by upstream maintainer Tatu Saloranta and shipped in upstream version 2.12.4, which TuxCare later onboarded. The blacklist entry is present at line 84 of SubTypeValidator.java and is actively enforced during polymorphic deserialization, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 is not present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves unsafe deserialization of the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix (adding this class to the SubTypeValidator blacklist) was authored by upstream maintainer Tatu Saloranta and shipped in upstream version 2.12.4, which TuxCare later onboarded. The blacklist entry is present at line 84 of SubTypeValidator.java and is actively enforced during polymorphic deserialization, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.4-tuxcare.3) is not affected by CVE-2020-11619. The vulnerability concerns deserialization gadgets related to org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The fix for this vulnerability was already present in the upstream jackson-databind 2.12.4 release before TuxCare onboarded it. The fix, authored by upstream maintainer Tatu Saloranta, adds these two class names to the SubTypeValidator denylist, preventing their deserialization. Since version 2.12.4 is later than 2.9.10.4 (where the fix was first released), the vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "The target repository (jackson-databind 2.12.4-tuxcare.3) is not affected by CVE-2020-11619. The vulnerability concerns deserialization gadgets related to org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The fix for this vulnerability was already present in the upstream jackson-databind 2.12.4 release before TuxCare onboarded it. The fix, authored by upstream maintainer Tatu Saloranta, adds these two class names to the SubTypeValidator denylist, preventing their deserialization. Since version 2.12.4 is later than 2.9.10.4 (where the fix was first released), the vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.4 is not affected by CVE-2020-11620. The vulnerability involves a deserialization gadget class (org.apache.commons.jelly.impl.Embedded) that could be exploited via polymorphic type handling. The fix, which adds this class to a blocklist in SubTypeValidator.java, was already present in the upstream jackson-databind 2.12.4 release that TuxCare onboarded. The blocklist entry at line 189 prevents deserialization of this gadget class, blocking the attack chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "The target jackson-databind 2.12.4 is not affected by CVE-2020-11620. The vulnerability involves a deserialization gadget class (org.apache.commons.jelly.impl.Embedded) that could be exploited via polymorphic type handling. The fix, which adds this class to a blocklist in SubTypeValidator.java, was already present in the upstream jackson-databind 2.12.4 release that TuxCare onboarded. The blocklist entry at line 189 prevents deserialization of this gadget class, blocking the attack chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 does not affect jackson-databind 2.12.4-tuxcare.3. The vulnerability involves deserialization gadgets in the apache/drill shaded classes (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool and related commons-dbcp classes). The upstream fix, which blacklists these gadget classes in SubTypeValidator, was introduced in jackson-databind 2.9.10.5 by upstream author Tatu Saloranta. Since the target version 2.12.4 is significantly newer than 2.9.10.5, the fix was already present in the upstream release that TuxCare onboarded, and all three blacklist entries are confirmed present in the target code at SubTypeValidator.java lines 192-195.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 does not affect jackson-databind 2.12.4-tuxcare.3. The vulnerability involves deserialization gadgets in the apache/drill shaded classes (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool and related commons-dbcp classes). The upstream fix, which blacklists these gadget classes in SubTypeValidator, was introduced in jackson-databind 2.9.10.5 by upstream author Tatu Saloranta. Since the target version 2.12.4 is significantly newer than 2.9.10.5, the fix was already present in the upstream release that TuxCare onboarded, and all three blacklist entries are confirmed present in the target code at SubTypeValidator.java lines 192-195.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.4-tuxcare.3 is NOT vulnerable to CVE-2020-14061. The vulnerability concerns deserialization gadgets using Oracle JMS connection factory classes (oracle.jms.AQjms*). The fix, which adds these classes to a deserialization blocklist in SubTypeValidator.java, was already present in the upstream release 2.12.4 before TuxCare onboarded it. The fix commit (5c8642aeae) by upstream author Tatu Saloranta is an ancestor of both the target HEAD and the first TuxCare commit (a7a5ae30fc). The vulnerable code pattern is not present in the target because the upstream vendor had already applied the fix in the 2.12.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "The target jackson-databind 2.12.4-tuxcare.3 is NOT vulnerable to CVE-2020-14061. The vulnerability concerns deserialization gadgets using Oracle JMS connection factory classes (oracle.jms.AQjms*). The fix, which adds these classes to a deserialization blocklist in SubTypeValidator.java, was already present in the upstream release 2.12.4 before TuxCare onboarded it. The fix commit (5c8642aeae) by upstream author Tatu Saloranta is an ancestor of both the target HEAD and the first TuxCare commit (a7a5ae30fc). The vulnerable code pattern is not present in the target because the upstream vendor had already applied the fix in the 2.12.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target is version 2.12.4-tuxcare.3, which already contains the upstream fix that blacklists com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool in SubTypeValidator.java (line 119). The fix was authored by upstream maintainer Tatu Saloranta in commit 840eae2ca81 and was included in the upstream release 2.9.10.5, well before version 2.12.4 was released. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target is version 2.12.4-tuxcare.3, which already contains the upstream fix that blacklists com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool in SubTypeValidator.java (line 119). The fix was authored by upstream maintainer Tatu Saloranta in commit 840eae2ca81 and was included in the upstream release 2.9.10.5, well before version 2.12.4 was released. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory. The upstream fix (commit f6d9c664f6) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in upstream version 2.12.4 before TuxCare onboarded it (first TuxCare commit 174b73007 \"Onboard version 2.12.4\"). The target contains the defense at SubTypeValidator.java:207, which blocks the malicious class during polymorphic type validation and throws a security exception before deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory. The upstream fix (commit f6d9c664f6) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in upstream version 2.12.4 before TuxCare onboarded it (first TuxCare commit 174b73007 \"Onboard version 2.12.4\"). The target contains the defense at SubTypeValidator.java:207, which blocks the malicious class during polymorphic type validation and throws a security exception before deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 does not affect jackson-databind 2.12.4-tuxcare.3. The vulnerability involves deserialization of the br.com.anteros.dbcp.AnterosDBCPDataSource gadget class. The upstream fix (adding this class to the SubTypeValidator blocklist) was already present in the upstream 2.12.4 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 does not affect jackson-databind 2.12.4-tuxcare.3. The vulnerability involves deserialization of the br.com.anteros.dbcp.AnterosDBCPDataSource gadget class. The upstream fix (adding this class to the SubTypeValidator blocklist) was already present in the upstream 2.12.4 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2020-24750. The vulnerability involves a JNDI deserialization gadget in com.pastdev.httpcomponents.configuration.JndiConfiguration. The upstream vendor (FasterXML) fixed this by adding the gadget class to a deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.12.4 release when TuxCare onboarded it, so the vulnerable code pattern has never been present in the TuxCare-maintained version. The fix commit (6cc9f1a1af) authored by upstream maintainer Tatu Saloranta is an ancestor of the onboarding commit (174b730075), confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "The target jackson-databind 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2020-24750. The vulnerability involves a JNDI deserialization gadget in com.pastdev.httpcomponents.configuration.JndiConfiguration. The upstream vendor (FasterXML) fixed this by adding the gadget class to a deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.12.4 release when TuxCare onboarded it, so the vulnerable code pattern has never been present in the TuxCare-maintained version. The fix commit (6cc9f1a1af) authored by upstream maintainer Tatu Saloranta is an ancestor of the onboarding commit (174b730075), confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 is NOT present in jackson-databind 2.12.4-tuxcare.3. The XXE (XML External Entity) vulnerability was fixed by upstream FasterXML in commit 612f971b78 (authored by tatu.saloranta@iki.fi) which added two XML security features to DOMDeserializer: (1) disallow-doctype-decl=true to reject DOCTYPE declarations, and (2) load-external-dtd=false to prevent loading external DTDs. This fix was already present in the upstream 2.12.4 release before TuxCare onboarded it (first TuxCare commit 174b730075). The defense code is active in the static initializer at DOMDeserializer.java lines 43-49, protecting all XML deserialization paths through the DEFAULT_PARSER_FACTORY.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 is NOT present in jackson-databind 2.12.4-tuxcare.3. The XXE (XML External Entity) vulnerability was fixed by upstream FasterXML in commit 612f971b78 (authored by tatu.saloranta@iki.fi) which added two XML security features to DOMDeserializer: (1) disallow-doctype-decl=true to reject DOCTYPE declarations, and (2) load-external-dtd=false to prevent loading external DTDs. This fix was already present in the upstream 2.12.4 release before TuxCare onboarded it (first TuxCare commit 174b730075). The defense code is active in the static initializer at DOMDeserializer.java lines 43-49, protecting all XML deserialization paths through the DEFAULT_PARSER_FACTORY.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability concerns deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix (adding these classes to the deserialization blacklist) was already present in upstream jackson-databind 2.12.4 when TuxCare onboarded it. The target contains the fix at SubTypeValidator.java lines 217-218, installed by upstream commit 41b8bdb5ccc authored by Tatu Saloranta on 2020-12-15, which predates the TuxCare onboarding commit 174b7300751.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "CVE-2020-35490 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability concerns deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix (adding these classes to the deserialization blacklist) was already present in upstream jackson-databind 2.12.4 when TuxCare onboarded it. The target contains the fix at SubTypeValidator.java lines 217-218, installed by upstream commit 41b8bdb5ccc authored by Tatu Saloranta on 2020-12-15, which predates the TuxCare onboarding commit 174b7300751.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 targets jackson-databind versions before 2.9.10.8 that lack blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The target (jackson-databind 2.12.4-tuxcare.3) contains the complete upstream vendor fix (commit 41b8bdb5cc by Tatu Saloranta, 2020-12-15) that adds these classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. This fix was part of the upstream 2.12.4 release before TuxCare onboarding, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "CVE-2020-35491 targets jackson-databind versions before 2.9.10.8 that lack blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The target (jackson-databind 2.12.4-tuxcare.3) contains the complete upstream vendor fix (commit 41b8bdb5cc by Tatu Saloranta, 2020-12-15) that adds these classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. This fix was part of the upstream 2.12.4 release before TuxCare onboarding, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability requires blocking the deserialization gadget class 'com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool'. This class is already blocked in SubTypeValidator.java at line 240. The fix was authored by upstream maintainer Tatu Saloranta (commit 1ca0388c2fb, 2020-12-26) and was already included in the upstream jackson-databind 2.12.4 release that TuxCare onboarded. The vulnerable code pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "CVE-2020-35728 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability requires blocking the deserialization gadget class 'com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool'. This class is already blocked in SubTypeValidator.java at line 240. The fix was authored by upstream maintainer Tatu Saloranta (commit 1ca0388c2fb, 2020-12-26) and was already included in the upstream jackson-databind 2.12.4 release that TuxCare onboarded. The vulnerable code pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.4-tuxcare.3 is not affected by CVE-2020-36179. The vulnerability requires the absence of blocklist entries for DriverAdapterCPDS classes in SubTypeValidator.java, but the fix was already present in the upstream 2.12.4 release that TuxCare onboarded. All five DriverAdapterCPDS variants mentioned in the security patch are present in the blocklist (lines 123, 193, 219, 228, 234), preventing deserialization of these dangerous gadget classes. The fix commit (3ded28aece) was authored by upstream maintainer Tatu Saloranta on 2020-12-31, well before TuxCare's onboarding on 2026-09-20.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "The target jackson-databind 2.12.4-tuxcare.3 is not affected by CVE-2020-36179. The vulnerability requires the absence of blocklist entries for DriverAdapterCPDS classes in SubTypeValidator.java, but the fix was already present in the upstream 2.12.4 release that TuxCare onboarded. All five DriverAdapterCPDS variants mentioned in the security patch are present in the blocklist (lines 123, 193, 219, 228, 234), preventing deserialization of these dangerous gadget classes. The fix commit (3ded28aece) was authored by upstream maintainer Tatu Saloranta on 2020-12-31, well before TuxCare's onboarding on 2026-09-20.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 concerns Jackson's deserialization gadget vulnerability related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and variants. The target repository (jackson-databind 2.12.4-tuxcare.3) is NOT AFFECTED because the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already present in the upstream release 2.12.4 that TuxCare onboarded. All five DriverAdapterCPDS gadget class variants are present in SubTypeValidator's blocklist (lines 123, 193, 219, 228, 234), and SubTypeValidator is actively enforced during deserialization in BeanDeserializerFactory. The vulnerable code pattern (missing gadget blocks) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "CVE-2020-36180 concerns Jackson's deserialization gadget vulnerability related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and variants. The target repository (jackson-databind 2.12.4-tuxcare.3) is NOT AFFECTED because the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already present in the upstream release 2.12.4 that TuxCare onboarded. All five DriverAdapterCPDS gadget class variants are present in SubTypeValidator's blocklist (lines 123, 193, 219, 228, 234), and SubTypeValidator is actively enforced during deserialization in BeanDeserializerFactory. The vulnerable code pattern (missing gadget blocks) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 does not affect jackson-databind 2.12.4-tuxcare.3. The upstream fix (commit 3ded28aece by Tatu Saloranta) that blocks org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS from deserialization was already included in the jackson-databind 2.12.4 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 does not affect jackson-databind 2.12.4-tuxcare.3. The upstream fix (commit 3ded28aece by Tatu Saloranta) that blocks org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS from deserialization was already included in the jackson-databind 2.12.4 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.12.4. The vulnerability involves missing blocklist entries for DriverAdapterCPDS gadget classes that enable deserialization-based RCE. The upstream fix (commit 3ded28aece by Tatu Saloranta) added these classes to SubTypeValidator's blocklist and was already included in the upstream 2.12.4 release that TuxCare onboarded. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.12.4. The vulnerability involves missing blocklist entries for DriverAdapterCPDS gadget classes that enable deserialization-based RCE. The upstream fix (commit 3ded28aece by Tatu Saloranta) added these classes to SubTypeValidator's blocklist and was already included in the upstream 2.12.4 release that TuxCare onboarded. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not present in jackson-databind 2.12.4-tuxcare.3. The fix (blacklisting org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool to prevent JNDI injection via deserialization gadgets) was added by upstream maintainer Tatu Saloranta on 2020-12-31 (commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29) and shipped in the upstream 2.12.4 release. TuxCare onboarded this already-fixed version on 2026-09-20. The blacklist entry is present at SubTypeValidator.java:243 and is enforced during deserialization via BeanDeserializerFactory._validateSubType() at line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "CVE-2020-36183 is not present in jackson-databind 2.12.4-tuxcare.3. The fix (blacklisting org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool to prevent JNDI injection via deserialization gadgets) was added by upstream maintainer Tatu Saloranta on 2020-12-31 (commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29) and shipped in the upstream 2.12.4 release. TuxCare onboarded this already-fixed version on 2026-09-20. The blacklist entry is present at SubTypeValidator.java:243 and is enforced during deserialization via BeanDeserializerFactory._validateSubType() at line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2020-36184. The vulnerability pattern is not present because the fix was already included in the upstream jackson-databind 2.12.4 release that TuxCare onboarded. The blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource are present in SubTypeValidator.java (lines 235-236), preventing deserialization of these gadget classes. The fix was authored by the upstream maintainer Tatu Saloranta and shipped in upstream releases 2.12.1 through 2.12.5, including the 2.12.4 base that TuxCare maintains.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "The target jackson-databind 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2020-36184. The vulnerability pattern is not present because the fix was already included in the upstream jackson-databind 2.12.4 release that TuxCare onboarded. The blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource are present in SubTypeValidator.java (lines 235-236), preventing deserialization of these gadget classes. The fix was authored by the upstream maintainer Tatu Saloranta and shipped in upstream releases 2.12.1 through 2.12.5, including the 2.12.4 base that TuxCare maintains.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to missing blacklist entry for org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource, enabling polymorphic deserialization gadget attacks. The target version 2.12.4-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability in commit 567194c53a (Dec 26, 2020), which added the required blacklist entry to SubTypeValidator. This fix was included in upstream jackson-databind 2.12.1 release, and the TuxCare onboarding of version 2.12.4 inherited the fix from upstream. The vulnerable code pattern (missing blacklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to missing blacklist entry for org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource, enabling polymorphic deserialization gadget attacks. The target version 2.12.4-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability in commit 567194c53a (Dec 26, 2020), which added the required blacklist entry to SubTypeValidator. This fix was included in upstream jackson-databind 2.12.1 release, and the TuxCare onboarding of version 2.12.4 inherited the fix from upstream. The vulnerable code pattern (missing blacklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is not present in jackson-databind 2.12.4-tuxcare.3. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix (adding these classes to the deserialization blocklist) was already included in the upstream release 2.12.4 that TuxCare onboarded. The dangerous classes are blocked at lines 229-230 of SubTypeValidator.java, preventing malicious deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "CVE-2020-36186 is not present in jackson-databind 2.12.4-tuxcare.3. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix (adding these classes to the deserialization blocklist) was already included in the upstream release 2.12.4 that TuxCare onboarded. The dangerous classes are blocked at lines 229-230 of SubTypeValidator.java, preventing malicious deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is not present in jackson-databind 2.12.4-tuxcare.3. The fix, which adds org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist, was already included in the upstream 2.12.4 release that TuxCare onboarded. The vulnerable pattern (missing blocklist entries) does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "CVE-2020-36187 is not present in jackson-databind 2.12.4-tuxcare.3. The fix, which adds org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist, was already included in the upstream 2.12.4 release that TuxCare onboarded. The vulnerable pattern (missing blocklist entries) does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 targets jackson-databind deserialization gadgets com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource. The target (jackson-databind 2.12.4-tuxcare.3) includes the upstream fix (commit 33d96c13fe by Tatu Saloranta) that adds these classes to the deserialization blocklist in SubTypeValidator.java. The fix was already present in the upstream 2.12.4 release that TuxCare onboarded (first TuxCare commit 174b730075 \"Onboard version 2.12.4\" comes after the fix). The vulnerable pattern is not present because the blocklist prevents deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188 targets jackson-databind deserialization gadgets com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource. The target (jackson-databind 2.12.4-tuxcare.3) includes the upstream fix (commit 33d96c13fe by Tatu Saloranta) that adds these classes to the deserialization blocklist in SubTypeValidator.java. The fix was already present in the upstream 2.12.4 release that TuxCare onboarded (first TuxCare commit 174b730075 \"Onboard version 2.12.4\" comes after the fix). The vulnerable pattern is not present because the blocklist prevents deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is not present in jackson-databind 2.12.4-tuxcare.3. The upstream fix for this deserialization gadget vulnerability was already included in the jackson-databind 2.12.4 release that TuxCare onboarded. The vulnerable classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource) are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 is not present in jackson-databind 2.12.4-tuxcare.3. The upstream fix for this deserialization gadget vulnerability was already included in the jackson-databind 2.12.4 release that TuxCare onboarded. The vulnerable classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource) are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-36518 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 affects jackson-databind versions lacking blocklist protection for org.apache.xbean.propertyeditor.JndiConverter, a JNDI gadget class. The target repository (jackson-databind 2.12.4-tuxcare.3) already contains the upstream fix: the malicious class is blocklisted in SubTypeValidator.java at line 138, preventing polymorphic deserialization attacks. The fix was authored by upstream maintainer Tatu Saloranta (commit 914e7c9f2c, 2020-02-09) and shipped in the upstream 2.12.4 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 affects jackson-databind versions lacking blocklist protection for org.apache.xbean.propertyeditor.JndiConverter, a JNDI gadget class. The target repository (jackson-databind 2.12.4-tuxcare.3) already contains the upstream fix: the malicious class is blocklisted in SubTypeValidator.java at line 138, preventing polymorphic deserialization attacks. The fix was authored by upstream maintainer Tatu Saloranta (commit 914e7c9f2c, 2020-02-09) and shipped in the upstream 2.12.4 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is not present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, which could lead to arbitrary code execution. The fix (adding this class to the SubTypeValidator blocklist) was already present in the upstream 2.12.4 release that TuxCare onboarded. The blocklist entry exists at line 141 of SubTypeValidator.java, preventing deserialization of this dangerous class. This is an upstream fix authored by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 is not present in jackson-databind 2.12.4-tuxcare.3. The vulnerability involves deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, which could lead to arbitrary code execution. The fix (adding this class to the SubTypeValidator blocklist) was already present in the upstream 2.12.4 release that TuxCare onboarded. The blocklist entry exists at line 141 of SubTypeValidator.java, preventing deserialization of this dangerous class. This is an upstream fix authored by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability concerns a deserialization gadget involving `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The upstream FasterXML project added this class to the `SubTypeValidator` blacklist in commits 1e64db6a2f and 9f4e97019f, which were included in jackson-databind 2.12.0. Since the target is version 2.12.4, the fix was already present in the upstream release that TuxCare onboarded. The blacklist entry exists at SubTypeValidator.java:144, preventing deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 is NOT present in jackson-databind 2.12.4-tuxcare.3. The vulnerability concerns a deserialization gadget involving `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The upstream FasterXML project added this class to the `SubTypeValidator` blacklist in commits 1e64db6a2f and 9f4e97019f, which were included in jackson-databind 2.12.0. Since the target is version 2.12.4, the fix was already present in the upstream release that TuxCare onboarded. The blacklist entry exists at SubTypeValidator.java:144, preventing deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.4-tuxcare.3 is NOT affected by CVE-2020-9548. The fix blocking deserialization of br.com.anteros.dbcp.AnterosDBCPConfig was already present in the upstream Jackson 2.12.4 release that TuxCare onboarded. The dangerous class name is in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 145 of SubTypeValidator.java, preventing the polymorphic deserialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "Target version 2.12.4-tuxcare.3 is NOT affected by CVE-2020-9548. The fix blocking deserialization of br.com.anteros.dbcp.AnterosDBCPConfig was already present in the upstream Jackson 2.12.4 release that TuxCare onboarded. The dangerous class name is in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 145 of SubTypeValidator.java, preventing the polymorphic deserialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2021-20190. The vulnerability fixes (blocking deserialization of gadget classes including javax.swing.JTextPane, com.nqadmin.rowset.JdbcRowSetImpl, and many others) were already present in the upstream jackson-databind 2.12.4 release. Fix commit 7dbf51bf78 by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) shipped in the upstream release before TuxCare's onboarding commit 174b730075. The SubTypeValidator.java blocklist at lines 32-245 contains all required gadget class blocks, and the validation logic at lines 259-304 actively prevents their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "The target jackson-databind 2.12.4-tuxcare.3 is NOT AFFECTED by CVE-2021-20190. The vulnerability fixes (blocking deserialization of gadget classes including javax.swing.JTextPane, com.nqadmin.rowset.JdbcRowSetImpl, and many others) were already present in the upstream jackson-databind 2.12.4 release. Fix commit 7dbf51bf78 by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) shipped in the upstream release before TuxCare's onboarding commit 174b730075. The SubTypeValidator.java blocklist at lines 32-245 contains all required gadget class blocks, and the validation logic at lines 259-304 actively prevents their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2021-46877 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-54516 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 jackson-databind 2.12.4 is not affected by CVE-2026-54516. The vulnerability was introduced in version 2.21.0 by commit 1fe6ee7a89 (issue #5398), which added logic to allow properties with renamed getters and ignored setters to be renamed and retain their backing fields for deserialization. This commit is not present in version 2.12.4, which predates the vulnerable code path by several major ve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54516" }, "impact_statement": "not_affected \u2014 jackson-databind 2.12.4 is not affected by CVE-2026-54516. The vulnerability was introduced in version 2.21.0 by commit 1fe6ee7a89 (issue #5398), which added logic to allow properties with renamed getters and ignored setters to be renamed and retain their backing fields for deserialization. This commit is not present in version 2.12.4, which predates the vulnerable code path by several major ve..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54518 affects UnwrappedPropertyHandler.processUnwrappedCreatorProperties(), which bypasses @JsonView checks when deserializing unwrapped creator parameters. The target version 2.12.4-tuxcare.3 does NOT support @JsonUnwrapped on creator parameters at all - this feature was introduced 1909 commits later in version 2.19.0 (commit 502fe888da, 2024-11-13). The vulnerable method doesn't exis...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 CVE-2026-54518 affects UnwrappedPropertyHandler.processUnwrappedCreatorProperties(), which bypasses @JsonView checks when deserializing unwrapped creator parameters. The target version 2.12.4-tuxcare.3 does NOT support @JsonUnwrapped on creator parameters at all - this feature was introduced 1909 commits later in version 2.19.0 (commit 502fe888da, 2024-11-13). The vulnerable method doesn't exis..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:20.048404+00:00", "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59888" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.12.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.4-tuxcare.4" } } ], "timestamp": "2026-11-05T11:16:02.093695+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.12.4-tuxcare.4.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }