{
  "@id": "urn:uuid:bfad197d-0abf-49f9-aef0-24fe0fd55e65",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T10:43:19.113489+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is NOT present in jackson-databind 2.12.5. The vulnerability was fixed upstream by FasterXML in versions 2.8.11 and 2.9.4 (released 2017), and version 2.12.5 (released 2021) includes these security fixes. The target contains a comprehensive SubTypeValidator class with a blacklist that blocks all dangerous gadget classes identified in issues #1680 and #1737, preventing the deserialization-based code execution attack. The fix was authored by tatu.saloranta@iki.fi (upstream maintainer) and shipped in the upstream release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is NOT present in jackson-databind 2.12.5. The vulnerability was fixed upstream by FasterXML in versions 2.8.11 and 2.9.4 (released 2017), and version 2.12.5 (released 2021) includes these security fixes. The target contains a comprehensive SubTypeValidator class with a blacklist that blocks all dangerous gadget classes identified in issues #1680 and #1737, preventing the deserialization-based code execution attack. The fix was authored by tatu.saloranta@iki.fi (upstream maintainer) and shipped in the upstream release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is not present in jackson-databind 2.12.5. The vulnerability was fixed in the upstream release through commits addressing issues #1737 and #1855, which added blacklist entries and pattern-based validation to prevent deserialization of dangerous gadget classes. The fix was already present in upstream version 2.12.5 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 is not present in jackson-databind 2.12.5. The vulnerability was fixed in the upstream release through commits addressing issues #1737 and #1855, which added blacklist entries and pattern-based validation to prevent deserialization of dangerous gadget classes. The fix was already present in upstream version 2.12.5 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability was fixed by upstream in version 2.8.11 through the introduction of SubTypeValidator with a blacklist of dangerous classes. This fix was already present in upstream version 2.9.10.5, which predates the TuxCare branch initialization. The target inherits the complete upstream mitigation through SubTypeValidator.validateSubType() which blocks deserialization of exploit gadget classes including TemplatesImpl, InvokerTransformer, and others listed in CVE-2017-7525.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability was fixed by upstream in version 2.8.11 through the introduction of SubTypeValidator with a blacklist of dangerous classes. This fix was already present in upstream version 2.9.10.5, which predates the TuxCare branch initialization. The target inherits the complete upstream mitigation through SubTypeValidator.validateSubType() which blocks deserialization of exploit gadget classes including TemplatesImpl, InvokerTransformer, and others listed in CVE-2017-7525.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.12.5. The vulnerability involved deserialization of the iBatis XPathParser gadget class when default typing is enabled, allowing data exfiltration via XML external entities. The fix (adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist) was already present in the upstream jackson-databind 2.12.5 release that TuxCare onboarded. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.12.5. The vulnerability involved deserialization of the iBatis XPathParser gadget class when default typing is enabled, allowing data exfiltration via XML external entities. The fix (adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist) was already present in the upstream jackson-databind 2.12.5 release that TuxCare onboarded. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target repository version 2.12.5-tuxcare.3 is significantly newer and already contains the upstream fix. The vulnerability allows arbitrary code execution via deserialization of jodd.db.connection.DataSourceConnectionProvider when Default Typing is enabled. The fix adds this class to SubTypeValidator's blocklist (lines 67-68 of SubTypeValidator.java), blocking deserialization attempts. This fix was authored by tatu.saloranta@iki.fi (upstream maintainer) in commit 7487cf7eb14be2f65a1eb108e8629c07ef45e0a1 and was already present in the upstream 2.12.5 release when TuxCare onboarded it via commit 667347046439b0b79e874a99e617385e382843dc. Therefore, this is an upstream fix that shipped in the vendor's release, not a TuxCare backport. The target is not affected because the vulnerable code pattern (ability to deserialize Jodd class) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target repository version 2.12.5-tuxcare.3 is significantly newer and already contains the upstream fix. The vulnerability allows arbitrary code execution via deserialization of jodd.db.connection.DataSourceConnectionProvider when Default Typing is enabled. The fix adds this class to SubTypeValidator's blocklist (lines 67-68 of SubTypeValidator.java), blocking deserialization attempts. This fix was authored by tatu.saloranta@iki.fi (upstream maintainer) in commit 7487cf7eb14be2f65a1eb108e8629c07ef45e0a1 and was already present in the upstream 2.12.5 release when TuxCare onboarded it via commit 667347046439b0b79e874a99e617385e382843dc. Therefore, this is an upstream fix that shipped in the vendor's release, not a TuxCare backport. The target is not affected because the vulnerable code pattern (ability to deserialize Jodd class) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target repository is jackson-databind version 2.12.5-tuxcare.3, which already contains the upstream fix that blocks polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet). The fix was present in the upstream 2.12.5 release before TuxCare onboarded it, authored by upstream maintainer Tatu Saloranta. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target repository is jackson-databind version 2.12.5-tuxcare.3, which already contains the upstream fix that blocks polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet). The fix was present in the upstream 2.12.5 release before TuxCare onboarded it, authored by upstream maintainer Tatu Saloranta. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 affects jackson-databind versions before 2.9.7. The target is version 2.12.5-tuxcare.3, which is well after the fixed version. The upstream fix (adding org.slf4j.ext.EventData and three other classes to the deserialization blocklist) shipped with upstream version 2.12.5 and is present in SubTypeValidator.java lines 75-78. The blocklist is actively enforced via SubTypeValidator.validateSubType() during polymorphic deserialization, blocking the dangerous classes before instantiation. The vulnerability is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 affects jackson-databind versions before 2.9.7. The target is version 2.12.5-tuxcare.3, which is well after the fixed version. The upstream fix (adding org.slf4j.ext.EventData and three other classes to the deserialization blocklist) shipped with upstream version 2.12.5 and is present in SubTypeValidator.java lines 75-78. The blocklist is actively enforced via SubTypeValidator.validateSubType() during polymorphic deserialization, blocking the dangerous classes before instantiation. The vulnerability is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.5-tuxcare.3 is NOT AFFECTED by CVE-2018-14719. The upstream vendor (Tatu Saloranta) already applied the fix in commit 0899726ec34 on 2018-08-16, which blocks the blaze-ds class `flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor` from polymorphic deserialization. This fix was included in the upstream 2.12.5 release that TuxCare onboarded, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "Target jackson-databind 2.12.5-tuxcare.3 is NOT AFFECTED by CVE-2018-14719. The upstream vendor (Tatu Saloranta) already applied the fix in commit 0899726ec34 on 2018-08-16, which blocks the blaze-ds class `flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor` from polymorphic deserialization. This fix was included in the upstream 2.12.5 release that TuxCare onboarded, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.12.5. The vulnerability required adding four dangerous classes to the polymorphic deserialization blocklist. This fix was applied by upstream maintainer Tatu Saloranta in commit 0899726ec34 on 2018-08-16 and shipped with the upstream 2.12.5 release. The target repository inherited this fix when version 2.12.5 was onboarded. All four vulnerable classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in the blocklist at SubTypeValidator.java lines 75-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.12.5. The vulnerability required adding four dangerous classes to the polymorphic deserialization blocklist. This fix was applied by upstream maintainer Tatu Saloranta in commit 0899726ec34 on 2018-08-16 and shipped with the upstream 2.12.5 release. The target repository inherited this fix when version 2.12.5 was onboarded. All four vulnerable classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in the blocklist at SubTypeValidator.java lines 75-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 affects jackson-databind 2.x before 2.9.7 by allowing SSRF attacks through polymorphic deserialization of the axis2-jaxws class. The target (jackson-databind 2.12.5-tuxcare.3) is not vulnerable because the fix was already included in the upstream 2.12.5 release. The dangerous class \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" is present in the deserialization blocklist at SubTypeValidator.java:78, preventing its instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af and shipped with the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 affects jackson-databind 2.x before 2.9.7 by allowing SSRF attacks through polymorphic deserialization of the axis2-jaxws class. The target (jackson-databind 2.12.5-tuxcare.3) is not vulnerable because the fix was already included in the upstream 2.12.5 release. The dangerous class \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" is present in the deserialization blocklist at SubTypeValidator.java:78, preventing its instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af and shipped with the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is not present in jackson-databind 2.12.5-tuxcare.2. The vulnerability was fixed in upstream version 2.9.8 (released November 2018) via commit 72cd4025a2 by adding org.apache.axis2.transport.jms.JMSOutTransportInfo to the polymorphic deserialization blocklist. The target version 2.12.5 already contains this fix as part of the upstream release that TuxCare onboarded. The blocklist entry is present at SubTypeValidator.java:85 and is properly enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 is not present in jackson-databind 2.12.5-tuxcare.2. The vulnerability was fixed in upstream version 2.9.8 (released November 2018) via commit 72cd4025a2 by adding org.apache.axis2.transport.jms.JMSOutTransportInfo to the polymorphic deserialization blocklist. The target version 2.12.5 already contains this fix as part of the upstream release that TuxCare onboarded. The blocklist entry is present at SubTypeValidator.java:85 and is properly enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for openjpa classes in polymorphic deserialization. The target version 2.12.5-tuxcare.3 already contains the upstream fix (commit 72cd4025a2) that was released in jackson-databind 2.9.8 on November 19, 2018. The vulnerable code pattern (absence of openjpa blocklist entries) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for openjpa classes in polymorphic deserialization. The target version 2.12.5-tuxcare.3 already contains the upstream fix (commit 72cd4025a2) that was released in jackson-databind 2.9.8 on November 19, 2018. The vulnerable code pattern (absence of openjpa blocklist entries) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability concerns the failure to block org.jboss.util.propertyeditor.DocumentEditor from polymorphic deserialization. The fix (adding this class and 3 others to the blacklist in SubTypeValidator.java) was already included in the upstream 2.12.5 release by FasterXML maintainer Tatu Saloranta in November 2018, nearly 3 years before TuxCare onboarded this version in June 2021. The defense is present at SubTypeValidator.java lines 81-85.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability concerns the failure to block org.jboss.util.propertyeditor.DocumentEditor from polymorphic deserialization. The fix (adding this class and 3 others to the blacklist in SubTypeValidator.java) was already included in the upstream 2.12.5 release by FasterXML maintainer Tatu Saloranta in November 2018, nearly 3 years before TuxCare onboarded this version in June 2021. The defense is present at SubTypeValidator.java lines 81-85.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.5 is not affected by CVE-2018-5968. The upstream fix (commit 038b471e2e) that blacklists the two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) was already present in the upstream jackson-databind 2.12.5 release before TuxCare onboarded it. Both classes are confirmed present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist at SubTypeValidator.java lines 62-63.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "Target version 2.12.5 is not affected by CVE-2018-5968. The upstream fix (commit 038b471e2e) that blacklists the two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) was already present in the upstream jackson-databind 2.12.5 release before TuxCare onboarded it. Both classes are confirmed present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist at SubTypeValidator.java lines 62-63.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involves remote code execution via deserialization of c3p0 DataSource gadgets when default typing is enabled. The fix blocking c3p0.*DataSource classes was already present in the upstream 2.12.5 release (commit 6799f8f by tatu.saloranta@iki.fi, Feb 2018) before TuxCare onboarded this version. The defense at SubTypeValidator.java:288-298 blocks all known c3p0 gadgets (ComboPooledDataSource, JndiRefForwardingDataSource, WrapperConnectionPoolDataSource, AfterCloseLoggingComboPooledDataSource) via pattern matching: any class starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\" is rejected during type validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involves remote code execution via deserialization of c3p0 DataSource gadgets when default typing is enabled. The fix blocking c3p0.*DataSource classes was already present in the upstream 2.12.5 release (commit 6799f8f by tatu.saloranta@iki.fi, Feb 2018) before TuxCare onboarded this version. The defense at SubTypeValidator.java:288-298 blocks all known c3p0 gadgets (ComboPooledDataSource, JndiRefForwardingDataSource, WrapperConnectionPoolDataSource, AfterCloseLoggingComboPooledDataSource) via pattern matching: any class starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\" is rejected during type validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.12.5 is not affected by CVE-2019-12086. The vulnerability affected versions before 2.9.9, requiring validation of com.mysql.cj.jdbc.admin.MiniAdmin to prevent arbitrary file reads via crafted JSON with polymorphic typing. The upstream fix (blocklist entry at SubTypeValidator.java:88) was already present in the jackson-databind 2.12.5 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta on 2019-05-14 in commit dda513bd72, predating the first TuxCare commit (onboarding 667347046 by amoniatovskiy@cloudlinux.com).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "Target jackson-databind version 2.12.5 is not affected by CVE-2019-12086. The vulnerability affected versions before 2.9.9, requiring validation of com.mysql.cj.jdbc.admin.MiniAdmin to prevent arbitrary file reads via crafted JSON with polymorphic typing. The upstream fix (blocklist entry at SubTypeValidator.java:88) was already present in the jackson-databind 2.12.5 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta on 2019-05-14 in commit dda513bd72, predating the first TuxCare commit (onboarding 667347046 by amoniatovskiy@cloudlinux.com).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability concerns polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to arbitrary code execution. The fix (adding this class to the deserialization blocklist) was authored by upstream maintainer Tatu Saloranta in commit c9ef4a10d6 on June 12, 201...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability concerns polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to arbitrary code execution. The fix (adding this class to the deserialization blocklist) was authored by upstream maintainer Tatu Saloranta in commit c9ef4a10d6 on June 12, 201..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.12.5-tuxcare.3 is not affected by CVE-2019-12814. The vulnerability, which allowed arbitrary file read via JDOM XSLTransformer deserialization gadgets when Default Typing is enabled, was fixed in the upstream release. The fix commit 5f7c69bba0 by upstream maintainer Tatu Saloranta added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind 2.12.5-tuxcare.3 is not affected by CVE-2019-12814. The vulnerability, which allowed arbitrary file read via JDOM XSLTransformer deserialization gadgets when Default Typing is enabled, was fixed in the upstream release. The fix commit 5f7c69bba0 by upstream maintainer Tatu Saloranta added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 affects jackson-databind versions before 2.9.9.2, 2.8.11.4, and 2.7.9.6. The target repository is version 2.12.5-tuxcare.2, which already contains the upstream fix. The dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) are already blacklisted in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and was present in the upstream release 2.12.5 when TuxCare onboarded the project.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 affects jackson-databind versions before 2.9.9.2, 2.8.11.4, and 2.7.9.6. The target repository is version 2.12.5-tuxcare.2, which already contains the upstream fix. The dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) are already blacklisted in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and was present in the upstream release 2.12.5 when TuxCare onboarded the project.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in jackson-databind 2.12.5-tuxcare.3. The fix (adding ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blocklist) was already included in the upstream jackson-databind 2.12.5 release. The target inherited this fix when TuxCare onboarded version 2.12.5 in commit 667347046439b0b79e874a99e617385e382843dc. The vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is NOT present in jackson-databind 2.12.5-tuxcare.3. The fix (adding ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blocklist) was already included in the upstream jackson-databind 2.12.5 release. The target inherited this fix when TuxCare onboarded version 2.12.5 in commit 667347046439b0b79e874a99e617385e382843dc. The vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10/2.8.11.5/2.6.7.3 due to a polymorphic deserialization vulnerability involving com.zaxxer.hikari.HikariConfig and HikariDataSource gadget classes. The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT AFFECTED because the upstream vendor fixes (commits d4983c740f and 73c1c2cc76 by Tatu Saloranta) were already included in the upstream release 2.12.5 before TuxCare onboarded it. The SubTypeValidator.java file contains both required blocklist entries (lines 105, 107) that prevent deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10/2.8.11.5/2.6.7.3 due to a polymorphic deserialization vulnerability involving com.zaxxer.hikari.HikariConfig and HikariDataSource gadget classes. The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT AFFECTED because the upstream vendor fixes (commits d4983c740f and 73c1c2cc76 by Tatu Saloranta) were already included in the upstream release 2.12.5 before TuxCare onboarded it. The SubTypeValidator.java file contains both required blocklist entries (lines 105, 107) that prevent deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involved polymorphic deserialization of malicious commons-configuration 1 and 2 JNDI classes that could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in version 2.9.10 by adding two class names to a deny-list in SubTypeValidator.java: org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration. Since the target version 2.12.5 is later than 2.9.10, the fix was already present in the upstream release that TuxCare onboarded. The fix commit (41b7f9b90149e9d44a65a8261a8deedc7186f6af) by upstream author Tatu Saloranta is an ancestor of the first TuxCare commit (onboarding commit 667347046439b0b79e874a99e617385e382843dc), confirming this is an upstream fix shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involved polymorphic deserialization of malicious commons-configuration 1 and 2 JNDI classes that could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in version 2.9.10 by adding two class names to a deny-list in SubTypeValidator.java: org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration. Since the target version 2.12.5 is later than 2.9.10, the fix was already present in the upstream release that TuxCare onboarded. The fix commit (41b7f9b90149e9d44a65a8261a8deedc7186f6af) by upstream author Tatu Saloranta is an ancestor of the first TuxCare commit (onboarding commit 667347046439b0b79e874a99e617385e382843dc), confirming this is an upstream fix shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT affected by CVE-2019-14893. The vulnerability involves polymorphic deserialization of the malicious xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) that could lead to arbitrary code execution. The fix was implemented in upstream commit 998efd708284778f29d83d7962a9bd935c228317 by adding this class to the SubTypeValidator blocklist. This fix was already present in jackson-databind 2.12.5 when TuxCare onboarded it, making the target safe from this attack vector. The blocklist is enforced through a mandatory validation step during deserialization that cannot be bypassed or disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT affected by CVE-2019-14893. The vulnerability involves polymorphic deserialization of the malicious xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) that could lead to arbitrary code execution. The fix was implemented in upstream commit 998efd708284778f29d83d7962a9bd935c228317 by adding this class to the SubTypeValidator blocklist. This fix was already present in jackson-databind 2.12.5 when TuxCare onboarded it, making the target safe from this attack vector. The blocklist is enforced through a mandatory validation step during deserialization that cannot be bypassed or disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The vulnerability allows deserialization of com.zaxxer.hikari.HikariDataSource through polymorphic typing. The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT vulnerable because the fix was already present in the upstream 2.12.5 release that TuxCare onboarded. The blacklist entry for HikariDataSource exists at SubTypeValidator.java:107, added by upstream commit 73c1c2cc76 authored by Tatu Saloranta (tatu.saloranta@iki.fi). Since this fix was part of the original upstream release and not a TuxCare backport, the verdict is not_affected with code_not_present justification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The vulnerability allows deserialization of com.zaxxer.hikari.HikariDataSource through polymorphic typing. The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT vulnerable because the fix was already present in the upstream 2.12.5 release that TuxCare onboarded. The blacklist entry for HikariDataSource exists at SubTypeValidator.java:107, added by upstream commit 73c1c2cc76 authored by Tatu Saloranta (tatu.saloranta@iki.fi). Since this fix was part of the original upstream release and not a TuxCare backport, the verdict is not_affected with code_not_present justification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability was fixed by upstream FasterXML in version 2.10.1 (released September 2019), which added blocklist entries for org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource to SubTypeValidator. The target version 2.12.5, onboarded by TuxCare in its already-patched state, inherited this fix from upstream. The dangerous classes cannot be deserialized when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability was fixed by upstream FasterXML in version 2.10.1 (released September 2019), which added blocklist entries for org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource to SubTypeValidator. The target version 2.12.5, onboarded by TuxCare in its already-patched state, inherited this fix from upstream. The dangerous classes cannot be deserialized when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involved deserialization gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp classes) that could enable arbitrary code execution when Default Typing was enabled. The fix\u2014adding these classes to a deserialization blocklist in SubTypeValidator.java\u2014was included in the upstream jackson-databind 2.12.5 release (commit 9593e16cf5 by upstream maintainer Tatu Saloranta). The blocklist entries are present at lines 124-127 of SubTypeValidator.java, and the validator is actively enforced during bean deserialization. This is an upstream fix that shipped in the release TuxCare onboarded, not a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involved deserialization gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp classes) that could enable arbitrary code execution when Default Typing was enabled. The fix\u2014adding these classes to a deserialization blocklist in SubTypeValidator.java\u2014was included in the upstream jackson-databind 2.12.5 release (commit 9593e16cf5 by upstream maintainer Tatu Saloranta). The blocklist entries are present at lines 124-127 of SubTypeValidator.java, and the validator is actively enforced during bean deserialization. This is an upstream fix that shipped in the release TuxCare onboarded, not a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5, related to polymorphic deserialization of net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.12.5-tuxcare.3) already contains the upstream vendor fix in SubTypeValidator.java line 99, which blocks this dangerous class from being deserialized. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 191a4cdf87b and was already present in the upstream 2.12.5 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5, related to polymorphic deserialization of net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.12.5-tuxcare.3) already contains the upstream vendor fix in SubTypeValidator.java line 99, which blocks this dangerous class from being deserialized. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 191a4cdf87b and was already present in the upstream 2.12.5 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.12.5-tuxcare.3 is NOT affected by CVE-2019-17531. The vulnerability was fixed in the upstream release 2.12.5 by commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 (authored by Tatu Saloranta), which added the dangerous log4j-extras classes to the deserialization blocklist. This fix was already present when TuxCare onboarded version 2.12.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "The target repository jackson-databind 2.12.5-tuxcare.3 is NOT affected by CVE-2019-17531. The vulnerability was fixed in the upstream release 2.12.5 by commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 (authored by Tatu Saloranta), which added the dangerous log4j-extras classes to the deserialization blocklist. This fix was already present when TuxCare onboarded version 2.12.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT affected by CVE-2019-20330. The vulnerability involves missing deserialization blacklist entries for two net.sf.ehcache classes (GenericJndiSelector and GlassfishSelector) that could enable remote code execution via JNDI injection gadget chains. The fix blocking these classes was already present in the upstream Jackson 2.12.5 release (commit eb254813cc by upstream maintainer Tatu Saloranta), which TuxCare onboarded. Lines 133-135 of SubTypeValidator.java contain the required blacklist entries, preventing the vulnerable deserialization pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT affected by CVE-2019-20330. The vulnerability involves missing deserialization blacklist entries for two net.sf.ehcache classes (GenericJndiSelector and GlassfishSelector) that could enable remote code execution via JNDI injection gadget chains. The fix blocking these classes was already present in the upstream Jackson 2.12.5 release (commit eb254813cc by upstream maintainer Tatu Saloranta), which TuxCare onboarded. Lines 133-135 of SubTypeValidator.java contain the required blacklist entries, preventing the vulnerable deserialization pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650: Target is NOT AFFECTED. The fix for CVE-2020-10650 (blocking deserialization of ignite-jta JNDI gadget classes) is present in the target repository at SubTypeValidator.java:157-160. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the jackson-databind 2.12.5 upstream release that TuxCare onboarded. The three dangerous classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) are blacklisted in DEFAULT_NO_DESER_CLASS_NAMES, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650: Target is NOT AFFECTED. The fix for CVE-2020-10650 (blocking deserialization of ignite-jta JNDI gadget classes) is present in the target repository at SubTypeValidator.java:157-160. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the jackson-databind 2.12.5 upstream release that TuxCare onboarded. The three dangerous classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) are blacklisted in DEFAULT_NO_DESER_CLASS_NAMES, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability affects versions before 2.9.10.4, and the fix was already included in the upstream release 2.12.5 that TuxCare onboarded. The vulnerable gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory is properly blocked in SubTypeValidator.java (lines 162-164), preventing deserialization attacks. This is an upstream fix by FasterXML maintainer Tatu Saloranta (commit 592872f423), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability affects versions before 2.9.10.4, and the fix was already included in the upstream release 2.12.5 that TuxCare onboarded. The vulnerable gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory is properly blocked in SubTypeValidator.java (lines 162-164), preventing deserialization attacks. This is an upstream fix by FasterXML maintainer Tatu Saloranta (commit 592872f423), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability concerns unsafe deserialization of com.caucho.config.types.ResourceRef, which can lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 1645efbd392989cf015f459a91c999e59c921b15 by adding the class to the SubTypeValidator denylist. This fix was included in upstream release 2.12.5, which TuxCare onboarded with the fix already present. The vulnerable code pattern (unblocked deserialization of this gadget class) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability concerns unsafe deserialization of com.caucho.config.types.ResourceRef, which can lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 1645efbd392989cf015f459a91c999e59c921b15 by adding the class to the SubTypeValidator denylist. This fix was included in upstream release 2.12.5, which TuxCare onboarded with the fix already present. The vulnerable code pattern (unblocked deserialization of this gadget class) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entries for deserialization gadgets org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.12.5-tuxcare.3) is not affected because the upstream fix was already present in the 2.12.5 release that TuxCare onboarded. The fix commit 05d7e0e13f by upstream author Tatu Saloranta added both gadget classes to the SubTypeValidator deny-list (lines 170-171), preventing their deserialization with the error message \"Illegal type (...) to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entries for deserialization gadgets org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.12.5-tuxcare.3) is not affected because the upstream fix was already present in the 2.12.5 release that TuxCare onboarded. The fix commit 05d7e0e13f by upstream author Tatu Saloranta added both gadget classes to the SubTypeValidator deny-list (lines 170-171), preventing their deserialization with the error message \"Illegal type (...) to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.5-tuxcare.3 is NOT AFFECTED by CVE-2020-10969. The vulnerability relates to unsafe deserialization of javax.swing.JEditorPane class as a serialization gadget. The fix (blocklisting JEditorPane in SubTypeValidator) was already present in upstream version 2.12.5 when TuxCare onboarded it. The vulnerable code pattern does not exist in the target because the upstream vendor (FasterXML) applied the fix in commit 6ba48457 before TuxCare's first commit. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "Target version 2.12.5-tuxcare.3 is NOT AFFECTED by CVE-2020-10969. The vulnerability relates to unsafe deserialization of javax.swing.JEditorPane class as a serialization gadget. The fix (blocklisting JEditorPane in SubTypeValidator) was already present in upstream version 2.12.5 when TuxCare onboarded it. The vulnerable code pattern does not exist in the target because the upstream vendor (FasterXML) applied the fix in commit 6ba48457 before TuxCare's first commit. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.12.5-tuxcare.3, which already contains the upstream fix (commit c14c9f99) that blocks deserialization of all activemq connection factory classes identified in the CVE. The fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream 2.12.5 release before TuxCare onboarded this version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.12.5-tuxcare.3, which already contains the upstream fix (commit c14c9f99) that blocks deserialization of all activemq connection factory classes identified in the CVE. The fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream 2.12.5 release before TuxCare onboarded this version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.5-tuxcare.3 is NOT AFFECTED by CVE-2020-11112. The vulnerability involves deserialization of the malicious gadget class org.apache.commons.proxy.provider.remoting.RmiProvider, which could lead to remote code execution. The fix (blacklisting this class in SubTypeValidator) was authored by upstream vendor Tatu Saloranta and was already present in upstream release 2.12.5 when TuxCare onboarded it. The vulnerable pattern is not present in the target because the upstream fix removed it before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "The target jackson-databind 2.12.5-tuxcare.3 is NOT AFFECTED by CVE-2020-11112. The vulnerability involves deserialization of the malicious gadget class org.apache.commons.proxy.provider.remoting.RmiProvider, which could lead to remote code execution. The fix (blacklisting this class in SubTypeValidator) was authored by upstream vendor Tatu Saloranta and was already present in upstream release 2.12.5 when TuxCare onboarded it. The vulnerable pattern is not present in the target because the upstream fix removed it before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.5-tuxcare.3 is NOT affected by CVE-2020-11113. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime, which could enable code execution. The upstream FasterXML project added this class to the SubTypeValidator blocklist in commit e2ba12d5d60715d95105e3e790fc234cfb59893d (authored by Tatu Saloranta on 2020-03-28). This fix was already included in the upstream 2.12.5 release that TuxCare onboarded on 2026-09-20. The vulnerable code pattern is not present in the target because the upstream vendor's fix shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "The target jackson-databind 2.12.5-tuxcare.3 is NOT affected by CVE-2020-11113. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime, which could enable code execution. The upstream FasterXML project added this class to the SubTypeValidator blocklist in commit e2ba12d5d60715d95105e3e790fc234cfb59893d (authored by Tatu Saloranta on 2020-03-28). This fix was already included in the upstream 2.12.5 release that TuxCare onboarded on 2026-09-20. The vulnerable code pattern is not present in the target because the upstream vendor's fix shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.5-tuxcare.3 is NOT vulnerable to CVE-2020-11619. The fix that adds MethodLocatingFactoryBean and BeanReferenceFactoryBean to the deserialization blacklist is already present in SubTypeValidator.java (lines 52-54). This fix was applied by upstream maintainer Tatu Saloranta in commit 113e89fb08 and was already included in the upstream release before TuxCare's first commit. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "The target jackson-databind version 2.12.5-tuxcare.3 is NOT vulnerable to CVE-2020-11619. The fix that adds MethodLocatingFactoryBean and BeanReferenceFactoryBean to the deserialization blacklist is already present in SubTypeValidator.java (lines 52-54). This fix was applied by upstream maintainer Tatu Saloranta in commit 113e89fb08 and was already included in the upstream release before TuxCare's first commit. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.5-tuxcare.3 is NOT vulnerable to CVE-2020-11620. The fix for this vulnerability was already present in the upstream release 2.12.5 that TuxCare onboarded. The fix adds \"org.apache.commons.jelly.impl.Embedded\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 189), preventing deserialization of this dangerous gadget class. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commits 77040d85e3 and 08fbfacf89, which are both ancestors of the first TuxCare commit (667347046439b0b79e874a99e617385e382843dc \"Onboard version 2.12.5\"). The validator is actively enforced during deserialization via BeanDeserializerFactory, blocking any attempt to instantiate the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "The target jackson-databind version 2.12.5-tuxcare.3 is NOT vulnerable to CVE-2020-11620. The fix for this vulnerability was already present in the upstream release 2.12.5 that TuxCare onboarded. The fix adds \"org.apache.commons.jelly.impl.Embedded\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 189), preventing deserialization of this dangerous gadget class. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commits 77040d85e3 and 08fbfacf89, which are both ancestors of the first TuxCare commit (667347046439b0b79e874a99e617385e382843dc \"Onboard version 2.12.5\"). The validator is actively enforced during deserialization via BeanDeserializerFactory, blocking any attempt to instantiate the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is NOT AFFECTING jackson-databind 2.12.5-tuxcare.3. The vulnerability involves deserialization of the gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool to achieve arbitrary code execution via JNDI injection. The fix was already present in the upstream jackson-databind 2.12.5 release, authored by Tatu Saloranta (upstream maintainer) in commit d1c67a0396e. The SubTypeValidator blocklist contains four variants of the vulnerable class (lines 117, 192, 240, 243), preventing their deserialization. No TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 is NOT AFFECTING jackson-databind 2.12.5-tuxcare.3. The vulnerability involves deserialization of the gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool to achieve arbitrary code execution via JNDI injection. The fix was already present in the upstream jackson-databind 2.12.5 release, authored by Tatu Saloranta (upstream maintainer) in commit d1c67a0396e. The SubTypeValidator blocklist contains four variants of the vulnerable class (lines 117, 192, 240, 243), preventing their deserialization. No TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involves deserialization of oracle.jms gadget classes to achieve code execution. The upstream fix (commit 5c8642aeae by Tatu Saloranta, April 2020) added these five classes to the SubTypeValidator blacklist, blocking them from deserialization. This fix was already included in the upstream jackson-databind 2.12.5 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare commit (667347046439 \"Onboard version 2.12.5\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involves deserialization of oracle.jms gadget classes to achieve code execution. The upstream fix (commit 5c8642aeae by Tatu Saloranta, April 2020) added these five classes to the SubTypeValidator blacklist, blocking them from deserialization. This fix was already included in the upstream jackson-databind 2.12.5 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare commit (667347046439 \"Onboard version 2.12.5\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involves deserialization of the dangerous gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool, which can lead to JNDI injection and remote code execution. The fix, which blacklists this class in SubTypeValidator, was authored by upstream maintainer Tatu Saloranta (commit 840eae2ca81) on 2020-05-01 and was already included in the upstream jackson-databind 2.12.5 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involves deserialization of the dangerous gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool, which can lead to JNDI injection and remote code execution. The fix, which blacklists this class in SubTypeValidator, was authored by upstream maintainer Tatu Saloranta (commit 840eae2ca81) on 2020-05-01 and was already included in the upstream jackson-databind 2.12.5 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to missing blocklist entry for the org.jsecurity.realm.jndi.JndiRealmFactory deserialization gadget. The target (version 2.12.5-tuxcare.3) contains the upstream fix that was already present in the 2.12.5 release before TuxCare onboarding. The blocklist entry exists at SubTypeValidator.java:207 and is actively enforced during deserialization via BeanDeserializerFactory, preventing exploitation of this JNDI injection gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to missing blocklist entry for the org.jsecurity.realm.jndi.JndiRealmFactory deserialization gadget. The target (version 2.12.5-tuxcare.3) contains the upstream fix that was already present in the 2.12.5 release before TuxCare onboarding. The blocklist entry exists at SubTypeValidator.java:207 and is actively enforced during deserialization via BeanDeserializerFactory, preventing exploitation of this JNDI injection gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is not applicable to jackson-databind 2.12.5-tuxcare.3. The fix blocking deserialization of br.com.anteros.dbcp.AnterosDBCPDataSource was already included in the upstream 2.12.5 release before TuxCare onboarded it. The SubTypeValidator.java file at line 147 contains the protection: s.add(\"br.com.anteros.dbcp.AnterosDBCPDataSource\"). This prevents exploitation of the serialization gadget vulnerability described in CVE-2020-24616.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 is not applicable to jackson-databind 2.12.5-tuxcare.3. The fix blocking deserialization of br.com.anteros.dbcp.AnterosDBCPDataSource was already included in the upstream 2.12.5 release before TuxCare onboarded it. The SubTypeValidator.java file at line 147 contains the protection: s.add(\"br.com.anteros.dbcp.AnterosDBCPDataSource\"). This prevents exploitation of the serialization gadget vulnerability described in CVE-2020-24616.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is NOT present in jackson-databind 2.12.5. The vulnerability involves the deserialization gadget class `com.pastdev.httpcomponents.configuration.JndiConfiguration` which can be exploited for JNDI injection leading to remote code execution. The upstream fix (adding this class to the deserialization blacklist in SubTypeValidator.java) was included in version 2.9.10.6 (Aug 2020) and is present in the target version 2.12.5. The blacklist entry exists at line 210 with the comment \"[databind#2798]\" and effectively blocks deserialization attempts of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 is NOT present in jackson-databind 2.12.5. The vulnerability involves the deserialization gadget class `com.pastdev.httpcomponents.configuration.JndiConfiguration` which can be exploited for JNDI injection leading to remote code execution. The upstream fix (adding this class to the deserialization blacklist in SubTypeValidator.java) was included in version 2.9.10.6 (Aug 2020) and is present in the target version 2.12.5. The blacklist entry exists at line 210 with the comment \"[databind#2798]\" and effectively blocks deserialization attempts of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.12.5-tuxcare.3. The upstream fix commits (612f971b78 and 3d932709ab) were already included in the 2.12.5 release that TuxCare onboarded. The defense code that disallows DOCTYPE declarations and prevents loading external DTDs is present at DOMDeserializer.java lines 43-49.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.12.5-tuxcare.3. The upstream fix commits (612f971b78 and 3d932709ab) were already included in the 2.12.5 release that TuxCare onboarded. The defense code that disallows DOCTYPE declarations and prevents loading external DTDs is present at DOMDeserializer.java lines 43-49.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.5-tuxcare.3 is NOT AFFECTED by CVE-2020-35490. The vulnerable pattern (ability to deserialize org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource as gadget classes) is absent because these classes are blocked in the DEFAULT_NO_DESER_CLASS_NAMES set. The fix was added by upstream vendor Tatu Saloranta in commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d (upstream issue #2986), which was already included in the upstream 2.12.5 release that TuxCare onboarded in commit 667347046439b0b79e874a99e617385e382843dc.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "The target jackson-databind 2.12.5-tuxcare.3 is NOT AFFECTED by CVE-2020-35490. The vulnerable pattern (ability to deserialize org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource as gadget classes) is absent because these classes are blocked in the DEFAULT_NO_DESER_CLASS_NAMES set. The fix was added by upstream vendor Tatu Saloranta in commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d (upstream issue #2986), which was already included in the upstream 2.12.5 release that TuxCare onboarded in commit 667347046439b0b79e874a99e617385e382843dc.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is NOT present in jackson-databind 2.12.5. The vulnerability involves deserialization gadgets related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The fix was committed to the upstream FasterXML repository on December 15, 2020 (commit 41b8bdb5cc) and shipped in upstream version 2.9.10.8. Since version 2.12.5 was released on August 26, 2021 (8 months after the fix), it already contains the upstream fix. The target repository's onboarded 2.12.5 includes this fix, with both dbcp2 datasource classes properly blocklisted in SubTypeValidator.java lines 217-218. No TuxCare backport was needed for 2.12.x versions as the upstream release already contained the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 is NOT present in jackson-databind 2.12.5. The vulnerability involves deserialization gadgets related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The fix was committed to the upstream FasterXML repository on December 15, 2020 (commit 41b8bdb5cc) and shipped in upstream version 2.9.10.8. Since version 2.12.5 was released on August 26, 2021 (8 months after the fix), it already contains the upstream fix. The target repository's onboarded 2.12.5 includes this fix, with both dbcp2 datasource classes properly blocklisted in SubTypeValidator.java lines 217-218. No TuxCare backport was needed for 2.12.x versions as the upstream release already contained the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerable deserialization gadget class 'com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool' is already blacklisted in SubTypeValidator.java (line 240) as part of the DEFAULT_NO_DESER_CLASS_NAMES set. This fix was shipped in upstream release 2.12.5, which was onboarded into the TuxCare repository. The blacklist is actively enforced during polymorphic type validation (line 269), preventing deserialization of the gadget class and blocking the JNDI injection attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerable deserialization gadget class 'com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool' is already blacklisted in SubTypeValidator.java (line 240) as part of the DEFAULT_NO_DESER_CLASS_NAMES set. This fix was shipped in upstream release 2.12.5, which was onboarded into the TuxCare repository. The blacklist is actively enforced during polymorphic type validation (line 269), preventing deserialization of the gadget class and blocking the JNDI injection attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involves deserialization of dangerous DBCP DriverAdapterCPDS gadget classes that enable JNDI injection. The fix (commit 3ded28aece by upstream maintainer Tatu Saloranta) added five DriverAdapterCPDS class variants to SubTypeValidator's no-deserialize blocklist. All five blocklist entries are present in the target at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, with comments referencing issue [databind#3004]. This fix was already included in the upstream 2.12.5 release when TuxCare onboarded it (first TuxCare commit 667347046 \"Onboard version 2.12.5\" is a descendant of the fix commit). The vulnerable pattern was never present in this shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involves deserialization of dangerous DBCP DriverAdapterCPDS gadget classes that enable JNDI injection. The fix (commit 3ded28aece by upstream maintainer Tatu Saloranta) added five DriverAdapterCPDS class variants to SubTypeValidator's no-deserialize blocklist. All five blocklist entries are present in the target at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, with comments referencing issue [databind#3004]. This fix was already included in the upstream 2.12.5 release when TuxCare onboarded it (first TuxCare commit 667347046 \"Onboard version 2.12.5\" is a descendant of the fix commit). The vulnerable pattern was never present in this shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is not affecting this target. The vulnerability relates to jackson-databind's improper handling of the deserialization gadget class org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS. The fix for this vulnerability was already present in the upstream jackson-databind 2.12.5 release (commit 3ded28aece by Tatu Saloranta), which was onboarded by TuxCare. The malicious class is blocked in SubTypeValidator.java at line 219, preventing its deserialization and thus eliminating the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 is not affecting this target. The vulnerability relates to jackson-databind's improper handling of the deserialization gadget class org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS. The fix for this vulnerability was already present in the upstream jackson-databind 2.12.5 release (commit 3ded28aece by Tatu Saloranta), which was onboarded by TuxCare. The malicious class is blocked in SubTypeValidator.java at line 219, preventing its deserialization and thus eliminating the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involves polymorphic deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS and related classes to achieve code execution via gadget chains. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) added all DriverAdapterCPDS class name variants to the SubTypeValidator blacklist, blocking deserialization. This fix was already present in upstream jackson-databind 2.12.5 (released 2021-08-26, well after the Dec 2020 fix). When TuxCare onboarded version 2.12.5, the fix came with it. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability involves polymorphic deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS and related classes to achieve code execution via gadget chains. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) added all DriverAdapterCPDS class name variants to the SubTypeValidator blacklist, blocking deserialization. This fix was already present in upstream jackson-databind 2.12.5 (released 2021-08-26, well after the Dec 2020 fix). When TuxCare onboarded version 2.12.5, the fix came with it. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.5-tuxcare.3 is NOT vulnerable to CVE-2020-36182. The vulnerability concerns deserialization of dangerous DriverAdapterCPDS gadget classes that can lead to remote code execution. The fix (adding these classes to the deserialization blocklist in SubTypeValidator.java) was already present in upstream jackson-databind 2.12.5 when TuxCare onboarded it. Fix commit 3ded28aece by upstream author Tatu Saloranta shipped in the upstream release before TuxCare's first onboarding commit. All five DriverAdapterCPDS variants mentioned in the CVE and patches are present in the blocklist at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "Target jackson-databind 2.12.5-tuxcare.3 is NOT vulnerable to CVE-2020-36182. The vulnerability concerns deserialization of dangerous DriverAdapterCPDS gadget classes that can lead to remote code execution. The fix (adding these classes to the deserialization blocklist in SubTypeValidator.java) was already present in upstream jackson-databind 2.12.5 when TuxCare onboarded it. Fix commit 3ded28aece by upstream author Tatu Saloranta shipped in the upstream release before TuxCare's first onboarding commit. All five DriverAdapterCPDS variants mentioned in the CVE and patches are present in the blocklist at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is NOT affecting jackson-databind 2.12.5-tuxcare.3. The vulnerability involves deserialization of the dangerous gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool that enables JNDI injection attacks. The fix (adding this class to the deserialization blacklist) was already present in the upstream 2.12.5 release that TuxCare onboarded. The vulnerable pattern is not present in the target because it was removed by the upstream vendor (Tatu Saloranta) before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 is NOT affecting jackson-databind 2.12.5-tuxcare.3. The vulnerability involves deserialization of the dangerous gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool that enables JNDI injection attacks. The fix (adding this class to the deserialization blacklist) was already present in the upstream 2.12.5 release that TuxCare onboarded. The vulnerable pattern is not present in the target because it was removed by the upstream vendor (Tatu Saloranta) before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.12.5-tuxcare.2. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes (PerUserPoolDataSource and SharedPoolDataSource). The upstream fix (commit 567194c53ae by Tatu Saloranta, 2020-12-26) added these classes to the blocklist in SubTypeValidator.java and was already included in the upstream 2.12.5 release that TuxCare onboarded. The fix is present at HEAD (lines 235-236 of SubTypeValidator.java), preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.12.5-tuxcare.2. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes (PerUserPoolDataSource and SharedPoolDataSource). The upstream fix (commit 567194c53ae by Tatu Saloranta, 2020-12-26) added these classes to the blocklist in SubTypeValidator.java and was already included in the upstream 2.12.5 release that TuxCare onboarded. The fix is present at HEAD (lines 235-236 of SubTypeValidator.java), preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8. The target version 2.12.5-tuxcare.3 already contains the fix from the upstream FasterXML release. The dangerous class org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource is present in the SubTypeValidator blacklist (line 236), preventing its deserialization. This fix was part of the upstream 2.12.5 release when TuxCare onboarded it, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8. The target version 2.12.5-tuxcare.3 already contains the fix from the upstream FasterXML release. The dangerous class org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource is present in the SubTypeValidator blacklist (line 236), preventing its deserialization. This fix was part of the upstream 2.12.5 release when TuxCare onboarded it, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT affected by CVE-2020-36186. The vulnerability allows deserialization of malicious gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource), but these classes are already blocklisted in SubTypeValidator.java. The fix was committed upstream in version 2.9.10.8 by Tatu Saloranta and was already present when TuxCare onboarded version 2.12.5. The vulnerable pattern does not exist in the target because the upstream fix removed it before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT affected by CVE-2020-36186. The vulnerability allows deserialization of malicious gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource), but these classes are already blocklisted in SubTypeValidator.java. The fix was committed upstream in version 2.9.10.8 by Tatu Saloranta and was already present when TuxCare onboarded version 2.12.5. The vulnerable pattern does not exist in the target because the upstream fix removed it before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability relates to unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The fix blocking these classes was already present in the upstream release 2.12.5 that TuxCare onboarded. The target's SubTypeValidator.java contains the required blocklist entries at lines 229-230, preventing deserialization of the vulnerable gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 is NOT present in jackson-databind 2.12.5-tuxcare.3. The vulnerability relates to unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The fix blocking these classes was already present in the upstream release 2.12.5 that TuxCare onboarded. The target's SubTypeValidator.java contains the required blocklist entries at lines 229-230, preventing deserialization of the vulnerable gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5 due to deserialization of the gadget class com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability in version 2.9.10.8, and version 2.12.5 includes this fix. The dangerous classes are blocked by entries in SubTypeValidator.java lines 223-224, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5 due to deserialization of the gadget class com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability in version 2.9.10.8, and version 2.12.5 includes this fix. The dangerous classes are blocked by entries in SubTypeValidator.java lines 223-224, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is not present in jackson-databind 2.12.5. The vulnerability involved unsafe deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.{JNDIConnectionSource,DriverManagerConnectionSource} classes. The upstream fix (blocking these classes in SubTypeValidator) was committed by Tatu Saloranta on 2020-12-26 (commit 33d96c13) and was already included in the upstream 2.12.5 release when TuxCare onboarded it. The blocklist entries are present at SubTypeValidator.java:223-224 and are actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is not present in jackson-databind 2.12.5. The vulnerability involved unsafe deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.{JNDIConnectionSource,DriverManagerConnectionSource} classes. The upstream fix (blocking these classes in SubTypeValidator) was committed by Tatu Saloranta on 2020-12-26 (commit 33d96c13) and was already included in the upstream 2.12.5 release when TuxCare onboarded it. The blocklist entries are present at SubTypeValidator.java:223-224 and are actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.12.5-tuxcare.3 is NOT AFFECTED by CVE-2020-8840. The vulnerability (lack of blocking for org.apache.xbean.propertyeditor.JndiConverter) was fixed in the upstream release 2.12.5, which TuxCare onboarded. The fix adds JndiConverter to the deserialization blocklist in SubTypeValidator.java (line 138), preventing JNDI injection attacks. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "The target repository jackson-databind version 2.12.5-tuxcare.3 is NOT AFFECTED by CVE-2020-8840. The vulnerability (lack of blocking for org.apache.xbean.propertyeditor.JndiConverter) was fixed in the upstream release 2.12.5, which TuxCare onboarded. The fix adds JndiConverter to the deserialization blocklist in SubTypeValidator.java (line 138), preventing JNDI injection attacks. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is not affecting this target. The upstream vendor fix that blocks deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig was already present in jackson-databind 2.12.5 when TuxCare onboarded it. The blacklist entry exists at line 141 of SubTypeValidator.java (commit 1e64db6a2f by Tatu Saloranta), and the validateSubType method properly enforces this blacklist during polymorphic deserialization. The vulnerable code pattern (missing blacklist entry for the shaded HikariConfig gadget) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 is not affecting this target. The upstream vendor fix that blocks deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig was already present in jackson-databind 2.12.5 when TuxCare onboarded it. The blacklist entry exists at line 141 of SubTypeValidator.java (commit 1e64db6a2f by Tatu Saloranta), and the validateSubType method properly enforces this blacklist during polymorphic deserialization. The vulnerable code pattern (missing blacklist entry for the shaded HikariConfig gadget) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability concerns deserialization of the malicious gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The fix was already included in upstream jackson-databind 2.12.5 (authored by Tatu Saloranta on 2020-02-29) which TuxCare onboarded. The gadget class is blocked in SubTypeValidator.java line 144, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is not present in jackson-databind 2.12.5-tuxcare.3. The vulnerability concerns deserialization of the malicious gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The fix was already included in upstream jackson-databind 2.12.5 (authored by Tatu Saloranta on 2020-02-29) which TuxCare onboarded. The gadget class is blocked in SubTypeValidator.java line 144, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind's handling of the deserialization gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in the 2.12.5 release that TuxCare onboarded. The malicious class is blocked in SubTypeValidator.java via the DEFAULT_NO_DESER_CLASS_NAMES blacklist (line 145), preventing deserialization exploitation. Fix commit 9f4e97019fb by upstream author Tatu Saloranta predates the first TuxCare commit (667347046439) by 1502 commits, confirming it was part of the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 affects jackson-databind's handling of the deserialization gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.12.5-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in the 2.12.5 release that TuxCare onboarded. The malicious class is blocked in SubTypeValidator.java via the DEFAULT_NO_DESER_CLASS_NAMES blacklist (line 145), preventing deserialization exploitation. Fix commit 9f4e97019fb by upstream author Tatu Saloranta predates the first TuxCare commit (667347046439) by 1502 commits, confirming it was part of the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is not present in jackson-databind 2.12.5-tuxcare.3. The fix blocking javax.swing.JTextPane gadget was already included in upstream release 2.12.5 before TuxCare onboarded it. The vulnerable pattern never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is not present in jackson-databind 2.12.5-tuxcare.3. The fix blocking javax.swing.JTextPane gadget was already included in upstream release 2.12.5 before TuxCare onboarded it. The vulnerable pattern never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.12.5 is not affected by CVE-2026-54517. The vulnerability requires setterless properties to be routed through an unguarded buffering path that lacks @JsonView checks. This routing behavior was introduced by a later architectural change (commit ff8c5a22c6, fixing databind#5237) that first appears in versions 2.20.1+. The CVE explicitly states the affected range as \">= 2.21.0, < 2.21.4\"...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Version 2.12.5 is not affected by CVE-2026-54517. The vulnerability requires setterless properties to be routed through an unguarded buffering path that lacks @JsonView checks. This routing behavior was introduced by a later architectural change (commit ff8c5a22c6, fixing databind#5237) that first appears in versions 2.20.1+. The CVE explicitly states the affected range as \">= 2.21.0, < 2.21.4\"..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:43:19.113489+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54518"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:43:19.113489+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.12.5-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:42:53.452799+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.12.5-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}