{ "@id": "urn:uuid:f44fca7c-b3c7-4404-8487-d502e1015e8c", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T10:41:24.051298+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.12.6-tuxcare.2, which already contains the upstream vendor's fix. The required blacklist entries (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring/C3P0 classes) are present in SubTypeValidator.java and properly enforced. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.12.6 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.12.6-tuxcare.2, which already contains the upstream vendor's fix. The required blacklist entries (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring/C3P0 classes) are present in SubTypeValidator.java and properly enforced. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.12.6 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is not present in jackson-databind 2.12.6-tuxcare.2. The vulnerability addressed incomplete blacklist validation allowing remote code execution via polymorphic deserialization of dangerous classes when Spring libraries are present. The target contains comprehensive SubTypeValidator class (src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java) with extensive blacklist including all CVE-2017-17485 gadget classes: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, plus pattern-based Spring framework superclass checks (AbstractPointcutAdvisor, AbstractApplicationContext) and C3P0 DataSource checks. Validation is invoked at BeanDeserializerFactory.java:140 before deserialization. Fix commit 2235894210 (2017-12-18) is ancestor of upstream jackson-databind-2.12.6 tag (2021-12-14) and predates first TuxCare onboarding commit ccbd9424 by ~4 years. This is upstream fix shipped in jackson-databind 2.7.9.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 is not present in jackson-databind 2.12.6-tuxcare.2. The vulnerability addressed incomplete blacklist validation allowing remote code execution via polymorphic deserialization of dangerous classes when Spring libraries are present. The target contains comprehensive SubTypeValidator class (src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java) with extensive blacklist including all CVE-2017-17485 gadget classes: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, plus pattern-based Spring framework superclass checks (AbstractPointcutAdvisor, AbstractApplicationContext) and C3P0 DataSource checks. Validation is invoked at BeanDeserializerFactory.java:140 before deserialization. Fix commit 2235894210 (2017-12-18) is ancestor of upstream jackson-databind-2.12.6 tag (2021-12-14) and predates first TuxCare onboarding commit ccbd9424 by ~4 years. This is upstream fix shipped in jackson-databind 2.7.9.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 does not affect jackson-databind 2.12.6. The vulnerability was fixed in the upstream Jackson project in versions 2.6.7.1, 2.7.9.1, and 2.8.9 (released in April 2017). The fix was already present when TuxCare onboarded version 2.12.6. The SubTypeValidator blocklist includes both TemplatesImpl variants ('com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl' and 'org.apache.xalan.xsltc.trax.TemplatesImpl') that enable the arbitrary code execution exploit, and the validation is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 does not affect jackson-databind 2.12.6. The vulnerability was fixed in the upstream Jackson project in versions 2.6.7.1, 2.7.9.1, and 2.8.9 (released in April 2017). The fix was already present when TuxCare onboarded version 2.12.6. The SubTypeValidator blocklist includes both TemplatesImpl variants ('com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl' and 'org.apache.xalan.xsltc.trax.TemplatesImpl') that enable the arbitrary code execution exploit, and the validation is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5 and was fixed in upstream versions 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.12.6 is significantly newer and already contains the upstream vendor fix. The fix (blacklisting org.apache.ibatis.parsing.XPathParser in SubTypeValidator) was added by upstream commit 27b4defc270 (Tatu Saloranta, May 2018) and was already present in the upstream 2.12.6 release before TuxCare onboarded it. No TuxCare-specific backport of this CVE exists for the 2.12.6 branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5 and was fixed in upstream versions 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.12.6 is significantly newer and already contains the upstream vendor fix. The fix (blacklisting org.apache.ibatis.parsing.XPathParser in SubTypeValidator) was added by upstream commit 27b4defc270 (Tatu Saloranta, May 2018) and was already present in the upstream 2.12.6 release before TuxCare onboarded it. No TuxCare-specific backport of this CVE exists for the 2.12.6 branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 (Jodd-db polymorphic deserialization gadget) is not present in jackson-databind 2.12.6. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.12.6 shipped with the upstream fix already applied (commit 28badf7ef6 by Tatu Saloranta). The fix adds \"jodd.db.connection.DataSourceConnectionProvider\" to SubTypeValidator's blacklist, preventing polymorphic deserialization of this gadget class when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 (Jodd-db polymorphic deserialization gadget) is not present in jackson-databind 2.12.6. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.12.6 shipped with the upstream fix already applied (commit 28badf7ef6 by Tatu Saloranta). The fix adds \"jodd.db.connection.DataSourceConnectionProvider\" to SubTypeValidator's blacklist, preventing polymorphic deserialization of this gadget class when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.6-tuxcare.2 is not affected by CVE-2018-12023. The fix blocking deserialization of Oracle JDBC and Jodd-db gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) was already present in the upstream 2.12.6 release before TuxCare onboarding. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "The target jackson-databind 2.12.6-tuxcare.2 is not affected by CVE-2018-12023. The fix blocking deserialization of Oracle JDBC and Jodd-db gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) was already present in the upstream 2.12.6 release before TuxCare onboarding. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target repository jackson-databind version 2.12.6-tuxcare.2 is NOT affected by CVE-2018-14718. The fix that blocks org.slf4j.ext.EventData and other gadget classes from polymorphic deserialization was already present in the upstream release 2.12.6, which was onboarded by TuxCare. The vulnerable pattern (unblocked deserialization of slf4j-ext EventData class) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "Target repository jackson-databind version 2.12.6-tuxcare.2 is NOT affected by CVE-2018-14718. The fix that blocks org.slf4j.ext.EventData and other gadget classes from polymorphic deserialization was already present in the upstream release 2.12.6, which was onboarded by TuxCare. The vulnerable pattern (unblocked deserialization of slf4j-ext EventData class) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.6-tuxcare.2 is not affected by CVE-2018-14719. The four dangerous classes from the BlazeDS library and related gadgets (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, org.slf4j.ext.EventData, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are already blocked in SubTypeValidator.java's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 74-78). This fix was applied by upstream maintainer Tatu Saloranta in commit 87d29af25e (August 16, 2018) and was already present in the jackson-databind 2.12.6 upstream release that TuxCare onboarded in September 2026. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "The target jackson-databind 2.12.6-tuxcare.2 is not affected by CVE-2018-14719. The four dangerous classes from the BlazeDS library and related gadgets (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, org.slf4j.ext.EventData, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are already blocked in SubTypeValidator.java's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 74-78). This fix was applied by upstream maintainer Tatu Saloranta in commit 87d29af25e (August 16, 2018) and was already present in the jackson-databind 2.12.6 upstream release that TuxCare onboarded in September 2026. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability affects jackson-databind versions before 2.9.7, which allowed polymorphic deserialization of dangerous classes that could enable XXE attacks and code execution. The fix blocking the four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was already present in the upstream jackson-databind 2.12.6 release when TuxCare onboarded it. The blocklist is enforced by SubTypeValidator.validateSubType() which is called during bean deserialization and throws JsonMappingException for blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability affects jackson-databind versions before 2.9.7, which allowed polymorphic deserialization of dangerous classes that could enable XXE attacks and code execution. The fix blocking the four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was already present in the upstream jackson-databind 2.12.6 release when TuxCare onboarded it. The blocklist is enforced by SubTypeValidator.validateSubType() which is called during bean deserialization and throws JsonMappingException for blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 affects jackson-databind versions before 2.9.7, allowing SSRF attacks via the axis2-jaxws class. The target (jackson-databind 2.12.6-tuxcare.2) is NOT affected because the upstream vendor already fixed this vulnerability before version 2.12.6 was released. The dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl is blacklisted in SubTypeValidator.java line 78, preventing its polymorphic deserialization. The fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and was present in the upstream 2.12.6 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 affects jackson-databind versions before 2.9.7, allowing SSRF attacks via the axis2-jaxws class. The target (jackson-databind 2.12.6-tuxcare.2) is NOT affected because the upstream vendor already fixed this vulnerability before version 2.12.6 was released. The dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl is blacklisted in SubTypeValidator.java line 78, preventing its polymorphic deserialization. The fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and was present in the upstream 2.12.6 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8, allowing polymorphic deserialization of the axis2-transport-jms class (org.apache.axis2.transport.jms.JMSOutTransportInfo). The target repository (version 2.12.6-tuxcare.2) already contains the upstream fix that blocks this class from deserialization in SubTypeValidator.java line 85. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 72cd4025 on Nov 19, 2018, and shipped in the upstream 2.12.6 release before TuxCare onboarded the project. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8, allowing polymorphic deserialization of the axis2-transport-jms class (org.apache.axis2.transport.jms.JMSOutTransportInfo). The target repository (version 2.12.6-tuxcare.2) already contains the upstream fix that blocks this class from deserialization in SubTypeValidator.java line 85. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 72cd4025 on Nov 19, 2018, and shipped in the upstream 2.12.6 release before TuxCare onboarded the project. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind versions before 2.9.8, allowing polymorphic deserialization of dangerous openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime). The target version 2.12.6 contains the upstream fix (commit 72cd4025a2, authored by Tatu Saloranta) which adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. The fix was present in the upstream 2.12.6 release before TuxCare onboarded it (commit ccbd9424b9). The vulnerable code pattern is not present in HEAD because the blocklist defense (lines 82-84, checked at line 269) prevents instantiation of the openjpa classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 affects jackson-databind versions before 2.9.8, allowing polymorphic deserialization of dangerous openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime). The target version 2.12.6 contains the upstream fix (commit 72cd4025a2, authored by Tatu Saloranta) which adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. The fix was present in the upstream 2.12.6 release before TuxCare onboarded it (commit ccbd9424b9). The vulnerable code pattern is not present in HEAD because the blocklist defense (lines 82-84, checked at line 269) prevents instantiation of the openjpa classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind versions 2.x before 2.9.8 due to missing blocklist entries for jboss-common-core classes in polymorphic deserialization. The target repository (jackson-databind 2.12.6-tuxcare.2) is NOT AFFECTED because the upstream fix was already present in the jackson-databind 2.12.6 release that TuxCare onboarded. The fix (commit 72cd4025a2 by upstream maintainer Tatu Saloranta) added org.jboss.util.propertyeditor.DocumentEditor and related classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was committed on 2018-11-19 and shipped in upstream version 2.9.8, well before the 2.12.6 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 affects jackson-databind versions 2.x before 2.9.8 due to missing blocklist entries for jboss-common-core classes in polymorphic deserialization. The target repository (jackson-databind 2.12.6-tuxcare.2) is NOT AFFECTED because the upstream fix was already present in the jackson-databind 2.12.6 release that TuxCare onboarded. The fix (commit 72cd4025a2 by upstream maintainer Tatu Saloranta) added org.jboss.util.propertyeditor.DocumentEditor and related classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was committed on 2018-11-19 and shipped in upstream version 2.9.8, well before the 2.12.6 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.12.6. The vulnerability allowed RCE via deserialization of two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed the existing blacklist. The upstream fix (commit 038b471e2e by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream release 2.12.6 before TuxCare onboarded it (first TuxCare commit ccbd9424b9), so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.12.6. The vulnerability allowed RCE via deserialization of two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed the existing blacklist. The upstream fix (commit 038b471e2e by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream release 2.12.6 before TuxCare onboarded it (first TuxCare commit ccbd9424b9), so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.6-tuxcare.2) is not affected by CVE-2018-7489. The fix for this vulnerability was already present in the upstream jackson-databind 2.12.6 release that TuxCare onboarded. The SubTypeValidator.java file contains the complete defense mechanism that blocks deserialization of any c3p0 class whose fully qualified name starts with \"com.mchange.v2.c3p0.\" and ends with \"DataSource\", preventing the gadget chain exploitation described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "The target repository (jackson-databind 2.12.6-tuxcare.2) is not affected by CVE-2018-7489. The fix for this vulnerability was already present in the upstream jackson-databind 2.12.6 release that TuxCare onboarded. The SubTypeValidator.java file contains the complete defense mechanism that blocks deserialization of any c3p0 class whose fully qualified name starts with \"com.mchange.v2.c3p0.\" and ends with \"DataSource\", preventing the gadget chain exploitation described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.6-tuxcare.2) is NOT affected by CVE-2019-12086. The fix for this vulnerability\u2014blocking \"com.mysql.cj.jdbc.admin.MiniAdmin\" from polymorphic deserialization\u2014was already present in the upstream 2.12.6 release before TuxCare onboarded it. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit dda513bd7 on 2019-05-14 and is present at line 88 of SubTypeValidator.java. The vulnerable code pattern (allowing MiniAdmin deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "The target repository (jackson-databind 2.12.6-tuxcare.2) is NOT affected by CVE-2019-12086. The fix for this vulnerability\u2014blocking \"com.mysql.cj.jdbc.admin.MiniAdmin\" from polymorphic deserialization\u2014was already present in the upstream 2.12.6 release before TuxCare onboarded it. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit dda513bd7 on 2019-05-14 and is present at line 88 of SubTypeValidator.java. The vulnerable code pattern (allowing MiniAdmin deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.12.6-tuxcare.2 is NOT vulnerable to CVE-2019-12384. The dangerous class ch.qos.logback.core.db.DriverManagerConnectionSource is already blocked in SubTypeValidator.java (line 91), preventing polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta in commit c9ef4a10d6f and was already present in jackson-databind 2.12.6 when TuxCare o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 The target jackson-databind 2.12.6-tuxcare.2 is NOT vulnerable to CVE-2019-12384. The dangerous class ch.qos.logback.core.db.DriverManagerConnectionSource is already blocked in SubTypeValidator.java (line 91), preventing polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta in commit c9ef4a10d6f and was already present in jackson-databind 2.12.6 when TuxCare o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is not present in jackson-databind 2.12.6-tuxcare.2. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes that can be exploited to read arbitrary files. The fix (commit 5f7c69bba0) blacklisting org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer in SubTypeValidator.java was already included in the upstream jackson-databind 2.1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 is not present in jackson-databind 2.12.6-tuxcare.2. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes that can be exploited to read arbitrary files. The fix (commit 5f7c69bba0) blacklisting org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer in SubTypeValidator.java was already included in the upstream jackson-databind 2.1..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.6-tuxcare.2) is not affected by CVE-2019-14379. The fix for this vulnerability was already present in the upstream 2.12.6 release. The upstream commit ad418eeb974 by Tatu Saloranta added the dangerous class `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` to the deserialization blocklist in SubTypeValidator.java, preventing remote code execution via ehcache gadget deserialization. This is an upstream fix that shipped in the release before TuxCare onboarded version 2.12.6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "The target repository (jackson-databind 2.12.6-tuxcare.2) is not affected by CVE-2019-14379. The fix for this vulnerability was already present in the upstream 2.12.6 release. The upstream commit ad418eeb974 by Tatu Saloranta added the dangerous class `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` to the deserialization blocklist in SubTypeValidator.java, preventing remote code execution via ehcache gadget deserialization. This is an upstream fix that shipped in the release before TuxCare onboarded version 2.12.6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is not present in jackson-databind 2.12.6-tuxcare.2. The fix for this polymorphic typing vulnerability was already included in the upstream jackson-databind 2.12.6 release before TuxCare onboarded it. The dangerous classes ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup are present in the deserialization blocklist (SubTypeValidator.java lines 102 and 98), preventing their exploitation via Default Typing. The fix was authored by Tatu Saloranta (upstream Jackson maintainer) in commit ad418eeb97 and shipped in the upstream 2.12.6 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 is not present in jackson-databind 2.12.6-tuxcare.2. The fix for this polymorphic typing vulnerability was already included in the upstream jackson-databind 2.12.6 release before TuxCare onboarded it. The dangerous classes ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup are present in the deserialization blocklist (SubTypeValidator.java lines 102 and 98), preventing their exploitation via Default Typing. The fix was authored by Tatu Saloranta (upstream Jackson maintainer) in commit ad418eeb97 and shipped in the upstream 2.12.6 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 relates to polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource. The target jackson-databind 2.12.6 already contains the upstream fix: SubTypeValidator.java includes both class names in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (lines 105, 107), preventing their deserialization. These fixes were authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commits d4983c740f and 73c1c2cc76, which were already present in the upstream 2.12.6 release that TuxCare onboarded via commit ccbd9424b9. The vulnerable pattern (absence of blacklist entries) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 relates to polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource. The target jackson-databind 2.12.6 already contains the upstream fix: SubTypeValidator.java includes both class names in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (lines 105, 107), preventing their deserialization. These fixes were authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commits d4983c740f and 73c1c2cc76, which were already present in the upstream 2.12.6 release that TuxCare onboarded via commit ccbd9424b9. The vulnerable pattern (absence of blacklist entries) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is not present in jackson-databind 2.12.6. The upstream vendor (FasterXML) fixed this vulnerability by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blacklist in SubTypeValidator.java. This fix was already included in the upstream 2.12.6 release that TuxCare onboarded, as confirmed by verifying that fix commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af is an ancestor of both HEAD and the first TuxCare onboarding commit (ccbd9424b940394e50a11a38886eaa933958d1cd).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 is not present in jackson-databind 2.12.6. The upstream vendor (FasterXML) fixed this vulnerability by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blacklist in SubTypeValidator.java. This fix was already included in the upstream 2.12.6 release that TuxCare onboarded, as confirmed by verifying that fix commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af is an ancestor of both HEAD and the first TuxCare onboarding commit (ccbd9424b940394e50a11a38886eaa933958d1cd).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0, where polymorphic deserialization could instantiate the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution. The target repository jackson-databind 2.12.6-tuxcare.2 is NOT AFFECTED because the upstream fix (commit 998efd7082 by Tatu Saloranta) was already present in the upstream release 2.12.6 that TuxCare onboarded. The fix adds the xalan gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 117), preventing deserialization attacks. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0, where polymorphic deserialization could instantiate the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution. The target repository jackson-databind 2.12.6-tuxcare.2 is NOT AFFECTED because the upstream fix (commit 998efd7082 by Tatu Saloranta) was already present in the upstream release 2.12.6 that TuxCare onboarded. The fix adds the xalan gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 117), preventing deserialization attacks. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 does not affect jackson-databind 2.12.6-tuxcare.2. The vulnerability involves unsafe polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, but the upstream fix that blocks this class in SubTypeValidator was authored by Tatu Saloranta and shipped in upstream release 2.12.6 before TuxCare onboarded the version. The blocklist entry is present at SubTypeValidator.java:107 and properly enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 does not affect jackson-databind 2.12.6-tuxcare.2. The vulnerability involves unsafe polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, but the upstream fix that blocks this class in SubTypeValidator was authored by Tatu Saloranta and shipped in upstream release 2.12.6 before TuxCare onboarded the version. The blocklist entry is present at SubTypeValidator.java:107 and properly enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.6) is NOT AFFECTED by CVE-2019-16942. The vulnerability was fixed by the upstream maintainer in commits 328a0f833d and 9593e16cf5 (September 2019), which added the dangerous commons-dbcp classes (SharedPoolDataSource, PerUserPoolDataSource) to the SubTypeValidator blocklist. These fixes were released in upstream version 2.9.10.1 and are present in all subsequent versions including 2.12.6. The fix was already included in the upstream release that TuxCare onboarded, not applied by a TuxCare backport. The vulnerable deserialization pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "The target repository (jackson-databind 2.12.6) is NOT AFFECTED by CVE-2019-16942. The vulnerability was fixed by the upstream maintainer in commits 328a0f833d and 9593e16cf5 (September 2019), which added the dangerous commons-dbcp classes (SharedPoolDataSource, PerUserPoolDataSource) to the SubTypeValidator blocklist. These fixes were released in upstream version 2.9.10.1 and are present in all subsequent versions including 2.12.6. The fix was already included in the upstream release that TuxCare onboarded, not applied by a TuxCare backport. The vulnerable deserialization pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability involved deserialization of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp DataSource types) when polymorphic typing was enabled. The upstream fix (commit 9593e16cf5) added these class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. This fix was already present in the upstream 2.12.6 release that TuxCare onboarded, so the vulnerable code pattern never existed in this TuxCare-maintained version. The defense code is confirmed present at SubTypeValidator.java:127.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability involved deserialization of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp DataSource types) when polymorphic typing was enabled. The upstream fix (commit 9593e16cf5) added these class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. This fix was already present in the upstream 2.12.6 release that TuxCare onboarded, so the vulnerable code pattern never existed in this TuxCare-maintained version. The defense code is confirmed present at SubTypeValidator.java:127.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability involved a polymorphic deserialization gadget class (net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup) that could be exploited for arbitrary code execution. The fix\u2014adding this class to the SubTypeValidator blocklist\u2014was applied by upstream author Tatu Saloranta in commit 191a4cdf87 on September 19, 2019, and shipped in upstream version 2.9.10. Since the target version 2.12.6 is much newer than 2.9.10, the fix was already present when TuxCare onboarded this version in September 2026. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability involved a polymorphic deserialization gadget class (net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup) that could be exploited for arbitrary code execution. The fix\u2014adding this class to the SubTypeValidator blocklist\u2014was applied by upstream author Tatu Saloranta in commit 191a4cdf87 on September 19, 2019, and shipped in upstream version 2.9.10. Since the target version 2.12.6 is much newer than 2.9.10, the fix was already present when TuxCare onboarded this version in September 2026. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.12.6-tuxcare.2. The fix blocking deserialization of log4j-extras classes (org.apache.log4j.receivers.db.JNDIConnectionSource and DriverManagerConnectionSource) was already included in upstream jackson-databind 2.12.6 before TuxCare onboarded this version. The vulnerable pattern (unblocked dangerous classes enabling JNDI exploitation) does not exist because these classes are explicitly blocked in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES set. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-10-12 in commit b5a304a98590b6bb766134f9261e6566dcbbb6d0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.12.6-tuxcare.2. The fix blocking deserialization of log4j-extras classes (org.apache.log4j.receivers.db.JNDIConnectionSource and DriverManagerConnectionSource) was already included in upstream jackson-databind 2.12.6 before TuxCare onboarded this version. The vulnerable pattern (unblocked dangerous classes enabling JNDI exploitation) does not exist because these classes are explicitly blocked in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES set. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-10-12 in commit b5a304a98590b6bb766134f9261e6566dcbbb6d0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 affects jackson-databind versions that lack blocklist entries for dangerous ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector) that enable JNDI injection attacks. The target repository (jackson-databind 2.12.6) already contains these blocklist entries in SubTypeValidator.java (lines 133-135). The fix was introduced in upstream commit fc4214a883 by Tatu Saloranta and shipped with upstream release 2.12.6, which TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 affects jackson-databind versions that lack blocklist entries for dangerous ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector) that enable JNDI injection attacks. The target repository (jackson-databind 2.12.6) already contains these blocklist entries in SubTypeValidator.java (lines 133-135). The fix was introduced in upstream commit fc4214a883 by Tatu Saloranta and shipped with upstream release 2.12.6, which TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of ignite-jta classes. The target repository (jackson-databind 2.12.6-tuxcare.2) is NOT AFFECTED because the upstream fix (commit a424c038ba) was already present in the 2.12.6 release before TuxCare onboarding. The fix adds three classes (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider) to SubTypeValidator's blocklist, preventing their deserialization. This blocklist is verified present and active at SubTypeValidator.java:158-160.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of ignite-jta classes. The target repository (jackson-databind 2.12.6-tuxcare.2) is NOT AFFECTED because the upstream fix (commit a424c038ba) was already present in the 2.12.6 release before TuxCare onboarding. The fix adds three classes (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider) to SubTypeValidator's blocklist, preventing their deserialization. This blocklist is verified present and active at SubTypeValidator.java:158-160.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory) that was not blocked. The target repository is jackson-databind 2.12.6-tuxcare.2, which already contains the upstream fix that added the gadget class to the deserialization blocklist in SubTypeValidator.java. The fix (commit 592872f423) was authored by upstream maintainer Tatu Saloranta and was included in upstream release 2.9.10.4, which is the exact version mentioned in the CVE as the first fixed version. Since 2.12.6 is significantly later than 2.9.10.4, the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory) that was not blocked. The target repository is jackson-databind 2.12.6-tuxcare.2, which already contains the upstream fix that added the gadget class to the deserialization blocklist in SubTypeValidator.java. The fix (commit 592872f423) was authored by upstream maintainer Tatu Saloranta and was included in upstream release 2.9.10.4, which is the exact version mentioned in the CVE as the first fixed version. Since 2.12.6 is significantly later than 2.9.10.4, the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability involves deserialization of the gadget class \"com.caucho.config.types.ResourceRef\" which can lead to arbitrary code execution. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java) was already present in upstream version 2.12.6, which TuxCare onboarded. The blocklist entry exists at line 167 and prevents this class from being deserialized, effectively blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability involves deserialization of the gadget class \"com.caucho.config.types.ResourceRef\" which can lead to arbitrary code execution. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java) was already present in upstream version 2.12.6, which TuxCare onboarded. The blocklist entry exists at line 167 and prevents this class from being deserialized, effectively blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.6-tuxcare.2) is NOT affected by CVE-2020-10968. The fix for this vulnerability was already present in the upstream release 2.12.6 before TuxCare onboarded it. The blocklist entries for org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider are present in SubTypeValidator.java at lines 170-171, which prevents Jackson from deserializing these dangerous gadget classes during polymorphic type handling. The vulnerable code pattern does not exist in this version because the upstream fix (commit 08fbfacf89) was included in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "The target repository (jackson-databind 2.12.6-tuxcare.2) is NOT affected by CVE-2020-10968. The fix for this vulnerability was already present in the upstream release 2.12.6 before TuxCare onboarded it. The blocklist entries for org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider are present in SubTypeValidator.java at lines 170-171, which prevents Jackson from deserializing these dangerous gadget classes during polymorphic type handling. The vulnerable code pattern does not exist in this version because the upstream fix (commit 08fbfacf89) was included in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 concerns deserialization gadgets in jackson-databind related to javax.swing.JEditorPane. The target repository (jackson-databind 2.12.6-tuxcare.2) already contains the upstream vendor's fix. The blocklist at SubTypeValidator.java:150 includes \"javax.swing.JEditorPane\", preventing its deserialization. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 4d038c9de0 and shipped in the upstream 2.12.6 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "CVE-2020-10969 concerns deserialization gadgets in jackson-databind related to javax.swing.JEditorPane. The target repository (jackson-databind 2.12.6-tuxcare.2) already contains the upstream vendor's fix. The blocklist at SubTypeValidator.java:150 includes \"javax.swing.JEditorPane\", preventing its deserialization. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 4d038c9de0 and shipped in the upstream 2.12.6 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111: Target jackson-databind 2.12.6 is NOT AFFECTED. The vulnerability involves deserialization of org.apache.activemq.* classes as gadgets for exploitation. The fix (blocklisting these classes in SubTypeValidator) was introduced in upstream commit c14c9f99ed (March 2020) by jackson-databind maintainer Tatu Saloranta, and was already present in the upstream 2.12.6 release when TuxCare onboarded it. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111: Target jackson-databind 2.12.6 is NOT AFFECTED. The vulnerability involves deserialization of org.apache.activemq.* classes as gadgets for exploitation. The fix (blocklisting these classes in SubTypeValidator) was introduced in upstream commit c14c9f99ed (March 2020) by jackson-databind maintainer Tatu Saloranta, and was already present in the upstream 2.12.6 release when TuxCare onboarded it. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.6 is not affected by CVE-2020-11112. The vulnerability involves deserialization of the gadget class org.apache.commons.proxy.provider.remoting.RmiProvider via polymorphic typing. The upstream vendor (FasterXML) fixed this in commit 05d7e0e13f by adding the class to SubTypeValidator's blocklist. This fix was already present in the upstream 2.12.6 release that TuxCare onboarded (commit ccbd9424b9 by amoniatovskiy@cloudlinux.com). The blocklist entry at SubTypeValidator.java:186 prevents instantiation of the gadget class during deserialization, breaking the attack chain before the goal (arbitrary code execution) can be reached.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "The target jackson-databind 2.12.6 is not affected by CVE-2020-11112. The vulnerability involves deserialization of the gadget class org.apache.commons.proxy.provider.remoting.RmiProvider via polymorphic typing. The upstream vendor (FasterXML) fixed this in commit 05d7e0e13f by adding the class to SubTypeValidator's blocklist. This fix was already present in the upstream 2.12.6 release that TuxCare onboarded (commit ccbd9424b9 by amoniatovskiy@cloudlinux.com). The blocklist entry at SubTypeValidator.java:186 prevents instantiation of the gadget class during deserialization, breaking the attack chain before the goal (arbitrary code execution) can be reached.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 affects jackson-databind versions before 2.9.10.4. The target version 2.12.6 shipped with the fix already integrated from upstream. The fix adds org.apache.openjpa.ee.WASRegistryManagedRuntime to the SubTypeValidator blocklist (line 84), preventing deserialization of this gadget class. The vulnerable pattern never existed in version 2.12.6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 affects jackson-databind versions before 2.9.10.4. The target version 2.12.6 shipped with the fix already integrated from upstream. The fix adds org.apache.openjpa.ee.WASRegistryManagedRuntime to the SubTypeValidator blocklist (line 84), preventing deserialization of this gadget class. The vulnerable pattern never existed in version 2.12.6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.12.6 is NOT AFFECTED by CVE-2020-11619. The vulnerability involved missing blocklist entries for Spring Framework gadget classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean) that could enable deserialization-based attacks. The fix was already present in the upstream release 2.12.6 when TuxCare onboarded it. The blocklist entries are confirmed present at lines 53-54 of SubTypeValidator.java, preventing instantiation of the vulnerable classes during polymorphic type resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "The target repository jackson-databind version 2.12.6 is NOT AFFECTED by CVE-2020-11619. The vulnerability involved missing blocklist entries for Spring Framework gadget classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean) that could enable deserialization-based attacks. The fix was already present in the upstream release 2.12.6 when TuxCare onboarded it. The blocklist entries are confirmed present at lines 53-54 of SubTypeValidator.java, preventing instantiation of the vulnerable classes during polymorphic type resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 by allowing deserialization of the gadget class org.apache.commons.jelly.impl.Embedded. The target version 2.12.6-tuxcare.2 already contains the upstream fix (commit 77040d85e3) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was present in the upstream release before TuxCare onboarded version 2.12.6, making the vulnerable code pattern absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 by allowing deserialization of the gadget class org.apache.commons.jelly.impl.Embedded. The target version 2.12.6-tuxcare.2 already contains the upstream fix (commit 77040d85e3) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was present in the upstream release before TuxCare onboarded version 2.12.6, making the vulnerable code pattern absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not present in jackson-databind 2.12.6. The vulnerability affects versions before 2.9.10.5, and the fix (blocklist entry for \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\") was already included in the upstream 2.12.6 release that TuxCare onboarded. The fix commit d1c67a0396e84c08d0558fbb843b5bd1f26e1921 by upstream maintainer Tatu Saloranta is an ancestor of the onboarding commit, confirming it shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 is not present in jackson-databind 2.12.6. The vulnerability affects versions before 2.9.10.5, and the fix (blocklist entry for \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\") was already included in the upstream 2.12.6 release that TuxCare onboarded. The fix commit d1c67a0396e84c08d0558fbb843b5bd1f26e1921 by upstream maintainer Tatu Saloranta is an ancestor of the onboarding commit, confirming it shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 targets jackson-databind's polymorphic deserialization, allowing instantiation of dangerous oracle.jms.AQjms* gadget classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The fix blacklists these five classes in SubTypeValidator.java lines 200-204. This defense was added by upstream author Tatu Saloranta in commit 5c8642aeae9 on 2020-04-24, first released in jackson-databind-2.10.4. The target version 2.12.6 already contains this fix as part of the upstream release that TuxCare onboarded (commit ccbd9424b9). The vulnerable pattern is not present\u2014the fix shipped with the upstream version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "CVE-2020-14061 targets jackson-databind's polymorphic deserialization, allowing instantiation of dangerous oracle.jms.AQjms* gadget classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The fix blacklists these five classes in SubTypeValidator.java lines 200-204. This defense was added by upstream author Tatu Saloranta in commit 5c8642aeae9 on 2020-04-24, first released in jackson-databind-2.10.4. The target version 2.12.6 already contains this fix as part of the upstream release that TuxCare onboarded (commit ccbd9424b9). The vulnerable pattern is not present\u2014the fix shipped with the upstream version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.6 is not affected by CVE-2020-14062. The fix for this vulnerability (blacklisting com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool) was already present in the upstream 2.12.6 release before TuxCare onboarded it. The vulnerable gadget is blocked at line 119 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "Target version 2.12.6 is not affected by CVE-2020-14062. The fix for this vulnerability (blacklisting com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool) was already present in the upstream 2.12.6 release before TuxCare onboarded it. The vulnerable gadget is blocked at line 119 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is NOT affecting target version 2.12.6-tuxcare.2. The vulnerability concerns Jackson-databind's polymorphic deserialization allowing instantiation of the JNDI gadget class org.jsecurity.realm.jndi.JndiRealmFactory. The fix (blocklist entry preventing deserialization of this class) was introduced in upstream release 2.9.10.5 by maintainer Tatu Saloranta (commit f6d9c664f6, June 2020). Target version 2.12.6 is much later than 2.9.10.5 and inherited this upstream fix. The blocklist entry is present at SubTypeValidator.java:207 and actively enforced during deserialization via BeanDeserializerFactory:1000.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 is NOT affecting target version 2.12.6-tuxcare.2. The vulnerability concerns Jackson-databind's polymorphic deserialization allowing instantiation of the JNDI gadget class org.jsecurity.realm.jndi.JndiRealmFactory. The fix (blocklist entry preventing deserialization of this class) was introduced in upstream release 2.9.10.5 by maintainer Tatu Saloranta (commit f6d9c664f6, June 2020). Target version 2.12.6 is much later than 2.9.10.5 and inherited this upstream fix. The blocklist entry is present at SubTypeValidator.java:207 and actively enforced during deserialization via BeanDeserializerFactory:1000.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is not present in jackson-databind 2.12.6. The vulnerability relates to missing blocklist entries for the deserialization gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The upstream fix (commit 3d97153944 by Tatu Saloranta on Aug 10, 2020) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in upstream version 2.12.6 when TuxCare onboarded it (first TuxCare commit ccbd9424b9 \"Onboard version 2.12.6\"). The target contains the complete defense mechanism at lines 146-147 of SubTypeValidator.java, preventing deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 is not present in jackson-databind 2.12.6. The vulnerability relates to missing blocklist entries for the deserialization gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The upstream fix (commit 3d97153944 by Tatu Saloranta on Aug 10, 2020) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in upstream version 2.12.6 when TuxCare onboarded it (first TuxCare commit ccbd9424b9 \"Onboard version 2.12.6\"). The target contains the complete defense mechanism at lines 146-147 of SubTypeValidator.java, preventing deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 concerns the com.pastdev.httpcomponents.configuration.JndiConfiguration deserialization gadget. The upstream fix (commit 6cc9f1a1af3 by Tatu Saloranta, 2020-07-20) added this class to the blacklist in SubTypeValidator.java line 210. This fix was released in upstream version 2.9.10.6 (August 2020). The target repository at version 2.12.6-tuxcare.2 inherited this fix from upstream 2.12.6, which includes all 2.9.x branch fixes. The vulnerable pattern is not present because the upstream fix shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 concerns the com.pastdev.httpcomponents.configuration.JndiConfiguration deserialization gadget. The upstream fix (commit 6cc9f1a1af3 by Tatu Saloranta, 2020-07-20) added this class to the blacklist in SubTypeValidator.java line 210. This fix was released in upstream version 2.9.10.6 (August 2020). The target repository at version 2.12.6-tuxcare.2 inherited this fix from upstream 2.12.6, which includes all 2.9.x branch fixes. The vulnerable pattern is not present because the upstream fix shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in Jackson Databind DOMDeserializer) is NOT present in jackson-databind 2.12.6. The required XXE protections (disallow-doctype-decl=true and load-external-dtd=false) are present in DOMDeserializer.java lines 43-49. The fix was introduced by upstream commit 612f971b78 (authored by tatu.saloranta@iki.fi) in version 2.11.0. Since the target is version 2.12.6, this upstream fix was already included in the release that TuxCare onboarded (commit ccbd9424b9). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE vulnerability in Jackson Databind DOMDeserializer) is NOT present in jackson-databind 2.12.6. The required XXE protections (disallow-doctype-decl=true and load-external-dtd=false) are present in DOMDeserializer.java lines 43-49. The fix was introduced by upstream commit 612f971b78 (authored by tatu.saloranta@iki.fi) in version 2.11.0. Since the target is version 2.12.6, this upstream fix was already included in the release that TuxCare onboarded (commit ccbd9424b9). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.6-tuxcare.2 is NOT AFFECTED by CVE-2020-35490. The vulnerability involves deserialization gadgets using org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource classes that could lead to code execution via polymorphic type handling. The upstream vendor (Tatu Saloranta) fixed this in version 2.9.10.8 by adding these classes to SubTypeValidator's deserialization blocklist. Since the target version 2.12.6 is newer than 2.9.10.8, the fix was already included in the upstream release before TuxCare onboarded it. The blocklist entries are present at lines 217-218 of SubTypeValidator.java, and the validation mechanism properly blocks these gadget classes from being deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "The target jackson-databind 2.12.6-tuxcare.2 is NOT AFFECTED by CVE-2020-35490. The vulnerability involves deserialization gadgets using org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource classes that could lead to code execution via polymorphic type handling. The upstream vendor (Tatu Saloranta) fixed this in version 2.9.10.8 by adding these classes to SubTypeValidator's deserialization blocklist. Since the target version 2.12.6 is newer than 2.9.10.8, the fix was already included in the upstream release before TuxCare onboarded it. The blocklist entries are present at lines 217-218 of SubTypeValidator.java, and the validation mechanism properly blocks these gadget classes from being deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is NOT affecting jackson-databind 2.12.6. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream vendor (FasterXML) fixed this in commit 41b8bdb5cc (Dec 15, 2020) by adding these classes to the SubTypeValidator deny list. This fix was already included in the upstream 2.12.6 release (Dec 14, 2021) that TuxCare onboarded (Sep 10, 2026). The vulnerable code pattern is not present in the target - the dbcp2 classes are blocked at SubTypeValidator.java:217-218, and this protection cannot be bypassed or disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "CVE-2020-35491 is NOT affecting jackson-databind 2.12.6. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream vendor (FasterXML) fixed this in commit 41b8bdb5cc (Dec 15, 2020) by adding these classes to the SubTypeValidator deny list. This fix was already included in the upstream 2.12.6 release (Dec 14, 2021) that TuxCare onboarded (Sep 10, 2026). The vulnerable code pattern is not present in the target - the dbcp2 classes are blocked at SubTypeValidator.java:217-218, and this protection cannot be bypassed or disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability involves a deserialization gadget class (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) that was not blocklisted in versions before 2.9.10.8. The fix (commit 1ca0388c2f by upstream author Tatu Saloranta) adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.12.6 release (well beyond the affected version range \"before 2.9.10.8\"), which TuxCare onboarded. The blocklist entry is present at line 240 and is actively enforced by the validator's validateSubType() method. Target is not affected because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "CVE-2020-35728 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability involves a deserialization gadget class (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) that was not blocklisted in versions before 2.9.10.8. The fix (commit 1ca0388c2f by upstream author Tatu Saloranta) adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.12.6 release (well beyond the affected version range \"before 2.9.10.8\"), which TuxCare onboarded. The blocklist entry is present at line 240 and is actively enforced by the validator's validateSubType() method. Target is not affected because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is not present in jackson-databind 2.12.6. The vulnerability involves deserialization of DBCP connection pool adapter classes that enable JNDI injection attacks. The fix (commit 3ded28aece) was already included in the upstream jackson-databind 2.12.6 release that TuxCare onboarded. All five DriverAdapterCPDS class variants mentioned in the patch are present in the SubTypeValidator blocklist, and the enforcement mechanism properly prevents their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "CVE-2020-36179 is not present in jackson-databind 2.12.6. The vulnerability involves deserialization of DBCP connection pool adapter classes that enable JNDI injection attacks. The fix (commit 3ded28aece) was already included in the upstream jackson-databind 2.12.6 release that TuxCare onboarded. All five DriverAdapterCPDS class variants mentioned in the patch are present in the SubTypeValidator blocklist, and the enforcement mechanism properly prevents their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability concerns deserialization gadgets using org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes. The target already contains the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) that was shipped in the upstream 2.12.6 release before TuxCare onboarding. SubTypeValidator.java includes all DriverAdapterCPDS class variants in its deserialization blocklist at lines 123, 193, 219, 228, and 234, which prevents instantiation of these gadget classes during JSON deserialization with polymorphic typing enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "CVE-2020-36180 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability concerns deserialization gadgets using org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes. The target already contains the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) that was shipped in the upstream 2.12.6 release before TuxCare onboarding. SubTypeValidator.java includes all DriverAdapterCPDS class variants in its deserialization blocklist at lines 123, 193, 219, 228, and 234, which prevents instantiation of these gadget classes during JSON deserialization with polymorphic typing enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is not present in jackson-databind 2.12.6-tuxcare.2. The vulnerability concerns unsafe deserialization of the gadget class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS`. The upstream fix (commit 3ded28aece, author tatu.saloranta@iki.fi, Dec 31 2020) added this class to the `SubTypeValidator` blocklist and was already included in the upstream 2.12.6 release when TuxCare onboarded it (commit ccbd9424b9, Oct 2026). The target's SubTypeValidator.java:228-230 contains the blocking code, preventing instantiation of this gadget class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 is not present in jackson-databind 2.12.6-tuxcare.2. The vulnerability concerns unsafe deserialization of the gadget class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS`. The upstream fix (commit 3ded28aece, author tatu.saloranta@iki.fi, Dec 31 2020) added this class to the `SubTypeValidator` blocklist and was already included in the upstream 2.12.6 release when TuxCare onboarded it (commit ccbd9424b9, Oct 2026). The target's SubTypeValidator.java:228-230 contains the blocking code, preventing instantiation of this gadget class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.12.6-tuxcare.2. The fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS was already included in the upstream release 2.12.6 (commit 3ded28aece6 by Tatu Saloranta, dated 2020-12-31). The defense is active by default in SubTypeValidator.java line 234, which adds the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist, preventing its instantiation during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.12.6-tuxcare.2. The fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS was already included in the upstream release 2.12.6 (commit 3ded28aece6 by Tatu Saloranta, dated 2020-12-31). The defense is active by default in SubTypeValidator.java line 234, which adds the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist, preventing its instantiation during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 concerns a Jackson deserialization gadget (org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) that allows RCE when polymorphic typing is enabled. The target jackson-databind 2.12.6 already contains the upstream fix that blocklists this class in SubTypeValidator.java:243. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.12.6 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "CVE-2020-36183 concerns a Jackson deserialization gadget (org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) that allows RCE when polymorphic typing is enabled. The target jackson-databind 2.12.6 already contains the upstream fix that blocklists this class in SubTypeValidator.java:243. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.12.6 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8, exploiting deserialization gadgets org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target repository (jackson-databind 2.12.6-tuxcare.2) is NOT vulnerable because the upstream fix was already present in the 2.12.6 release. The fix (commit 567194c53a by tatu.saloranta@iki.fi) adds both gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, causing the deserializer to reject these types with \"Illegal type to deserialize: prevented for security reasons\". This fix predates TuxCare's onboarding of version 2.12.6 (commit ccbd9424b9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8, exploiting deserialization gadgets org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target repository (jackson-databind 2.12.6-tuxcare.2) is NOT vulnerable because the upstream fix was already present in the 2.12.6 release. The fix (commit 567194c53a by tatu.saloranta@iki.fi) adds both gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, causing the deserializer to reject these types with \"Illegal type to deserialize: prevented for security reasons\". This fix predates TuxCare's onboarding of version 2.12.6 (commit ccbd9424b9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is NOT present in jackson-databind 2.12.6-tuxcare.2. This deserialization gadget vulnerability related to `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource` and `PerUserPoolDataSource` was fixed in upstream version 2.9.10.8 (released Dec 2020). The fix adds these classes to the deserialization blacklist in SubTypeValidator.java. Target version 2.12.6 already contained this fix when TuxCare onboarded it - the fix was authored by upstream maintainer Tatu Saloranta and is present at SubTypeValidator.java:234-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 is NOT present in jackson-databind 2.12.6-tuxcare.2. This deserialization gadget vulnerability related to `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource` and `PerUserPoolDataSource` was fixed in upstream version 2.9.10.8 (released Dec 2020). The fix adds these classes to the deserialization blacklist in SubTypeValidator.java. Target version 2.12.6 already contained this fix when TuxCare onboarded it - the fix was authored by upstream maintainer Tatu Saloranta and is present at SubTypeValidator.java:234-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for Tomcat DBCP datasource classes that can be exploited as deserialization gadgets. The target version 2.12.6-tuxcare.2 is NOT vulnerable because the upstream fix (commit 3e8fa3beea by Tatu Saloranta) was already present in the jackson-databind 2.12.6 release that TuxCare onboarded. The dangerous classes org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource are properly blocklisted in SubTypeValidator.java at lines 229-230.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for Tomcat DBCP datasource classes that can be exploited as deserialization gadgets. The target version 2.12.6-tuxcare.2 is NOT vulnerable because the upstream fix (commit 3e8fa3beea by Tatu Saloranta) was already present in the jackson-databind 2.12.6 release that TuxCare onboarded. The dangerous classes org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource are properly blocklisted in SubTypeValidator.java at lines 229-230.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.6-tuxcare.2 is NOT vulnerable to CVE-2020-36187. The fix blocking deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource was already present in the upstream 2.12.6 release that TuxCare onboarded. The vulnerable pattern does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "Target jackson-databind 2.12.6-tuxcare.2 is NOT vulnerable to CVE-2020-36187. The fix blocking deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource was already present in the upstream 2.12.6 release that TuxCare onboarded. The vulnerable pattern does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.6-tuxcare.2 is NOT AFFECTED by CVE-2020-36188. The vulnerability involves deserialization of dangerous gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) that enable arbitrary code execution. The upstream fix (commit 33d96c13fe by Tatu Saloranta) added these classes to the SubTypeValidator blacklist, which blocks their deserialization. This fix was already present in the upstream jackson-databind 2.9.10.8 release (Dec 2020) and therefore shipped in the upstream 2.12.6 release that TuxCare onboarded. The blacklist entries are present at SubTypeValidator.java:223-224, and the validator is actively called during deserialization (BeanDeserializerFactory.java:140\u21921000), throwing an error for any attempt to deserialize these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "The target jackson-databind 2.12.6-tuxcare.2 is NOT AFFECTED by CVE-2020-36188. The vulnerability involves deserialization of dangerous gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) that enable arbitrary code execution. The upstream fix (commit 33d96c13fe by Tatu Saloranta) added these classes to the SubTypeValidator blacklist, which blocks their deserialization. This fix was already present in the upstream jackson-databind 2.9.10.8 release (Dec 2020) and therefore shipped in the upstream 2.12.6 release that TuxCare onboarded. The blacklist entries are present at SubTypeValidator.java:223-224, and the validator is actively called during deserialization (BeanDeserializerFactory.java:140\u21921000), throwing an error for any attempt to deserialize these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability concerns missing blocklist entries for com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource in SubTypeValidator, which could allow deserialization gadget attacks. The fix (commit 33d96c13fe) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.12.6 before TuxCare onboarded it. The target contains the complete fix at lines 221-224 of SubTypeValidator.java, blocking both newrelic-agent embedded logback classes from polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 is NOT present in jackson-databind 2.12.6-tuxcare.2. The vulnerability concerns missing blocklist entries for com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource in SubTypeValidator, which could allow deserialization gadget attacks. The fix (commit 33d96c13fe) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.12.6 before TuxCare onboarded it. The target contains the complete fix at lines 221-224 of SubTypeValidator.java, blocking both newrelic-agent embedded logback classes from polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-36518 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.6 is not affected by CVE-2020-8840. The vulnerability involves JNDI injection via deserialization of org.apache.xbean.propertyeditor.JndiConverter. The upstream fix (blocking this class from deserialization) was included in the upstream 2.12.6 release and is present in the target at SubTypeValidator.java:138. The fix was authored by upstream maintainer Tatu Saloranta and shipped before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "Target version 2.12.6 is not affected by CVE-2020-8840. The vulnerability involves JNDI injection via deserialization of org.apache.xbean.propertyeditor.JndiConverter. The upstream fix (blocking this class from deserialization) was included in the upstream 2.12.6 release and is present in the target at SubTypeValidator.java:138. The fix was authored by upstream maintainer Tatu Saloranta and shipped before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is not present in jackson-databind 2.12.6. The fix (blocklist entry for org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig) was already included in the upstream 2.12.6 release that TuxCare onboarded. The CVE affected versions before 2.9.10.4, and this target version (2.12.6) is well beyond that fixed version. The defense code exists at SubTypeValidator.java line 141, preventing deserialization of the vulnerable gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 is not present in jackson-databind 2.12.6. The fix (blocklist entry for org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig) was already included in the upstream 2.12.6 release that TuxCare onboarded. The CVE affected versions before 2.9.10.4, and this target version (2.12.6) is well beyond that fixed version. The defense code exists at SubTypeValidator.java line 141, preventing deserialization of the vulnerable gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4/2.8.11.6/2.7.9.7 due to unsafe deserialization of the ibatis-sqlmap gadget class. The target version 2.12.6 contains the upstream fix (commit 1e64db6a2f by Tatu Saloranta) which adds com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig to the SubTypeValidator blocklist. This fix shipped in the upstream 2.12.6 release and was present when TuxCare onboarded the version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4/2.8.11.6/2.7.9.7 due to unsafe deserialization of the ibatis-sqlmap gadget class. The target version 2.12.6 contains the upstream fix (commit 1e64db6a2f by Tatu Saloranta) which adds com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig to the SubTypeValidator blocklist. This fix shipped in the upstream 2.12.6 release and was present when TuxCare onboarded the version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is not present in jackson-databind 2.12.6. The vulnerability concerns deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The fix, which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 145), was already included in upstream jackson-databind 2.12.6 before TuxCare onboarded the version. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi), the upstream FasterXML maintainer, in commits 1e64db6a2f and 9f4e97019f, both of which predate the first TuxCare commit (ccbd9424b9 \"Onboard version 2.12.6\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 is not present in jackson-databind 2.12.6. The vulnerability concerns deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The fix, which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 145), was already included in upstream jackson-databind 2.12.6 before TuxCare onboarded the version. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi), the upstream FasterXML maintainer, in commits 1e64db6a2f and 9f4e97019f, both of which predate the first TuxCare commit (ccbd9424b9 \"Onboard version 2.12.6\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is not present in jackson-databind 2.12.6. The vulnerability involves deserialization of dangerous gadget classes (specifically javax.swing.JTextPane) through polymorphic type handling. The fix, which adds JTextPane to the SubTypeValidator blocklist, was already included in the upstream 2.12.6 release (commit 7dbf51bf78 by Tatu Saloranta, Sept 2020). TuxCare onboarded version 2.12.6 in commit ccbd9424b9, which already contained the fix. TuxCare did backport CVE-2021-20190 to older versions (2.7.x, 2.8.x, 2.9.x) but not to 2.12.6, confirming the fix was already present upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 is not present in jackson-databind 2.12.6. The vulnerability involves deserialization of dangerous gadget classes (specifically javax.swing.JTextPane) through polymorphic type handling. The fix, which adds JTextPane to the SubTypeValidator blocklist, was already included in the upstream 2.12.6 release (commit 7dbf51bf78 by Tatu Saloranta, Sept 2020). TuxCare onboarded version 2.12.6 in commit ccbd9424b9, which already contained the fix. TuxCare did backport CVE-2021-20190 to older versions (2.7.x, 2.8.x, 2.9.x) but not to 2.12.6, confirming the fix was already present upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 affects jackson-databind versions before 2.12.6. The target is version 2.12.6-tuxcare.2, which contains the upstream fix (commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by tatu.saloranta@iki.fi) that shipped in the upstream 2.12.6 release. The vulnerable code pattern (unguarded eager allocation during JDK deserialization) is not present. The fix limits eager byte array allocation to 100k and uses incremental buffering for larger sizes, preventing the 2GB heap DoS attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "CVE-2021-46877 affects jackson-databind versions before 2.12.6. The target is version 2.12.6-tuxcare.2, which contains the upstream fix (commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by tatu.saloranta@iki.fi) that shipped in the upstream 2.12.6 release. The vulnerable code pattern (unguarded eager allocation during JDK deserialization) is not present. The fix limits eager byte array allocation to 100k and uses incremental buffering for larger sizes, preventing the 2GB heap DoS attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54517 describes a @JsonView bypass vulnerability affecting setterless collection/map properties when routed through the property-based creator buffering path. The vulnerability requires the isMerging() mechanism introduced in jackson-databind#5237 (first released in 2.20.1) which enables setterless properties to be successfully buffered and applied after bean construction. Target versi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54517" }, "impact_statement": "not_affected \u2014 CVE-2026-54517 describes a @JsonView bypass vulnerability affecting setterless collection/map properties when routed through the property-based creator buffering path. The vulnerability requires the isMerging() mechanism introduced in jackson-databind#5237 (first released in 2.20.1) which enables setterless properties to be successfully buffered and applied after bean construction. Target versi..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:24.051298+00:00", "status_notes": "Vulnerability CVE-2026-54518 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54518" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:24.051298+00:00", "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59888" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.12.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:41:00.122732+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.12.6-tuxcare.3.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }