{
  "@id": "urn:uuid:55dbe095-acc9-458c-a9b5-8387fc247f24",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 61,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T14:12:00.505333+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:04:07.366670+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.13.0-tuxcare.3 is much newer and already contains the upstream fix. The vulnerability involved unsafe deserialization of malicious classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, Spring/c3p0 types). The fix blacklists these classes in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES. All vulnerable classes are present in the blacklist at the onboarding commit (75db32f924), confirming the fix was already in the upstream 2.13.0 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.13.0-tuxcare.3 is much newer and already contains the upstream fix. The vulnerability involved unsafe deserialization of malicious classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, Spring/c3p0 types). The fix blacklists these classes in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES. All vulnerable classes are present in the blacklist at the onboarding commit (75db32f924), confirming the fix was already in the upstream 2.13.0 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:40:43.036497+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 does not affect jackson-databind 2.13.0. The vulnerability involved an incomplete deserialization blacklist that allowed remote code execution when Spring libraries were available. The upstream vendor fixed this in version 2.7.9.2 (December 2017) by creating SubTypeValidator and adding Spring framework classes, C3P0, Tomcat/DBCP, and JDK gadget classes to the blacklist. Version 2.13.0 already contains this fix from the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 does not affect jackson-databind 2.13.0. The vulnerability involved an incomplete deserialization blacklist that allowed remote code execution when Spring libraries were available. The upstream vendor fixed this in version 2.7.9.2 (December 2017) by creating SubTypeValidator and adding Spring framework classes, C3P0, Tomcat/DBCP, and JDK gadget classes to the blacklist. Version 2.13.0 already contains this fix from the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:24:51.161829+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target (jackson-databind 2.13.0-tuxcare.3) contains comprehensive protections against this deserialization vulnerability via SubTypeValidator, which blocks dangerous gadget classes including com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl. This fix was shipped in the upstream 2.13.0 release (all #1599 fix commits are ancestors of the TuxCare onboarding commit 75db32f924bd), authored by upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target (jackson-databind 2.13.0-tuxcare.3) contains comprehensive protections against this deserialization vulnerability via SubTypeValidator, which blocks dangerous gadget classes including com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl. This fix was shipped in the upstream 2.13.0 release (all #1599 fix commits are ancestors of the TuxCare onboarding commit 75db32f924bd), authored by upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:13:59.149107+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability involves polymorphic deserialization of org.apache.ibatis.parsing.XPathParser allowing data exfiltration. The upstream fix (commit 27b4defc270) blacklisting this class is present at SubTypeValidator.java:65 and was included in the upstream release 2.13.0 before TuxCare onboarding. Target version 2.13.0 is significantly newer than the affected range (2.0.0-2.9.5), and the fix was authored by upstream maintainer Tatu Saloranta, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability involves polymorphic deserialization of org.apache.ibatis.parsing.XPathParser allowing data exfiltration. The upstream fix (commit 27b4defc270) blacklisting this class is present at SubTypeValidator.java:65 and was included in the upstream release 2.13.0 before TuxCare onboarding. Target version 2.13.0 is significantly newer than the affected range (2.0.0-2.9.5), and the fix was authored by upstream maintainer Tatu Saloranta, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:15:39.453186+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is NOT present in jackson-databind 2.13.0. The vulnerability involves polymorphic deserialization of three dangerous gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled. The fix\u2014adding these classes to the SubTypeValidator blacklist\u2014was authored by upstream maintainer Tatu Saloranta in commits 28badf7ef6 and 7487cf7eb1, and was already included in the upstream jackson-databind 2.13.0 release when TuxCare onboarded it (commit 75db32f924). The target code at SubTypeValidator.java lines 67-72 contains all three blacklist entries, preventing deserialization of these gadget classes and blocking the attack chain before the Goal (code execution or remote connection) can be reached.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 is NOT present in jackson-databind 2.13.0. The vulnerability involves polymorphic deserialization of three dangerous gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled. The fix\u2014adding these classes to the SubTypeValidator blacklist\u2014was authored by upstream maintainer Tatu Saloranta in commits 28badf7ef6 and 7487cf7eb1, and was already included in the upstream jackson-databind 2.13.0 release when TuxCare onboarded it (commit 75db32f924). The target code at SubTypeValidator.java lines 67-72 contains all three blacklist entries, preventing deserialization of these gadget classes and blocking the attack chain before the Goal (code execution or remote connection) can be reached.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:17:04.637381+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind when Default Typing is enabled, allowing attackers to exploit Oracle JDBC classes as deserialization gadgets for LDAP-based code execution. The target version 2.13.0 is NOT affected because the upstream vendor (FasterXML) already fixed this vulnerability by adding the Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) to the SubTypeValidator blocklist in commit 28badf7ef6. This fix was shipped in upstream jackson-databind 2.13.0, which TuxCare then onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 affects jackson-databind when Default Typing is enabled, allowing attackers to exploit Oracle JDBC classes as deserialization gadgets for LDAP-based code execution. The target version 2.13.0 is NOT affected because the upstream vendor (FasterXML) already fixed this vulnerability by adding the Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) to the SubTypeValidator blocklist in commit 28badf7ef6. This fix was shipped in upstream jackson-databind 2.13.0, which TuxCare then onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:41:04.560309+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.0-tuxcare.3) is NOT AFFECTED by CVE-2018-14718. The fix for this vulnerability was already present in the upstream Jackson 2.13.0 release when TuxCare onboarded it. The dangerous slf4j-ext class \"org.slf4j.ext.EventData\" is present in the blocklist at SubTypeValidator.java line 75, preventing polymorphic deserialization attacks. The fix was authored by upstream maintainer Tatu Saloranta in August 2018 and included in all versions from 2.6.7.2 onwards.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "The target repository (jackson-databind 2.13.0-tuxcare.3) is NOT AFFECTED by CVE-2018-14718. The fix for this vulnerability was already present in the upstream Jackson 2.13.0 release when TuxCare onboarded it. The dangerous slf4j-ext class \"org.slf4j.ext.EventData\" is present in the blocklist at SubTypeValidator.java line 75, preventing polymorphic deserialization attacks. The fix was authored by upstream maintainer Tatu Saloranta in August 2018 and included in all versions from 2.6.7.2 onwards.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:57:03.771822+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.13.0-tuxcare.3 is NOT affected by CVE-2018-14719. The vulnerability involves polymorphic deserialization of BlazeDS classes (flex.messaging.*) that can lead to arbitrary code execution. The fix, which adds these classes to a deserialization blacklist, is present in the target at SubTypeValidator.java lines 74-78. This fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and was already included in upstream version 2.13.0 before TuxCare's onboarding. The CVE affects versions \"before 2.9.7\" and the target version 2.13.0 is well above this threshold. The blacklist is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "The target repository jackson-databind version 2.13.0-tuxcare.3 is NOT affected by CVE-2018-14719. The vulnerability involves polymorphic deserialization of BlazeDS classes (flex.messaging.*) that can lead to arbitrary code execution. The fix, which adds these classes to a deserialization blacklist, is present in the target at SubTypeValidator.java lines 74-78. This fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and was already included in upstream version 2.13.0 before TuxCare's onboarding. The CVE affects versions \"before 2.9.7\" and the target version 2.13.0 is well above this threshold. The blacklist is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:04:00.565154+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability was fixed by upstream commit 87d29af25e which was already included in the upstream jackson-databind 2.13.0 release that TuxCare onboarded. The fix adds four dangerous class names (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) to a blocklist that prevents polymorphic deserialization attacks. This blocklist is present and actively enforced in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability was fixed by upstream commit 87d29af25e which was already included in the upstream jackson-databind 2.13.0 release that TuxCare onboarded. The fix adds four dangerous class names (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) to a blocklist that prevents polymorphic deserialization attacks. This blocklist is present and actively enforced in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:32:37.942271+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns the failure to block org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization, enabling SSRF attacks. The fix was already included in the upstream jackson-databind 2.13.0 release (commit 87d29af25e by Tatu Saloranta on 2018-08-16), which TuxCare later onboarded. The dangerous class is properly blocked in SubTypeValidator.java line 78, and the validation is enforced during deserialization via BeanDeserializerFactory.java line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns the failure to block org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization, enabling SSRF attacks. The fix was already included in the upstream jackson-databind 2.13.0 release (commit 87d29af25e by Tatu Saloranta on 2018-08-16), which TuxCare later onboarded. The dangerous class is properly blocked in SubTypeValidator.java line 78, and the validation is enforced during deserialization via BeanDeserializerFactory.java line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:37:57.932432+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.0-tuxcare.3 is NOT affected by CVE-2018-19360. The vulnerability concerns polymorphic deserialization of org.apache.axis2.transport.jms.JMSOutTransportInfo and three other gadget classes that could enable code execution. The upstream vendor (FasterXML) fixed this by adding these classes to SubTypeValidator's blocklist in commit 72cd4025a22 (2018-11-19). This fix was already present in the upstream 2.13.0 release that TuxCare onboarded, predating all TuxCare commits. The defense is active: BeanDeserializerFactory calls SubTypeValidator.validateSubType during polymorphic deserialization, which rejects any attempt to deserialize the blocked classes, preventing instantiation of attacker-chosen gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "The target jackson-databind version 2.13.0-tuxcare.3 is NOT affected by CVE-2018-19360. The vulnerability concerns polymorphic deserialization of org.apache.axis2.transport.jms.JMSOutTransportInfo and three other gadget classes that could enable code execution. The upstream vendor (FasterXML) fixed this by adding these classes to SubTypeValidator's blocklist in commit 72cd4025a22 (2018-11-19). This fix was already present in the upstream 2.13.0 release that TuxCare onboarded, predating all TuxCare commits. The defense is active: BeanDeserializerFactory calls SubTypeValidator.validateSubType during polymorphic deserialization, which rejects any attempt to deserialize the blocked classes, preventing instantiation of attacker-chosen gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:54:24.400671+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind 2.x before 2.9.8 due to missing blocklist entries for openjpa classes in polymorphic deserialization. The target repository (jackson-databind 2.13.0-tuxcare.3) is not affected because the fix was already present in the upstream 2.13.0 release when TuxCare onboarded it. The SubTypeValidator.java file contains the required blocklist entries for org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime at lines 82-83, preventing these dangerous classes from being deserialized. Fix commit 72cd4025a2 by upstream author Tatu Saloranta was included in the upstream release before TuxCare's onboarding commit 75db32f924.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 affects jackson-databind 2.x before 2.9.8 due to missing blocklist entries for openjpa classes in polymorphic deserialization. The target repository (jackson-databind 2.13.0-tuxcare.3) is not affected because the fix was already present in the upstream 2.13.0 release when TuxCare onboarded it. The SubTypeValidator.java file contains the required blocklist entries for org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime at lines 82-83, preventing these dangerous classes from being deserialized. Fix commit 72cd4025a2 by upstream author Tatu Saloranta was included in the upstream release before TuxCare's onboarding commit 75db32f924.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:23:04.955983+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.13.0. The vulnerability involves polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The upstream fix (commit 72cd4025a2) added this class to the blocklist in SubTypeValidator.java and was already present in version 2.13.0 when TuxCare onboarded it. The fix is active and enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.13.0. The vulnerability involves polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The upstream fix (commit 72cd4025a2) added this class to the blocklist in SubTypeValidator.java and was already present in version 2.13.0 when TuxCare onboarded it. The fix is active and enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability required two specific gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to be absent from the deserialization blacklist. These classes are already present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 62-63), preventing the exploit. The fix was shipped in the upstream 2.13.0 release (commit 038b471e2e by upstream maintainer Tatu Saloranta on Jan 21, 2018) before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability required two specific gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to be absent from the deserialization blacklist. These classes are already present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 62-63), preventing the exploit. The fix was shipped in the upstream 2.13.0 release (commit 038b471e2e by upstream maintainer Tatu Saloranta on Jan 21, 2018) before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:34:53.925887+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.0-tuxcare.3 is NOT AFFECTED by CVE-2018-7489. The upstream fix for this vulnerability (blocking deserialization of c3p0 DataSource classes) was already present in the upstream 2.13.0 release that TuxCare onboarded. The fix commit (6799f8f10cc78e9af6d443ed6982d00a13f2e7d2 by upstream maintainer Tatu Saloranta) is an ancestor of the first TuxCare commit in HEAD's history, proving it shipped in the original upstream release. The defense code is present in SubTypeValidator.java lines 288-297, blocking any class matching pattern com.mchange.v2.c3p0.*DataSource from being deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "The target jackson-databind 2.13.0-tuxcare.3 is NOT AFFECTED by CVE-2018-7489. The upstream fix for this vulnerability (blocking deserialization of c3p0 DataSource classes) was already present in the upstream 2.13.0 release that TuxCare onboarded. The fix commit (6799f8f10cc78e9af6d443ed6982d00a13f2e7d2 by upstream maintainer Tatu Saloranta) is an ancestor of the first TuxCare commit in HEAD's history, proving it shipped in the original upstream release. The defense code is present in SubTypeValidator.java lines 288-297, blocking any class matching pattern com.mchange.v2.c3p0.*DataSource from being deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:29:44.182918+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind versions before 2.9.9. The target version 2.13.0-tuxcare.3 already contains the upstream fix that adds `com.mysql.cj.jdbc.admin.MiniAdmin` to the deserialization blacklist in SubTypeValidator.java (line 88). The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit dda513bd72 and was part of the upstream 2.13.0 release when TuxCare onboarded it (onboarding commit 75db32f924 by amoniatovskiy@cloudlinux.com). The vulnerable code pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 affects jackson-databind versions before 2.9.9. The target version 2.13.0-tuxcare.3 already contains the upstream fix that adds `com.mysql.cj.jdbc.admin.MiniAdmin` to the deserialization blacklist in SubTypeValidator.java (line 88). The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit dda513bd72 and was part of the upstream 2.13.0 release when TuxCare onboarded it (onboarding commit 75db32f924 by amoniatovskiy@cloudlinux.com). The vulnerable code pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T18:25:03.088691+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.13.0 is not affected by CVE-2019-12384. The vulnerability involves polymorphic deserialization of the dangerous logback-core class \"ch.qos.logback.core.db.DriverManagerConnectionSource\" which can lead to remote code execution. The fix (adding this class to the deserialization blocklist) was already present in upstream jackson-databind 2.13.0 before TuxCare onboarded it. The blo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 Target version 2.13.0 is not affected by CVE-2019-12384. The vulnerability involves polymorphic deserialization of the dangerous logback-core class \"ch.qos.logback.core.db.DriverManagerConnectionSource\" which can lead to remote code execution. The fix (adding this class to the deserialization blocklist) was already present in upstream jackson-databind 2.13.0 before TuxCare onboarded it. The blo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T07:06:00.125315+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes enabling arbitrary file reads. The upstream fix (commit 5f7c69bba0 by Tatu Saloranta) adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist was already included in the upstream 2.13.0 ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes enabling arbitrary file reads. The upstream fix (commit 5f7c69bba0 by Tatu Saloranta) adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist was already included in the upstream 2.13.0 ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:01:20.989527+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.0-tuxcare.3 is not affected by CVE-2019-14379. The fix (blacklisting net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) was already present in the upstream jackson-databind 2.13.0 release that TuxCare onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "The target jackson-databind 2.13.0-tuxcare.3 is not affected by CVE-2019-14379. The fix (blacklisting net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) was already present in the upstream jackson-databind 2.13.0 release that TuxCare onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:28:16.907403+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 describes a polymorphic typing vulnerability in jackson-databind when Default Typing is enabled, allowing arbitrary code execution via JNDI injection through dangerous gadget classes (specifically ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup). The upstream fix (commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b by Tatu Saloranta) adds these classes to the deserialization blacklist in SubTypeValidator.java. This fix is already present in the target repository (jackson-databind 2.13.0-tuxcare.3) at lines 98 and 102 of SubTypeValidator.java. The fix was shipped in the upstream jackson-databind 2.13.0 release before TuxCare onboarded it (first TuxCare commit: 75db32f924bd). The defense mechanism rejects deserialization when polymorphic type information references these blacklisted classes by checking against an immutable blacklist (DEFAULT_NO_DESER_CLASS_NAMES) and throwing JsonMappingException before instantiation. Target is not_affected because the vulnerable code pattern does not exist - the upstream vendor fix was already included in version 2.13.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 describes a polymorphic typing vulnerability in jackson-databind when Default Typing is enabled, allowing arbitrary code execution via JNDI injection through dangerous gadget classes (specifically ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup). The upstream fix (commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b by Tatu Saloranta) adds these classes to the deserialization blacklist in SubTypeValidator.java. This fix is already present in the target repository (jackson-databind 2.13.0-tuxcare.3) at lines 98 and 102 of SubTypeValidator.java. The fix was shipped in the upstream jackson-databind 2.13.0 release before TuxCare onboarded it (first TuxCare commit: 75db32f924bd). The defense mechanism rejects deserialization when polymorphic type information references these blacklisted classes by checking against an immutable blacklist (DEFAULT_NO_DESER_CLASS_NAMES) and throwing JsonMappingException before instantiation. Target is not_affected because the vulnerable code pattern does not exist - the upstream vendor fix was already included in version 2.13.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:43:48.744845+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10/2.8.11.5/2.6.7.3 due to polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource gadget classes. The target repository (jackson-databind 2.13.0-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream 2.13.0 release that TuxCare onboarded. The vulnerable code pattern (ability to deserialize these dangerous classes) is not present - they are blacklisted in SubTypeValidator.java lines 105-107.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10/2.8.11.5/2.6.7.3 due to polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource gadget classes. The target repository (jackson-databind 2.13.0-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream 2.13.0 release that TuxCare onboarded. The vulnerable code pattern (ability to deserialize these dangerous classes) is not present - they are blacklisted in SubTypeValidator.java lines 105-107.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:52:50.541440+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability, which allowed polymorphic deserialization of malicious commons-configuration JNDI classes leading to arbitrary code execution, was fixed in upstream jackson-databind before version 2.13.0. The target contains the fix (commit 41b7f9b901) which adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist in SubTypeValidator. This fix was shipped in the upstream release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability, which allowed polymorphic deserialization of malicious commons-configuration JNDI classes leading to arbitrary code execution, was fixed in upstream jackson-databind before version 2.13.0. The target contains the fix (commit 41b7f9b901) which adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist in SubTypeValidator. This fix was shipped in the upstream release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) that could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 998efd7082 by adding the malicious class to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.13.0 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of TuxCare's first onboarding commit (75db32f924 \"Onboard version 2.13.0\"). The target code at line 117 of SubTypeValidator.java contains the exact blocklist entry that prevents deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) that could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 998efd7082 by adding the malicious class to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.13.0 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of TuxCare's first onboarding commit (75db32f924 \"Onboard version 2.13.0\"). The target code at line 117 of SubTypeValidator.java contains the exact blocklist entry that prevents deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:01:58.863426+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.0-tuxcare.3 is NOT AFFECTED by CVE-2019-16335. The vulnerability relates to unsafe polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could enable arbitrary code execution via gadget chain exploitation. The upstream vendor (Tatu Saloranta) fixed this vulnerability in commit 73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db by adding HikariDataSource to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.13.0 release when TuxCare onboarded it (first TuxCare commit: 75db32f924bd0a2a582bf36769408c07a6e1141e). The vulnerable pattern is not present in the target code - the blocklist entry exists at SubTypeValidator.java:107.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "The target jackson-databind 2.13.0-tuxcare.3 is NOT AFFECTED by CVE-2019-16335. The vulnerability relates to unsafe polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could enable arbitrary code execution via gadget chain exploitation. The upstream vendor (Tatu Saloranta) fixed this vulnerability in commit 73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db by adding HikariDataSource to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.13.0 release when TuxCare onboarded it (first TuxCare commit: 75db32f924bd0a2a582bf36769408c07a6e1141e). The vulnerable pattern is not present in the target code - the blocklist entry exists at SubTypeValidator.java:107.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:00:38.120709+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. jackson-databind 2.13.0 is not affected by CVE-2019-16942. The target contains the upstream vendor's fix that blocklists the vulnerable commons-dbcp classes (org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource). The fix was added by FasterXML maintainer Tatu Saloranta in commit 328a0f833d on 2019-09-28, seven years before TuxCare onboarded version 2.13.0. The blocklist is actively enforced by SubTypeValidator.validateSubType() at line 269, which checks the class name against _cfgIllegalClassNames and throws a JsonMappingException (line 302-303) preventing deserialization of blocked types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "jackson-databind 2.13.0 is not affected by CVE-2019-16942. The target contains the upstream vendor's fix that blocklists the vulnerable commons-dbcp classes (org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource). The fix was added by FasterXML maintainer Tatu Saloranta in commit 328a0f833d on 2019-09-28, seven years before TuxCare onboarded version 2.13.0. The blocklist is actively enforced by SubTypeValidator.validateSubType() at line 269, which checks the class name against _cfgIllegalClassNames and throws a JsonMappingException (line 302-303) preventing deserialization of blocked types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:12:26.130269+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns unsafe deserialization of P6DataSource and commons-dbcp DataSource gadget classes when polymorphic typing is enabled. The upstream vendor (FasterXML) fixed this in commits 9593e16cf5 and 328a0f833d by adding these classes to SubTypeValidator's blacklist. Both fix commits are ancestors of the first TuxCare commit (75db32f924 \"Onboard version 2.13.0\"), confirming the fix shipped in the original upstream 2.13.0 release. The target code contains all three blacklist entries at SubTypeValidator.java lines 124-127. Fix author: tatu.saloranta@iki.fi (upstream maintainer, not TuxCare/CloudLinux).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns unsafe deserialization of P6DataSource and commons-dbcp DataSource gadget classes when polymorphic typing is enabled. The upstream vendor (FasterXML) fixed this in commits 9593e16cf5 and 328a0f833d by adding these classes to SubTypeValidator's blacklist. Both fix commits are ancestors of the first TuxCare commit (75db32f924 \"Onboard version 2.13.0\"), confirming the fix shipped in the original upstream 2.13.0 release. The target code contains all three blacklist entries at SubTypeValidator.java lines 124-127. Fix author: tatu.saloranta@iki.fi (upstream maintainer, not TuxCare/CloudLinux).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:26:39.614024+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to a polymorphic typing vulnerability related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target version 2.13.0-tuxcare.3 already contains the upstream fix (commit 191a4cdf87) that adds this class to the deserialization blocklist in SubTypeValidator.java:99. The fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.10 (September 2019), well before the 2.13.0 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to a polymorphic typing vulnerability related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target version 2.13.0-tuxcare.3 already contains the upstream fix (commit 191a4cdf87) that adds this class to the deserialization blocklist in SubTypeValidator.java:99. The fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.10 (September 2019), well before the 2.13.0 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:45:27.175080+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability requires deserialization of dangerous log4j-extras classes (org.apache.log4j.receivers.db.JNDIConnectionSource and DriverManagerConnectionSource) when Default Typing is enabled. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) added these classes to the SubTypeValidator blacklist and was already included in the upstream jackson-databind 2.13.0 release that TuxCare onboarded. The fix prevents these classes from being deserialized, blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability requires deserialization of dangerous log4j-extras classes (org.apache.log4j.receivers.db.JNDIConnectionSource and DriverManagerConnectionSource) when Default Typing is enabled. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) added these classes to the SubTypeValidator blacklist and was already included in the upstream jackson-databind 2.13.0 release that TuxCare onboarded. The fix prevents these classes from being deserialized, blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is not present in jackson-databind 2.13.0. The fix that blocks deserialization of net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector was already included in the upstream 2.13.0 release. The vulnerable pattern (unblocked ehcache classes allowing JNDI injection) does not exist in this version because the defense code (blocklist entries at SubTypeValidator.java:134-135) shipped with the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is not present in jackson-databind 2.13.0. The fix that blocks deserialization of net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector was already included in the upstream 2.13.0 release. The vulnerable pattern (unblocked ehcache classes allowing JNDI injection) does not exist in this version because the defense code (blocklist entries at SubTypeValidator.java:134-135) shipped with the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:58:57.863833+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability involves unsafe deserialization of ignite-jta JNDI gadget classes that can trigger remote code execution. The upstream fix (commit a424c038ba by Tatu Saloranta) was already included in the upstream 2.13.0 release before TuxCare onboarded it. The three dangerous classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) are blocked in SubTypeValidator.java lines 158-160, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability involves unsafe deserialization of ignite-jta JNDI gadget classes that can trigger remote code execution. The upstream fix (commit a424c038ba by Tatu Saloranta) was already included in the upstream 2.13.0 release before TuxCare onboarded it. The three dangerous classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) are blocked in SubTypeValidator.java lines 158-160, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability involves deserialization of malicious gadget classes (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and related classes) that can lead to remote code execution via JNDI injection. The fix (blocklist entries preventing deserialization of these classes) was already present in the upstream jackson-databind 2.13.0 release, which TuxCare onboarded via commit 75db32f9. The original upstream fix was authored by Tatu Saloranta (commit 592872f4) on March 15, 2020, and was included in jackson-databind 2.9.10.4. Since 2.13.0 was released much later (October 2021), the fix was already present when TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability involves deserialization of malicious gadget classes (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and related classes) that can lead to remote code execution via JNDI injection. The fix (blocklist entries preventing deserialization of these classes) was already present in the upstream jackson-databind 2.13.0 release, which TuxCare onboarded via commit 75db32f9. The original upstream fix was authored by Tatu Saloranta (commit 592872f4) on March 15, 2020, and was included in jackson-databind 2.9.10.4. Since 2.13.0 was released much later (October 2021), the fix was already present when TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:23:34.424796+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 targets the deserialization gadget com.caucho.config.types.ResourceRef in jackson-databind versions before 2.9.10.4. The target repository is jackson-databind 2.13.0-tuxcare.3, which already contains the upstream fix that adds ResourceRef to the deserialization blocklist in SubTypeValidator.java (line 167). The fix commit (1645efbd392989cf015f459a91c999e59c921b15) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.13.0 release before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 targets the deserialization gadget com.caucho.config.types.ResourceRef in jackson-databind versions before 2.9.10.4. The target repository is jackson-databind 2.13.0-tuxcare.3, which already contains the upstream fix that adds ResourceRef to the deserialization blocklist in SubTypeValidator.java (line 167). The fix commit (1645efbd392989cf015f459a91c999e59c921b15) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.13.0 release before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.0-tuxcare.3 is not affected by CVE-2020-10968. The vulnerability requires the ability to deserialize org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class. The upstream fix (commit 05d7e0e by Tatu Saloranta, March 2020) added this class to the SubTypeValidator blocklist, preventing its instantiation during polymorphic deserialization. This fix was already included in the upstream jackson-databind 2.13.0 release (September 2021) before TuxCare onboarded it. The target code at SubTypeValidator.java:169-171 contains the blocklist entries that block both org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider, making deserialization attacks using these gadgets impossible.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "Target jackson-databind 2.13.0-tuxcare.3 is not affected by CVE-2020-10968. The vulnerability requires the ability to deserialize org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class. The upstream fix (commit 05d7e0e by Tatu Saloranta, March 2020) added this class to the SubTypeValidator blocklist, preventing its instantiation during polymorphic deserialization. This fix was already included in the upstream jackson-databind 2.13.0 release (September 2021) before TuxCare onboarded it. The target code at SubTypeValidator.java:169-171 contains the blocklist entries that block both org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider, making deserialization attacks using these gadgets impossible.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 does NOT affect jackson-databind 2.13.0-tuxcare.3. The fix for this vulnerability (adding javax.swing.JEditorPane to the deserialization blacklist) was already present in the upstream 2.13.0 release that TuxCare onboarded. The vulnerable code pattern (missing blacklist entry) is not present in the target. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 6ba48457984943df0de92c54144f7dcae01b1221, which shipped in the upstream release before TuxCare's onboarding commit 75db32f924.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 does NOT affect jackson-databind 2.13.0-tuxcare.3. The fix for this vulnerability (adding javax.swing.JEditorPane to the deserialization blacklist) was already present in the upstream 2.13.0 release that TuxCare onboarded. The vulnerable code pattern (missing blacklist entry) is not present in the target. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 6ba48457984943df0de92c54144f7dcae01b1221, which shipped in the upstream release before TuxCare's onboarding commit 75db32f924.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is not present in jackson-databind 2.13.0. The vulnerability concerns unsafe deserialization of org.apache.activemq.* gadget classes through polymorphic typing. The upstream fix (commit c14c9f99ed by tatu.saloranta@iki.fi) adding these classes to the deserialization blocklist was already present in version 2.13.0 when TuxCare onboarded it. All nine activemq classes are blocked in SubTypeValidator.java lines 173-184, preventing the attack chain from INPUT (JSON with polymorphic type hints) to GOAL (arbitrary code execution via malicious object deserialization).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 is not present in jackson-databind 2.13.0. The vulnerability concerns unsafe deserialization of org.apache.activemq.* gadget classes through polymorphic typing. The upstream fix (commit c14c9f99ed by tatu.saloranta@iki.fi) adding these classes to the deserialization blocklist was already present in version 2.13.0 when TuxCare onboarded it. All nine activemq classes are blocked in SubTypeValidator.java lines 173-184, preventing the attack chain from INPUT (JSON with polymorphic type hints) to GOAL (arbitrary code execution via malicious object deserialization).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability involves deserialization of the org.apache.commons.proxy.provider.remoting.RmiProvider gadget class through polymorphic typing. The upstream vendor (Tatu Saloranta) fixed this in commit 05d7e0e13f on March 25, 2020 by adding RmiProvider to the SubTypeValidator blacklist. This fix shipped with upstream jackson-databind 2.13.0, which TuxCare later onboarded. The target contains the fix at SubTypeValidator.java:186, blocking deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability involves deserialization of the org.apache.commons.proxy.provider.remoting.RmiProvider gadget class through polymorphic typing. The upstream vendor (Tatu Saloranta) fixed this in commit 05d7e0e13f on March 25, 2020 by adding RmiProvider to the SubTypeValidator blacklist. This fix shipped with upstream jackson-databind 2.13.0, which TuxCare later onboarded. The target contains the fix at SubTypeValidator.java:186, blocking deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.0-tuxcare.3 is not affected by CVE-2020-11113. The vulnerability involves deserialization of the malicious gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The fix (adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was already present in the upstream 2.13.0 release that TuxCare onboarded. The fix commit e2ba12d5d6 by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of the first TuxCare commit (75db32f924 \"Onboard version 2.13.0\"), confirming it shipped in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "The target jackson-databind 2.13.0-tuxcare.3 is not affected by CVE-2020-11113. The vulnerability involves deserialization of the malicious gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The fix (adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was already present in the upstream 2.13.0 release that TuxCare onboarded. The fix commit e2ba12d5d6 by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of the first TuxCare commit (75db32f924 \"Onboard version 2.13.0\"), confirming it shipped in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns Jackson deserialization gadgets allowing arbitrary code execution through org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The upstream fix (commit 113e89fb08) added both classes to the SubTypeValidator blocklist, preventing their deserialization during polymorphic type handling. This fix was authored by Tatu Saloranta (upstream maintainer, tatu.saloranta@iki.fi) and shipped in the upstream release 2.13.0 that TuxCare onboarded (commit 75db32f924). The target contains the fix at SubTypeValidator.java:52-54.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns Jackson deserialization gadgets allowing arbitrary code execution through org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The upstream fix (commit 113e89fb08) added both classes to the SubTypeValidator blocklist, preventing their deserialization during polymorphic type handling. This fix was authored by Tatu Saloranta (upstream maintainer, tatu.saloranta@iki.fi) and shipped in the upstream release 2.13.0 that TuxCare onboarded (commit 75db32f924). The target contains the fix at SubTypeValidator.java:52-54.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 related to deserialization gadgets using org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.13.0-tuxcare.3) contains the upstream fix commit 77040d85e3 which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 189). This fix was authored by the upstream Jackson maintainer (Tatu Saloranta) and shipped in the upstream 2.13.0 release that TuxCare onboarded. The vulnerable pattern is not present because the blocklist prevents deserialization of this dangerous class, throwing a JsonMappingException during validation. The defense is mandatory and cannot be bypassed without code modification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 related to deserialization gadgets using org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.13.0-tuxcare.3) contains the upstream fix commit 77040d85e3 which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 189). This fix was authored by the upstream Jackson maintainer (Tatu Saloranta) and shipped in the upstream 2.13.0 release that TuxCare onboarded. The vulnerable pattern is not present because the blocklist prevents deserialization of this dangerous class, throwing a JsonMappingException during validation. The defense is mandatory and cannot be bypassed without code modification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to deserialization gadget vulnerability related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target repository version 2.13.0-tuxcare.3 is NOT AFFECTED because the upstream fix was already present in the upstream 2.13.0 release that TuxCare onboarded. The vulnerable gadget class is blocked in SubTypeValidator.java at lines 191-195.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to deserialization gadget vulnerability related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target repository version 2.13.0-tuxcare.3 is NOT AFFECTED because the upstream fix was already present in the upstream 2.13.0 release that TuxCare onboarded. The vulnerable gadget class is blocked in SubTypeValidator.java at lines 191-195.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.13.0-tuxcare.3 is NOT AFFECTED by CVE-2020-14061. The vulnerability (unsafe deserialization of oracle.jms gadget classes) is not present because the upstream fix was already included in version 2.13.0 before TuxCare onboarded it. The five oracle.jms classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java at lines 200-204, preventing their use in polymorphic deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "The target repository jackson-databind version 2.13.0-tuxcare.3 is NOT AFFECTED by CVE-2020-14061. The vulnerability (unsafe deserialization of oracle.jms gadget classes) is not present because the upstream fix was already included in version 2.13.0 before TuxCare onboarded it. The five oracle.jms classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java at lines 200-204, preventing their use in polymorphic deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.0-tuxcare.3 is not affected by CVE-2020-14062. The fix (blacklisting com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool in SubTypeValidator) was already present in upstream release 2.13.0 when TuxCare onboarded it. The upstream vendor (Tatu Saloranta) committed the fix in 840eae2ca81c597a0010b2126f32dce17d384b70, which predates TuxCare's first commit (onboarding 75db32f924bd0a2a582bf36769408c07a6e1141e). This is an upstream fix that shipped in the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "Target version 2.13.0-tuxcare.3 is not affected by CVE-2020-14062. The fix (blacklisting com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool in SubTypeValidator) was already present in upstream release 2.13.0 when TuxCare onboarded it. The upstream vendor (Tatu Saloranta) committed the fix in 840eae2ca81c597a0010b2126f32dce17d384b70, which predates TuxCare's first commit (onboarding 75db32f924bd0a2a582bf36769408c07a6e1141e). This is an upstream fix that shipped in the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind versions before 2.9.10.5, involving unsafe deserialization of org.jsecurity.realm.jndi.JndiRealmFactory leading to arbitrary code execution. The target is jackson-databind version 2.13.0-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in commit f6d9c664f6 by adding org.jsecurity.realm.jndi.JndiRealmFactory to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.0 release that TuxCare onboarded (the fix commit is an ancestor of the first TuxCare onboarding commit 75db32f924), so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 affects jackson-databind versions before 2.9.10.5, involving unsafe deserialization of org.jsecurity.realm.jndi.JndiRealmFactory leading to arbitrary code execution. The target is jackson-databind version 2.13.0-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in commit f6d9c664f6 by adding org.jsecurity.realm.jndi.JndiRealmFactory to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.0 release that TuxCare onboarded (the fix commit is an ancestor of the first TuxCare onboarding commit 75db32f924), so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:17:28.173576+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is NOT present in jackson-databind 2.13.0. The vulnerability involves deserialization of the malicious gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The fix (adding this class to the SubTypeValidator blacklist) was already included in the upstream 2.13.0 release that TuxCare onboarded. The vulnerable pattern (allowing unrestricted deserialization of AnterosDBCPDataSource) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 is NOT present in jackson-databind 2.13.0. The vulnerability involves deserialization of the malicious gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The fix (adding this class to the SubTypeValidator blacklist) was already included in the upstream 2.13.0 release that TuxCare onboarded. The vulnerable pattern (allowing unrestricted deserialization of AnterosDBCPDataSource) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:11:46.166695+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability, which involves JNDI injection via deserialization of com.pastdev.httpcomponents.configuration.JndiConfiguration, was fixed by the upstream FasterXML project in July 2020 (commit 6cc9f1a1af). This fix was already included in the upstream jackson-databind 2.13.0 release, which TuxCare onboarded in September 2026. The vulnerable class is present in the deny list at SubTypeValidator.java:210, preventing its deserialization when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability, which involves JNDI injection via deserialization of com.pastdev.httpcomponents.configuration.JndiConfiguration, was fixed by the upstream FasterXML project in July 2020 (commit 6cc9f1a1af). This fix was already included in the upstream jackson-databind 2.13.0 release, which TuxCare onboarded in September 2026. The vulnerable class is present in the deny list at SubTypeValidator.java:210, preventing its deserialization when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE in Jackson Databind) is NOT present in target version 2.13.0. The upstream vendor fix (commit 612f971b by Tatu Saloranta) was already included in the 2.13.0 release that TuxCare onboarded. The fix adds two XML parser security features to DOMDeserializer: (1) disallow-doctype-decl=true prevents DOCTYPE declarations, and (2) load-external-dtd=false prevents loading external DTD files. These protections are present in the target's DOMDeserializer.java at lines 43-49, effectively blocking XXE attacks via XML entity expansion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE in Jackson Databind) is NOT present in target version 2.13.0. The upstream vendor fix (commit 612f971b by Tatu Saloranta) was already included in the 2.13.0 release that TuxCare onboarded. The fix adds two XML parser security features to DOMDeserializer: (1) disallow-doctype-decl=true prevents DOCTYPE declarations, and (2) load-external-dtd=false prevents loading external DTD files. These protections are present in the target's DOMDeserializer.java at lines 43-49, effectively blocking XXE attacks via XML entity expansion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:18:54.750507+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability affects versions before 2.9.10.8. The target version 2.13.0 already contains the upstream fix (commit 41b8bdb5 by Tatu Saloranta) that blocklists org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. This fix was shipped in the upstream 2.13.0 release before TuxCare onboarded it, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "CVE-2020-35490 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability affects versions before 2.9.10.8. The target version 2.13.0 already contains the upstream fix (commit 41b8bdb5 by Tatu Saloranta) that blocklists org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. This fix was shipped in the upstream 2.13.0 release before TuxCare onboarded it, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:28:48.622691+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns deserialization gadgets related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. These classes were added to the deserialization blacklist in upstream commit 41b8bdb5cc (Fixed #2986) by Tatu Saloranta, which shipped in the upstream release 2.13.0. The fix was already present when TuxCare onboarded version 2.13.0 (commit 75db32f924). The target's SubTypeValidator.java contains the blacklist entries at lines 217-218, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns deserialization gadgets related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. These classes were added to the deserialization blacklist in upstream commit 41b8bdb5cc (Fixed #2986) by Tatu Saloranta, which shipped in the upstream release 2.13.0. The fix was already present when TuxCare onboarded version 2.13.0 (commit 75db32f924). The target's SubTypeValidator.java contains the blacklist entries at lines 217-218, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:52:50.063962+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728: Target jackson-databind 2.13.0-tuxcare.3 is NOT AFFECTED. The upstream fix (commit 1ca0388c by Tatu Saloranta) that blocks deserialization of the gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool was already present in the upstream 2.13.0 release when TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:240, and the validation mechanism at lines 269-270 actively prevents deserialization of this class, blocking the attack chain from Input (JSON with polymorphic type information) to Goal (arbitrary code execution).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728: Target jackson-databind 2.13.0-tuxcare.3 is NOT AFFECTED. The upstream fix (commit 1ca0388c by Tatu Saloranta) that blocks deserialization of the gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool was already present in the upstream 2.13.0 release when TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:240, and the validation mechanism at lines 269-270 actively prevents deserialization of this class, blocking the attack chain from Input (JSON with polymorphic type information) to Goal (arbitrary code execution).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:21:23.269302+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.0-tuxcare.3 is NOT affected by CVE-2020-36179. The vulnerability involves deserialization gadgets using DriverAdapterCPDS classes from commons-dbcp. The upstream fix (commit 3ded28aece by Tatu Saloranta on 2020-12-31) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in the upstream 2.13.0 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (75db32f924 \"Onboard version 2.13.0\"). The CVE explicitly states it affects \"2.x before 2.9.10.8\" - since 2.13.0 > 2.9.10.8, the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "The target jackson-databind 2.13.0-tuxcare.3 is NOT affected by CVE-2020-36179. The vulnerability involves deserialization gadgets using DriverAdapterCPDS classes from commons-dbcp. The upstream fix (commit 3ded28aece by Tatu Saloranta on 2020-12-31) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in the upstream 2.13.0 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (75db32f924 \"Onboard version 2.13.0\"). The CVE explicitly states it affects \"2.x before 2.9.10.8\" - since 2.13.0 > 2.9.10.8, the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:33:21.899203+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 (jackson-databind deserialization gadget for org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS) is NOT AFFECTING this target. The fix was already present in upstream jackson-databind 2.13.0 before TuxCare onboarded it. The vulnerable pattern (missing blocklist entries for DriverAdapterCPDS class variants) has been removed by upstream commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b authored by Tatu Saloranta on 2020-12-31. All five DriverAdapterCPDS variants added in the upstream patch are present in the target's SubTypeValidator.java blocklist, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 (jackson-databind deserialization gadget for org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS) is NOT AFFECTING this target. The fix was already present in upstream jackson-databind 2.13.0 before TuxCare onboarded it. The vulnerable pattern (missing blocklist entries for DriverAdapterCPDS class variants) has been removed by upstream commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b authored by Tatu Saloranta on 2020-12-31. All five DriverAdapterCPDS variants added in the upstream patch are present in the target's SubTypeValidator.java blocklist, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:40:07.551074+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability was fixed in upstream release 2.13.0 (before TuxCare onboarding) by commit 3ded28aece, which added the vulnerable class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS` and related DriverAdapterCPDS variants to the deserialization blocklist in SubTypeValidator. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 is NOT present in jackson-databind 2.13.0-tuxcare.3. The vulnerability was fixed in upstream release 2.13.0 (before TuxCare onboarding) by commit 3ded28aece, which added the vulnerable class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS` and related DriverAdapterCPDS variants to the deserialization blocklist in SubTypeValidator. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:10:29.791973+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.13.0-tuxcare.3. The upstream fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS was already included in upstream release 2.13.0 before TuxCare onboarded the project. The vulnerable class is in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:234, and this blocklist is enforced during bean deserializer creation at BeanDeserializerFactory.java:140, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.13.0-tuxcare.3. The upstream fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS was already included in upstream release 2.13.0 before TuxCare onboarded the project. The vulnerable class is in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:234, and this blocklist is enforced during bean deserializer creation at BeanDeserializerFactory.java:140, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:19:43.444136+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is NOT present in jackson-databind 2.13.0. The fix (blocklist entry for org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) was shipped in the upstream 2.13.0 release by Tatu Saloranta (commit 12e23c962f, Dec 31 2020). TuxCare onboarded version 2.13.0 in commit 75db32f924, which already included this upstream fix. The blocklist entry exists in SubTypeValidator.java:243 and prevents deserialization of the dangerous gadget class, blocking the attack path from polymorphic type metadata to JNDI-based RCE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 is NOT present in jackson-databind 2.13.0. The fix (blocklist entry for org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) was shipped in the upstream 2.13.0 release by Tatu Saloranta (commit 12e23c962f, Dec 31 2020). TuxCare onboarded version 2.13.0 in commit 75db32f924, which already included this upstream fix. The blocklist entry exists in SubTypeValidator.java:243 and prevents deserialization of the dangerous gadget class, blocking the attack path from polymorphic type metadata to JNDI-based RCE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource classes. The target version 2.13.0-tuxcare.3 contains the upstream fix (commit 567194c53a) which was already present in the upstream 2.13.0 release before TuxCare onboarded it. The vulnerable deserialization gadget classes are properly blocked in SubTypeValidator.java lines 235-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource classes. The target version 2.13.0-tuxcare.3 contains the upstream fix (commit 567194c53a) which was already present in the upstream 2.13.0 release before TuxCare onboarded it. The vulnerable deserialization gadget classes are properly blocked in SubTypeValidator.java lines 235-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:03:43.787457+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8. The target version 2.13.0-tuxcare.3 is not vulnerable because the upstream 2.13.0 release (released Sep 2021) already included the fix that blocks the dangerous gadget classes org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource from deserialization. The fix was committed upstream by Tatu Saloranta on Dec 26, 2020 (commit 567194c) and is present in SubTypeValidator.java lines 234-236. TuxCare onboarded this already-fixed upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8. The target version 2.13.0-tuxcare.3 is not vulnerable because the upstream 2.13.0 release (released Sep 2021) already included the fix that blocks the dangerous gadget classes org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource from deserialization. The fix was committed upstream by Tatu Saloranta on Dec 26, 2020 (commit 567194c) and is present in SubTypeValidator.java lines 234-236. TuxCare onboarded this already-fixed upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:27:51.969855+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns deserialization of malicious gadget classes org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 3e8fa3beea) was already included in the original jackson-databind 2.13.0 release that TuxCare onboarded. The blocklist in SubTypeValidator.java (lines 227-230) prevents deserialization of these dangerous classes, blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns deserialization of malicious gadget classes org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 3e8fa3beea) was already included in the original jackson-databind 2.13.0 release that TuxCare onboarded. The blocklist in SubTypeValidator.java (lines 227-230) prevents deserialization of these dangerous classes, blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:42:56.737779+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 relates to unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes in jackson-databind. The target (jackson-databind 2.13.0-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.13.0 when TuxCare onboarded it. The fix blocks deserialization of these gadget classes via a blocklist in SubTypeValidator.java (lines 226-230). The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 relates to unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes in jackson-databind. The target (jackson-databind 2.13.0-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.13.0 when TuxCare onboarded it. The fix blocks deserialization of these gadget classes via a blocklist in SubTypeValidator.java (lines 226-230). The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:48:33.739879+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns JNDI injection via deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource classes. The fix (adding these classes to the deserialization blacklist) was already present in the upstream jackson-databind 2.13.0 release that TuxCare onboarded. The vulnerable pattern does not exist in the target because the upstream vendor (Tatu Saloranta) applied the fix in commit 33d96c13fe before the 2.13.0 release was tagged.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns JNDI injection via deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource classes. The fix (adding these classes to the deserialization blacklist) was already present in the upstream jackson-databind 2.13.0 release that TuxCare onboarded. The vulnerable pattern does not exist in the target because the upstream vendor (Tatu Saloranta) applied the fix in commit 33d96c13fe before the 2.13.0 release was tagged.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:57:15.327260+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 does not affect jackson-databind 2.13.0-tuxcare.3. The vulnerability involves deserialization of malicious gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource). The upstream fix, which adds these classes to the SubTypeValidator blocklist, was authored by Tatu Saloranta (commit 33d96c13fe) and shipped in the upstream 2.13.0 release. This fix was already present when TuxCare onboarded version 2.13.0, as confirmed by its presence in the onboard commit 75db32f924 and current HEAD at SubTypeValidator.java:221-224. The blocklist mechanism is actively enforced via BeanDeserializerFactory._validateSubType() at line 999.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 does not affect jackson-databind 2.13.0-tuxcare.3. The vulnerability involves deserialization of malicious gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource). The upstream fix, which adds these classes to the SubTypeValidator blocklist, was authored by Tatu Saloranta (commit 33d96c13fe) and shipped in the upstream 2.13.0 release. This fix was already present when TuxCare onboarded version 2.13.0, as confirmed by its presence in the onboard commit 75db32f924 and current HEAD at SubTypeValidator.java:221-224. The blocklist mechanism is actively enforced via BeanDeserializerFactory._validateSubType() at line 999.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:08:45.993587+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is not present in jackson-databind 2.13.0. The vulnerability affects versions before 2.6.7.4, 2.7.9.7, 2.8.11.5, and 2.9.10.2 due to missing blocklist entry for org.apache.xbean.propertyeditor.JndiConverter, which enables JNDI injection attacks during polymorphic deserialization. The fix was applied by upstream maintainer Tatu Saloranta in commit 914e7c9f2c (Feb 2020) and shipped in upstream release 2.13.0, which TuxCare onboarded in Sept 2026. The blocklist entry is present at SubTypeValidator.java:138, preventing deserialization of the malicious class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 is not present in jackson-databind 2.13.0. The vulnerability affects versions before 2.6.7.4, 2.7.9.7, 2.8.11.5, and 2.9.10.2 due to missing blocklist entry for org.apache.xbean.propertyeditor.JndiConverter, which enables JNDI injection attacks during polymorphic deserialization. The fix was applied by upstream maintainer Tatu Saloranta in commit 914e7c9f2c (Feb 2020) and shipped in upstream release 2.13.0, which TuxCare onboarded in Sept 2026. The blocklist entry is present at SubTypeValidator.java:138, preventing deserialization of the malicious class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget vulnerability with org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target (jackson-databind 2.13.0-tuxcare.3) is not affected because the fix was already present in the upstream 2.13.0 release. The blocklist entry is present at line 141 of SubTypeValidator.java, added by upstream commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb (authored by Tatu Saloranta on March 10, 2020), which predates the TuxCare onboarding of version 2.13.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget vulnerability with org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target (jackson-databind 2.13.0-tuxcare.3) is not affected because the fix was already present in the upstream 2.13.0 release. The blocklist entry is present at line 141 of SubTypeValidator.java, added by upstream commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb (authored by Tatu Saloranta on March 10, 2020), which predates the TuxCare onboarding of version 2.13.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:36:59.729049+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns deserialization of the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The upstream vendor (FasterXML) fixed this in commit 1e64db6a2f by adding the class to a deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.13.0 release that TuxCare onboarded. The blocklist entry at line 144 prevents deserialization of the gadget class by throwing a JsonMappingException with message \"Illegal type to deserialize: prevented for security reasons\". Target is not affected because the vulnerable pattern (unrestricted deserialization of the gadget class) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability concerns deserialization of the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The upstream vendor (FasterXML) fixed this in commit 1e64db6a2f by adding the class to a deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.13.0 release that TuxCare onboarded. The blocklist entry at line 144 prevents deserialization of the gadget class by throwing a JsonMappingException with message \"Illegal type to deserialize: prevented for security reasons\". Target is not affected because the vulnerable pattern (unrestricted deserialization of the gadget class) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:12:27.199890+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability involves deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class. The target contains the upstream fix (commit 1e64db6a2fad) that adds AnterosDBCPConfig to the SubTypeValidator blocklist. This fix was already included in the upstream 2.13.0 release before TuxCare onboarded it, making the vulnerable pattern absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 is not present in jackson-databind 2.13.0-tuxcare.3. The vulnerability involves deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class. The target contains the upstream fix (commit 1e64db6a2fad) that adds AnterosDBCPConfig to the SubTypeValidator blocklist. This fix was already included in the upstream 2.13.0 release before TuxCare onboarded it, making the vulnerable pattern absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:08:44.196020+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is not present in jackson-databind 2.13.0. The vulnerability involves exploitation of serialization gadgets through polymorphic deserialization. The upstream fix (databind issues #2997, #2998, #2999, #3003, #3004, #2854) adds multiple dangerous gadget classes to the SubTypeValidator blacklist. All these gadget classes are present in the target's SubTypeValidator.java at commit 6328ac18ca. The fixes were committed by upstream maintainer Tatu Saloranta between December 2020 and early 2021, and were included in the upstream 2.13.0 release (September 2021) before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is not present in jackson-databind 2.13.0. The vulnerability involves exploitation of serialization gadgets through polymorphic deserialization. The upstream fix (databind issues #2997, #2998, #2999, #3003, #3004, #2854) adds multiple dangerous gadget classes to the SubTypeValidator blacklist. All these gadget classes are present in the target's SubTypeValidator.java at commit 6328ac18ca. The fixes were committed by upstream maintainer Tatu Saloranta between December 2020 and early 2021, and were included in the upstream 2.13.0 release (September 2021) before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T02:25:36.469962+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.13.0 is not affected by CVE-2026-54517. While the underlying data flaw (missing view check in the property-buffering branch at lines 469-483 of BeanDeserializer._deserializeUsingPropertyBased) exists in the code, the attack chain is broken because setterless properties cannot be successfully applied through this path. Buffered properties are applied via PropertyValue.Regular.assign() ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Version 2.13.0 is not affected by CVE-2026-54517. While the underlying data flaw (missing view check in the property-buffering branch at lines 469-483 of BeanDeserializer._deserializeUsingPropertyBased) exists in the code, the attack chain is broken because setterless properties cannot be successfully applied through this path. Buffered properties are applied via PropertyValue.Regular.assign() ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T01:59:00.084466+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.13.0 is not affected by CVE-2026-54518. The vulnerability exists in the `processUnwrappedCreatorProperties()` method of `UnwrappedPropertyHandler`, which was introduced as part of feature #1467 (Support for @JsonUnwrapped in @JsonCreators) in commit 502fe888da on 2024-11-13. This feature first appeared in version 2.19.0 and became vulnerable in versions 2.21.0-2.21.3 (and 3.0.0-3.1.3)...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.13.0 is not affected by CVE-2026-54518. The vulnerability exists in the `processUnwrappedCreatorProperties()` method of `UnwrappedPropertyHandler`, which was introduced as part of feature #1467 (Support for @JsonUnwrapped in @JsonCreators) in commit 502fe888da on 2024-11-13. This feature first appeared in version 2.19.0 and became vulnerable in versions 2.21.0-2.21.3 (and 3.0.0-3.1.3)..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T14:12:00.505333+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 affects version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "action_statement": "Vulnerability CVE-2026-59888 affects version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.0-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.13.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T18:43:56.275811+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.13.0-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}