{ "@id": "urn:uuid:b391c2ee-5c76-4cb4-bde8-18b29b060490", "role": "Document Creator", "author": "https://tuxcare.com", "version": 62, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T11:10:46.140407+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:08:13.759745+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.4.2-tuxcare.3 is NOT AFFECTED by CVE-2017-15095. The vulnerability (deserialization gadget classes exploitable via polymorphic type handling) was fixed in the upstream 2.13.4.2 release before TuxCare onboarded it. The target contains a comprehensive blacklist in SubTypeValidator.java (lines 30-245) blocking all dangerous classes mentioned in CVE-2017-15095: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, and com.mchange.v2.c3p0.* classes (via dynamic PREFIX_C3P0 validation at lines 288-297). Fix commits a054585e21 (#1737) and e8f043d1aa (#1680) are ancestors of the TuxCare onboarding commit e675c916cf36, confirming they shipped in the upstream release. Fix authors (derek@asterius.io, tatu.saloranta@iki.fi) are NOT TuxCare domains.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "Target jackson-databind 2.13.4.2-tuxcare.3 is NOT AFFECTED by CVE-2017-15095. The vulnerability (deserialization gadget classes exploitable via polymorphic type handling) was fixed in the upstream 2.13.4.2 release before TuxCare onboarded it. The target contains a comprehensive blacklist in SubTypeValidator.java (lines 30-245) blocking all dangerous classes mentioned in CVE-2017-15095: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, and com.mchange.v2.c3p0.* classes (via dynamic PREFIX_C3P0 validation at lines 288-297). Fix commits a054585e21 (#1737) and e8f043d1aa (#1680) are ancestors of the TuxCare onboarding commit e675c916cf36, confirming they shipped in the upstream release. Fix authors (derek@asterius.io, tatu.saloranta@iki.fi) are NOT TuxCare domains.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:43:13.146994+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is NOT present in jackson-databind 2.13.4.2-tuxcare.3. The upstream FasterXML vendor fix was already shipped in version 2.13.4.2, which TuxCare onboarded. The target contains the complete SubTypeValidator implementation with all required blacklist entries for Spring framework classes (AbstractPointcutAdvisor, AbstractApplicationContext), JDK classes (FileHandler, UnicastRemoteObject), c3p0, tomcat dbcp, and BCEL ClassLoader. The fix commits (bb45fb1670, 2235894210, e865a7a446) are ancestors of the onboarding commit and were authored by Tatu Saloranta (tatu.saloranta@iki.fi), the upstream maintainer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 is NOT present in jackson-databind 2.13.4.2-tuxcare.3. The upstream FasterXML vendor fix was already shipped in version 2.13.4.2, which TuxCare onboarded. The target contains the complete SubTypeValidator implementation with all required blacklist entries for Spring framework classes (AbstractPointcutAdvisor, AbstractApplicationContext), JDK classes (FileHandler, UnicastRemoteObject), c3p0, tomcat dbcp, and BCEL ClassLoader. The fix commits (bb45fb1670, 2235894210, e865a7a446) are ancestors of the onboarding commit and were authored by Tatu Saloranta (tatu.saloranta@iki.fi), the upstream maintainer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:26:35.232279+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.4.2 is not affected by CVE-2017-7525. The upstream jackson-databind project fixed this deserialization vulnerability in 2017 (issue #1599) by introducing the SubTypeValidator class with a blacklist of dangerous classes. This fix was already present in the upstream release 2.13.4.2 that TuxCare onboarded, well before any TuxCare modifications. The target contains the complete defense mechanism at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java, which blocks deserialization of all dangerous classes mentioned in the CVE patches (InvokerTransformer, InstantiateTransformer, ConvertedClosure, MethodClosure, ObjectFactory, TemplatesImpl, etc.) plus many additional classes discovered in later security research.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "Target version 2.13.4.2 is not affected by CVE-2017-7525. The upstream jackson-databind project fixed this deserialization vulnerability in 2017 (issue #1599) by introducing the SubTypeValidator class with a blacklist of dangerous classes. This fix was already present in the upstream release 2.13.4.2 that TuxCare onboarded, well before any TuxCare modifications. The target contains the complete defense mechanism at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java, which blocks deserialization of all dangerous classes mentioned in the CVE patches (InvokerTransformer, InstantiateTransformer, ConvertedClosure, MethodClosure, ObjectFactory, TemplatesImpl, etc.) plus many additional classes discovered in later security research.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:17:11.201920+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5, involving deserialization of the iBatis XPathParser gadget class for data exfiltration. The target repository (jackson-databind 2.13.4.2-tuxcare.3) already contains the upstream vendor fix (commit 27b4defc270) that blacklists org.apache.ibatis.parsing.XPathParser in SubTypeValidator.java line 65. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in upstream releases 2.7.9.4, 2.8.11.2, and 2.9.6. Since the target version 2.13.4.2 is significantly newer than these fixed versions, the fix was already present when TuxCare onboarded version 2.13.4.2 (commit e675c916cf). The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5, involving deserialization of the iBatis XPathParser gadget class for data exfiltration. The target repository (jackson-databind 2.13.4.2-tuxcare.3) already contains the upstream vendor fix (commit 27b4defc270) that blacklists org.apache.ibatis.parsing.XPathParser in SubTypeValidator.java line 65. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in upstream releases 2.7.9.4, 2.8.11.2, and 2.9.6. Since the target version 2.13.4.2 is significantly newer than these fixed versions, the fix was already present when TuxCare onboarded version 2.13.4.2 (commit e675c916cf). The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T17:17:53.657243+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.4.2 is not affected by CVE-2018-12022. The vulnerability allows polymorphic deserialization of dangerous gadget classes (Jodd-db, Oracle JDBC) when Default Typing is enabled, enabling attackers to instantiate classes that make outbound LDAP/JNDI connections to attacker-controlled servers. The fix adds these gadget class names to SubTypeValidator's blacklist. This fix was already present in upstream version 2.13.4.2 that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta in commit 28badf7ef6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "The target jackson-databind version 2.13.4.2 is not affected by CVE-2018-12022. The vulnerability allows polymorphic deserialization of dangerous gadget classes (Jodd-db, Oracle JDBC) when Default Typing is enabled, enabling attackers to instantiate classes that make outbound LDAP/JNDI connections to attacker-controlled servers. The fix adds these gadget class names to SubTypeValidator's blacklist. This fix was already present in upstream version 2.13.4.2 that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta in commit 28badf7ef6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:19:28.543087+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is not present in jackson-databind 2.13.4.2-tuxcare.3. The vulnerability allows arbitrary code execution via JNDI/LDAP injection when Default Typing is enabled and Oracle JDBC classes are deserialized. The vendor fix adds two Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) to the SubTypeValidator blocklist. Both classes are present in the target's blocklist (SubTypeValidator.java lines 71-72). The fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.13.4.2, which TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is not present in jackson-databind 2.13.4.2-tuxcare.3. The vulnerability allows arbitrary code execution via JNDI/LDAP injection when Default Typing is enabled and Oracle JDBC classes are deserialized. The vendor fix adds two Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) to the SubTypeValidator blocklist. Both classes are present in the target's blocklist (SubTypeValidator.java lines 71-72). The fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.13.4.2, which TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:48:02.040973+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.4.2-tuxcare.3 is NOT AFFECTED by CVE-2018-14718. The vulnerability pattern (missing blocklist for org.slf4j.ext.EventData in polymorphic deserialization) is not present because the fix was already included in upstream release 2.13.4.2 before TuxCare onboarded it. The fix commit 87d29af25e by upstream maintainer Tatu Saloranta adds org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing arbitrary code execution via deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "The target jackson-databind 2.13.4.2-tuxcare.3 is NOT AFFECTED by CVE-2018-14718. The vulnerability pattern (missing blocklist for org.slf4j.ext.EventData in polymorphic deserialization) is not present because the fix was already included in upstream release 2.13.4.2 before TuxCare onboarded it. The fix commit 87d29af25e by upstream maintainer Tatu Saloranta adds org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing arbitrary code execution via deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:59:41.286358+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is not present in jackson-databind 2.13.4.2-tuxcare.3. The vulnerability affects versions before 2.9.7/2.8.11.3/2.7.9.5 and allows RCE through polymorphic deserialization of dangerous blaze-ds classes. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by Tatu Saloranta) added four dangerous classes including flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream Jackson 2.13.4.2 before TuxCare onboarded it. The target's SubTypeValidator.java (lines 75-78) contains all four blocked classes, and the validation mechanism is properly wired through BeanDeserializerFactory._validateSubType (line 140), which rejects these classes before deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 is not present in jackson-databind 2.13.4.2-tuxcare.3. The vulnerability affects versions before 2.9.7/2.8.11.3/2.7.9.5 and allows RCE through polymorphic deserialization of dangerous blaze-ds classes. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by Tatu Saloranta) added four dangerous classes including flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream Jackson 2.13.4.2 before TuxCare onboarded it. The target's SubTypeValidator.java (lines 75-78) contains all four blocked classes, and the validation mechanism is properly wired through BeanDeserializerFactory._validateSubType (line 140), which rejects these classes before deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:07:32.765766+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.4.2-tuxcare.3 is not affected by CVE-2018-14720. The four dangerous classes identified in the patch (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was added by upstream commit 87d29af25e82a249ea15858e2d4ecbf64091db44 (author: Tatu Saloranta) and was already present in the upstream release 2.13.4.2 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "The target jackson-databind version 2.13.4.2-tuxcare.3 is not affected by CVE-2018-14720. The four dangerous classes identified in the patch (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was added by upstream commit 87d29af25e82a249ea15858e2d4ecbf64091db44 (author: Tatu Saloranta) and was already present in the upstream release 2.13.4.2 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:36:04.109725+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.4.2 already contains the fix for CVE-2018-14721. The dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl is blocked from polymorphic deserialization via the blacklist in SubTypeValidator.java (line 78). This fix was included in the upstream release 2.13.4.2 (committed by tatu.saloranta@iki.fi in commit 87d29af) before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "The target jackson-databind version 2.13.4.2 already contains the fix for CVE-2018-14721. The dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl is blocked from polymorphic deserialization via the blacklist in SubTypeValidator.java (line 78). This fix was included in the upstream release 2.13.4.2 (committed by tatu.saloranta@iki.fi in commit 87d29af) before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:46:45.783631+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is NOT present in jackson-databind 2.13.4.2-tuxcare.2. The vulnerability involves polymorphic deserialization of the gadget class org.apache.axis2.transport.jms.JMSOutTransportInfo. The fix (blocklist entry) was already present in the upstream release 2.13.4.2 that TuxCare onboarded, added by upstream maintainer Tatu Saloranta in commit 72cd4025a2 (Fix #2186). The blocklist is actively enforced during deserialization via SubTypeValidator, preventing instantiation of the dangerous class. CVE affects versions before 2.9.8; target is 2.13.4.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 is NOT present in jackson-databind 2.13.4.2-tuxcare.2. The vulnerability involves polymorphic deserialization of the gadget class org.apache.axis2.transport.jms.JMSOutTransportInfo. The fix (blocklist entry) was already present in the upstream release 2.13.4.2 that TuxCare onboarded, added by upstream maintainer Tatu Saloranta in commit 72cd4025a2 (Fix #2186). The blocklist is actively enforced during deserialization via SubTypeValidator, preventing instantiation of the dangerous class. CVE affects versions before 2.9.8; target is 2.13.4.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:55:41.476005+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is NOT present in jackson-databind 2.13.4.2. The vulnerability involves unsafe polymorphic deserialization of OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that could lead to arbitrary code execution. The fix, which adds these classes to the deserialization blocklist in SubTypeValidator.java, was already included in the upstream release 2.13.4.2 that TuxCare onboarded. The fix commit (72cd4025a2) was authored by upstream Jackson maintainer Tatu Saloranta and predates all TuxCare commits in this repository's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 is NOT present in jackson-databind 2.13.4.2. The vulnerability involves unsafe polymorphic deserialization of OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that could lead to arbitrary code execution. The fix, which adds these classes to the deserialization blocklist in SubTypeValidator.java, was already included in the upstream release 2.13.4.2 that TuxCare onboarded. The fix commit (72cd4025a2) was authored by upstream Jackson maintainer Tatu Saloranta and predates all TuxCare commits in this repository's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:24:24.833839+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 concerns polymorphic deserialization of org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core. The fix (blacklisting DocumentEditor in SubTypeValidator) was introduced in upstream jackson-databind 2.9.8/2.8.11.3 by commit 72cd4025a2 (authored by Tatu Saloranta, not TuxCare). The target version 2.13.4.2-tuxcare.3 contains this upstream fix\u2014the blacklist entry is present at SubTypeValidator.java:81. The fix predates TuxCare's first commit (a7a5ae30fc \"setup 2.11.2\"), confirming it shipped in the upstream release. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 concerns polymorphic deserialization of org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core. The fix (blacklisting DocumentEditor in SubTypeValidator) was introduced in upstream jackson-databind 2.9.8/2.8.11.3 by commit 72cd4025a2 (authored by Tatu Saloranta, not TuxCare). The target version 2.13.4.2-tuxcare.3 contains this upstream fix\u2014the blacklist entry is present at SubTypeValidator.java:81. The fix predates TuxCare's first commit (a7a5ae30fc \"setup 2.11.2\"), confirming it shipped in the upstream release. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.4.2-tuxcare.3 is not affected by CVE-2018-5968. The vulnerability was fixed in the upstream release by adding two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to the deserialization blacklist in SubTypeValidator.java. This fix was authored by the upstream maintainer Tatu Saloranta in commit 038b471e2e on 2018-01-21 and was already included in upstream release 2.13.4.2 before TuxCare onboarded this version. The target version (2.13.4.2) is significantly newer than the affected versions (through 2.8.11 and 2.9.x through 2.9.3) stated in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "The target jackson-databind version 2.13.4.2-tuxcare.3 is not affected by CVE-2018-5968. The vulnerability was fixed in the upstream release by adding two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to the deserialization blacklist in SubTypeValidator.java. This fix was authored by the upstream maintainer Tatu Saloranta in commit 038b471e2e on 2018-01-21 and was already included in upstream release 2.13.4.2 before TuxCare onboarded this version. The target version (2.13.4.2) is significantly newer than the affected versions (through 2.8.11 and 2.9.x through 2.9.3) stated in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:45:05.549046+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.4.2-tuxcare.3 is not affected by CVE-2018-7489. The upstream vendor (FasterXML) fixed this c3p0 deserialization vulnerability in version 2.7.9.3 (February 2018) by adding pattern-based validation to block deserialization of classes matching com.mchange.v2.c3p0.*DataSource. The fix commit 6799f8f10c, authored by upstream maintainer Tatu Saloranta, was already present in the upstream release 2.13.4.2 when TuxCare onboarded it in commit e675c916cf. The target version (2.13.4.2, released 2022) is well beyond all affected version ranges listed in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "The target jackson-databind 2.13.4.2-tuxcare.3 is not affected by CVE-2018-7489. The upstream vendor (FasterXML) fixed this c3p0 deserialization vulnerability in version 2.7.9.3 (February 2018) by adding pattern-based validation to block deserialization of classes matching com.mchange.v2.c3p0.*DataSource. The fix commit 6799f8f10c, authored by upstream maintainer Tatu Saloranta, was already present in the upstream release 2.13.4.2 when TuxCare onboarded it in commit e675c916cf. The target version (2.13.4.2, released 2022) is well beyond all affected version ranges listed in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:32:27.596761+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind versions before 2.9.9 due to missing validation for the com.mysql.cj.jdbc.admin.MiniAdmin class in polymorphic deserialization. The target version 2.13.4.2 is not affected because it already contains the upstream fix that blocks this dangerous class. The fix was present in the upstream release when TuxCare onboarded version 2.13.4.2, as confirmed by the presence of the MiniAdmin blocklist entry in SubTypeValidator.java line 88 within the onboarding commit e675c916c.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 affects jackson-databind versions before 2.9.9 due to missing validation for the com.mysql.cj.jdbc.admin.MiniAdmin class in polymorphic deserialization. The target version 2.13.4.2 is not affected because it already contains the upstream fix that blocks this dangerous class. The fix was present in the upstream release when TuxCare onboarded version 2.13.4.2, as confirmed by the presence of the MiniAdmin blocklist entry in SubTypeValidator.java line 88 within the onboarding commit e675c916c.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T18:31:00.133990+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind version 2.13.4.2-tuxcare.3 is NOT affected by CVE-2019-12384. The vulnerability involves polymorphic deserialization of the dangerous logback-core class `ch.qos.logback.core.db.DriverManagerConnectionSource`, which can lead to remote code execution. The upstream fix (commit c9ef4a10d6f) blocks this class in SubTypeValidator.java by adding it to the DEFAULT_NO_DESER_C...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 The target jackson-databind version 2.13.4.2-tuxcare.3 is NOT affected by CVE-2019-12384. The vulnerability involves polymorphic deserialization of the dangerous logback-core class `ch.qos.logback.core.db.DriverManagerConnectionSource`, which can lead to remote code execution. The upstream fix (commit c9ef4a10d6f) blocks this class in SubTypeValidator.java by adding it to the DEFAULT_NO_DESER_C..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-02T07:11:00.169222+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 affects jackson-databind versions that allow deserialization of JDOM XSLTransformer classes via polymorphic typing. The target repository version 2.13.4.2-tuxcare.3 contains the upstream fix (commit 5f7c69bba0) that blacklists org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer in SubTypeValidator.java. This fix was already present in the upstream release 2.1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 affects jackson-databind versions that allow deserialization of JDOM XSLTransformer classes via polymorphic typing. The target repository version 2.13.4.2-tuxcare.3 contains the upstream fix (commit 5f7c69bba0) that blacklists org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer in SubTypeValidator.java. This fix was already present in the upstream release 2.1..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:08:14.959299+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.13.4.2. The vulnerability involved missing blacklist entries for dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that could enable remote code execution via polymorphic JSON deserialization. The upstream fix (commit ad418eeb97 by Tatu Saloranta) shipped in the upstream release 2.13.4.2, which TuxCare onboarded. The dangerous classes are properly blacklisted in SubTypeValidator.java lines 98 and 102, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.13.4.2. The vulnerability involved missing blacklist entries for dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that could enable remote code execution via polymorphic JSON deserialization. The upstream fix (commit ad418eeb97 by Tatu Saloranta) shipped in the upstream release 2.13.4.2, which TuxCare onboarded. The dangerous classes are properly blacklisted in SubTypeValidator.java lines 98 and 102, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:30:30.768655+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in jackson-databind 2.13.4.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of the dangerous class `ch.qos.logback.core.db.JNDIConnectionSource` when Default Typing is enabled, which could allow JNDI injection attacks. The upstream fix (commit ad418eeb97) added this class to the SubTypeValidator blacklist, preventing its deserialization. This fix shipped in the upstream release 2.13.4.2 before TuxCare onboarded it (commit e675c916cf \"Onboard version 2.13.4.2\"). The blacklist entry is present at SubTypeValidator.java:102 and is actively enforced via the validateSubType() method (lines 269-303), which throws JsonMappingException when attempting to deserialize blacklisted classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 is NOT present in jackson-databind 2.13.4.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of the dangerous class `ch.qos.logback.core.db.JNDIConnectionSource` when Default Typing is enabled, which could allow JNDI injection attacks. The upstream fix (commit ad418eeb97) added this class to the SubTypeValidator blacklist, preventing its deserialization. This fix shipped in the upstream release 2.13.4.2 before TuxCare onboarded it (commit e675c916cf \"Onboard version 2.13.4.2\"). The blacklist entry is present at SubTypeValidator.java:102 and is actively enforced via the validateSubType() method (lines 269-303), which throws JsonMappingException when attempting to deserialize blacklisted classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:46:51.408476+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.4.2-tuxcare.3) is not affected by CVE-2019-14540. The vulnerability relates to polymorphic deserialization of HikariConfig and HikariDataSource classes, which could enable malicious operations. The fix (blacklisting these classes in SubTypeValidator.java) was authored by upstream maintainer Tatu Saloranta in August-September 2019 and shipped in upstream release 2.13.4.2 (October 2022), which TuxCare later onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "The target repository (jackson-databind 2.13.4.2-tuxcare.3) is not affected by CVE-2019-14540. The vulnerability relates to polymorphic deserialization of HikariConfig and HikariDataSource classes, which could enable malicious operations. The fix (blacklisting these classes in SubTypeValidator.java) was authored by upstream maintainer Tatu Saloranta in August-September 2019 and shipped in upstream release 2.13.4.2 (October 2022), which TuxCare later onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:54:24.198988+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 fix is already present in the target. The vulnerability involved polymorphic deserialization of malicious objects using commons-configuration JNDI classes to execute arbitrary code. The upstream vendor (FasterXML) fixed this in commit 41b7f9b901 by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blocklist. This fix was already present in upstream release 2.13.4.2, which TuxCare onboarded. The target version 2.13.4.2-tuxcare.3 inherits this upstream fix, making it not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 fix is already present in the target. The vulnerability involved polymorphic deserialization of malicious objects using commons-configuration JNDI classes to execute arbitrary code. The upstream vendor (FasterXML) fixed this in commit 41b7f9b901 by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blocklist. This fix was already present in upstream release 2.13.4.2, which TuxCare onboarded. The target version 2.13.4.2-tuxcare.3 inherits this upstream fix, making it not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is NOT present in the target. The vulnerability involved polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution. The upstream fix (commit 998efd7082) added this class to the SubTypeValidator deny-list, and this fix was already included in the upstream release 2.13.4.2 that TuxCare onboarded. The target at SHA 3db3f0c0c9 contains the fix at SubTypeValidator.java line 117, and the SubTypeValidator is enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893 is NOT present in the target. The vulnerability involved polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution. The upstream fix (commit 998efd7082) added this class to the SubTypeValidator deny-list, and this fix was already included in the upstream release 2.13.4.2 that TuxCare onboarded. The target at SHA 3db3f0c0c9 contains the fix at SubTypeValidator.java line 117, and the SubTypeValidator is enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T17:03:58.617275+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is NOT present in the target. The fix (blocking com.zaxxer.hikari.HikariDataSource from polymorphic deserialization) was already included in the upstream jackson-databind 2.13.4.2 release that TuxCare onboarded. The vulnerable code pattern does not exist in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 is NOT present in the target. The fix (blocking com.zaxxer.hikari.HikariDataSource from polymorphic deserialization) was already included in the upstream jackson-databind 2.13.4.2 release that TuxCare onboarded. The vulnerable code pattern does not exist in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:04:18.596746+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.4.2-tuxcare.3 is not affected by CVE-2019-16942. The vulnerability involved polymorphic deserialization of commons-dbcp gadget classes (SharedPoolDataSource, PerUserPoolDataSource) and p6spy (P6DataSource) that could lead to RCE when Default Typing is enabled. The upstream vendor fix added these three classes to the SubTypeValidator blocklist, preventing their instantiation during deserialization. This fix was already present in upstream release 2.13.4.2 when TuxCare onboarded it (commit e675c916cf), authored by tatu.saloranta@iki.fi. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "Target jackson-databind 2.13.4.2-tuxcare.3 is not affected by CVE-2019-16942. The vulnerability involved polymorphic deserialization of commons-dbcp gadget classes (SharedPoolDataSource, PerUserPoolDataSource) and p6spy (P6DataSource) that could lead to RCE when Default Typing is enabled. The upstream vendor fix added these three classes to the SubTypeValidator blocklist, preventing their instantiation during deserialization. This fix was already present in upstream release 2.13.4.2 when TuxCare onboarded it (commit e675c916cf), authored by tatu.saloranta@iki.fi. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T17:13:44.782673+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 affects jackson-databind's polymorphic deserialization when Default Typing is enabled and the p6spy library is in the classpath, allowing arbitrary code execution via com.p6spy.engine.spy.P6DataSource gadget class. The target version 2.13.4.2-tuxcare.3 is not affected because the upstream fix (commit 9593e16cf5 by Tatu Saloranta) was already included in the base release 2.13.4.2 that TuxCare onboarded. The fix adds P6DataSource to the SubTypeValidator blacklist (line 127), preventing its deserialization. This is an upstream fix that shipped in the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 affects jackson-databind's polymorphic deserialization when Default Typing is enabled and the p6spy library is in the classpath, allowing arbitrary code execution via com.p6spy.engine.spy.P6DataSource gadget class. The target version 2.13.4.2-tuxcare.3 is not affected because the upstream fix (commit 9593e16cf5 by Tatu Saloranta) was already included in the base release 2.13.4.2 that TuxCare onboarded. The fix adds P6DataSource to the SubTypeValidator blacklist (line 127), preventing its deserialization. This is an upstream fix that shipped in the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:28:17.034118+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is not present in target version 2.13.4.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of the malicious gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf by Tatu Saloranta) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream release 2.13.4.2 that TuxCare onboarded, as confirmed by the presence of the blocklist entry at SubTypeValidator.java:99. The vulnerable code pattern does not exist in the target because the upstream vendor shipped the fix in release 2.13.4.2, which predates all TuxCare activity on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 is not present in target version 2.13.4.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of the malicious gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf by Tatu Saloranta) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream release 2.13.4.2 that TuxCare onboarded, as confirmed by the presence of the blocklist entry at SubTypeValidator.java:99. The vulnerable code pattern does not exist in the target because the upstream vendor shipped the fix in release 2.13.4.2, which predates all TuxCare activity on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:47:28.358565+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is not affecting this target. The vulnerability involves polymorphic deserialization of dangerous log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) that can enable JNDI-based remote code execution when Default Typing is enabled. The fix, which adds these two classes to the SubTypeValidator blacklist, was already present in the upstream jackson-databind version 2.13.4.2 that TuxCare onboarded. The fix commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) was committed on Oct 12, 2019, and is an ancestor of the first TuxCare commit (e675c916cf \"Onboard version 2.13.4.2\"). Therefore, the vulnerable code pattern is not present in the target version 2.13.4.2-tuxcare.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is not affecting this target. The vulnerability involves polymorphic deserialization of dangerous log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) that can enable JNDI-based remote code execution when Default Typing is enabled. The fix, which adds these two classes to the SubTypeValidator blacklist, was already present in the upstream jackson-databind version 2.13.4.2 that TuxCare onboarded. The fix commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) was committed on Oct 12, 2019, and is an ancestor of the first TuxCare commit (e675c916cf \"Onboard version 2.13.4.2\"). Therefore, the vulnerable code pattern is not present in the target version 2.13.4.2-tuxcare.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:07:59.808671+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.13.4.2. The vulnerability concerns missing blocklist entries for two ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector) that could enable JNDI injection attacks via unsafe deserialization. The upstream fix (commit fc4214a883) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist and was already present in version 2.13.4.2 when TuxCare onboarded it. The blocklist is actively enforced during polymorphic deserialization through BeanDeserializerFactory._validateSubType, which calls SubTypeValidator.instance().validateSubType() to check and reject blocked classes. The target version inherited this protection from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.13.4.2. The vulnerability concerns missing blocklist entries for two ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector) that could enable JNDI injection attacks via unsafe deserialization. The upstream fix (commit fc4214a883) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist and was already present in version 2.13.4.2 when TuxCare onboarded it. The blocklist is actively enforced during polymorphic deserialization through BeanDeserializerFactory._validateSubType, which calls SubTypeValidator.instance().validateSubType() to check and reject blocked classes. The target version inherited this protection from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T17:01:32.199516+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is NOT present in jackson-databind 2.13.4.2-tuxcare.3. The vulnerability concerns unsafe deserialization of three JNDI-related classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) that enable arbitrary code execution. The upstream vendor fix (commit a424c038ba0) added these classes to SubTypeValidator's deserialization blocklist, and this fix was already present in upstream release 2.13.4.2 that TuxCare onboarded. The target's SubTypeValidator.java contains all three blocked classes (lines 157-160), preventing deserialization of these gadget types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 is NOT present in jackson-databind 2.13.4.2-tuxcare.3. The vulnerability concerns unsafe deserialization of three JNDI-related classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) that enable arbitrary code execution. The upstream vendor fix (commit a424c038ba0) added these classes to SubTypeValidator's deserialization blocklist, and this fix was already present in upstream release 2.13.4.2 that TuxCare onboarded. The target's SubTypeValidator.java contains all three blocked classes (lines 157-160), preventing deserialization of these gadget types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 targets a Jackson deserialization gadget (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory). The fix adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java to prevent instantiation during polymorphic deserialization. The target repository already contains this fix at lines 162-164 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta in commit 592872f4235 and was already part of jackson-databind 2.13.4.2 when TuxCare onboarded it. Verdict: not_affected - the vulnerable pattern is not present because the upstream vendor already fixed it before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "CVE-2020-10672 targets a Jackson deserialization gadget (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory). The fix adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java to prevent instantiation during polymorphic deserialization. The target repository already contains this fix at lines 162-164 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta in commit 592872f4235 and was already part of jackson-databind 2.13.4.2 when TuxCare onboarded it. Verdict: not_affected - the vulnerable pattern is not present because the upstream vendor already fixed it before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:26:23.100345+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is a deserialization gadget vulnerability in jackson-databind related to com.caucho.config.types.ResourceRef (caucho-quercus). The target version 2.13.4.2-tuxcare.3 is not affected because the upstream fix (commit 1645efbd39 by Tatu Saloranta) was already present in the upstream release 2.13.4.2 that TuxCare onboarded. The fix adds \"com.caucho.config.types.ResourceRef\" to the SubTypeValidator blocklist (DEFAULT_NO_DESER_CLASS_NAMES), which prevents deserialization of this dangerous class. The blocklist entry is present at SubTypeValidator.java:167 and is actively enforced by the validation logic that rejects blocked types with \"Illegal type...prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 is a deserialization gadget vulnerability in jackson-databind related to com.caucho.config.types.ResourceRef (caucho-quercus). The target version 2.13.4.2-tuxcare.3 is not affected because the upstream fix (commit 1645efbd39 by Tatu Saloranta) was already present in the upstream release 2.13.4.2 that TuxCare onboarded. The fix adds \"com.caucho.config.types.ResourceRef\" to the SubTypeValidator blocklist (DEFAULT_NO_DESER_CLASS_NAMES), which prevents deserialization of this dangerous class. The blocklist entry is present at SubTypeValidator.java:167 and is actively enforced by the validation logic that rejects blocked types with \"Illegal type...prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 does not affect jackson-databind 2.13.4.2-tuxcare.3. The vulnerability involves deserialization gadgets in org.aoju.bus.proxy.provider.remoting.RmiProvider that could lead to arbitrary code execution. The upstream fix (commit 05d7e0e13f by Tatu Saloranta) added blocklist entries to SubTypeValidator.java to prevent deserialization of these dangerous classes. This fix was already included in the upstream release 2.13.4.2 that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 does not affect jackson-databind 2.13.4.2-tuxcare.3. The vulnerability involves deserialization gadgets in org.aoju.bus.proxy.provider.remoting.RmiProvider that could lead to arbitrary code execution. The upstream fix (commit 05d7e0e13f by Tatu Saloranta) added blocklist entries to SubTypeValidator.java to prevent deserialization of these dangerous classes. This fix was already included in the upstream release 2.13.4.2 that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.4.2-tuxcare.3 is not affected by CVE-2020-10969. The vulnerability pattern (missing blocklist entry for javax.swing.JEditorPane deserialization gadget) is not present because the upstream fix was already included in the 2.13.4.2 release. The fix adds javax.swing.JEditorPane to DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 150), preventing deserialization of this gadget class. The fix commit (4d038c9de0a) was authored by upstream maintainer Tatu Saloranta and is an ancestor of TuxCare's onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "Target version 2.13.4.2-tuxcare.3 is not affected by CVE-2020-10969. The vulnerability pattern (missing blocklist entry for javax.swing.JEditorPane deserialization gadget) is not present because the upstream fix was already included in the 2.13.4.2 release. The fix adds javax.swing.JEditorPane to DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 150), preventing deserialization of this gadget class. The fix commit (4d038c9de0a) was authored by upstream maintainer Tatu Saloranta and is an ancestor of TuxCare's onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 affects jackson-databind 2.x before 2.9.10.4. The target version 2.13.4.2 already contains the upstream fix that blocks deserialization of dangerous org.apache.activemq.* classes. The fix (commit c14c9f99ed by Tatu Saloranta) was shipped in the upstream FasterXML release and was present when TuxCare onboarded version 2.13.4.2. The SubTypeValidator properly blocks all nine ActiveMQ classes specified in the CVE patches.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 affects jackson-databind 2.x before 2.9.10.4. The target version 2.13.4.2 already contains the upstream fix that blocks deserialization of dangerous org.apache.activemq.* classes. The fix (commit c14c9f99ed by Tatu Saloranta) was shipped in the upstream FasterXML release and was present when TuxCare onboarded version 2.13.4.2. The SubTypeValidator properly blocks all nine ActiveMQ classes specified in the CVE patches.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.4.2-tuxcare.3) is not vulnerable to CVE-2020-11112. The upstream fix that blocks deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider was already present in the upstream release 2.13.4.2 that TuxCare onboarded. The deny-list entry exists at SubTypeValidator.java:186, preventing the serialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "The target repository (jackson-databind 2.13.4.2-tuxcare.3) is not vulnerable to CVE-2020-11112. The upstream fix that blocks deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider was already present in the upstream release 2.13.4.2 that TuxCare onboarded. The deny-list entry exists at SubTypeValidator.java:186, preventing the serialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a missing blacklist entry for the org.apache.openjpa.ee.WASRegistryManagedRuntime deserialization gadget. The target repository version 2.13.4.2-tuxcare.3 is NOT vulnerable because the fix was already present in the upstream release 2.13.4.2 that TuxCare onboarded. The vulnerable pattern (missing blacklist entry) does not exist in this version - the fix was shipped by the upstream vendor FasterXML in commit e2ba12d5d6 authored by Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a missing blacklist entry for the org.apache.openjpa.ee.WASRegistryManagedRuntime deserialization gadget. The target repository version 2.13.4.2-tuxcare.3 is NOT vulnerable because the fix was already present in the upstream release 2.13.4.2 that TuxCare onboarded. The vulnerable pattern (missing blacklist entry) does not exist in this version - the fix was shipped by the upstream vendor FasterXML in commit e2ba12d5d6 authored by Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.4.2-tuxcare.3) is NOT AFFECTED by CVE-2020-11619. The upstream fix that blocks deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean was already present in the upstream release 2.13.4.2 that TuxCare onboarded. The vulnerable pattern (missing blacklist entries for these Spring gadget classes) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "The target repository (jackson-databind 2.13.4.2-tuxcare.3) is NOT AFFECTED by CVE-2020-11619. The upstream fix that blocks deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean was already present in the upstream release 2.13.4.2 that TuxCare onboarded. The vulnerable pattern (missing blacklist entries for these Spring gadget classes) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is NOT present in jackson-databind 2.13.4.2-tuxcare.3. The vulnerability involves deserialization of the gadget class org.apache.commons.jelly.impl.Embedded which could lead to arbitrary code execution. The upstream vendor fix (commit 77040d85e3 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.13.4.2 when TuxCare onboarded it, and is currently active at line 189 of SubTypeValidator.java. The defense is integrated into the core deserialization flow via BeanDeserializerFactory, blocking instantiation of this gadget class during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 is NOT present in jackson-databind 2.13.4.2-tuxcare.3. The vulnerability involves deserialization of the gadget class org.apache.commons.jelly.impl.Embedded which could lead to arbitrary code execution. The upstream vendor fix (commit 77040d85e3 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.13.4.2 when TuxCare onboarded it, and is currently active at line 189 of SubTypeValidator.java. The defense is integrated into the core deserialization flow via BeanDeserializerFactory, blocking instantiation of this gadget class during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not present in jackson-databind 2.13.4.2. The vulnerability concerns deserialization of the dangerous gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The fix blocking this class was added by upstream maintainer Tatu Saloranta in commit d1c67a0396e (2020-04-24) for version 2.9.10.5. Since the target version 2.13.4.2 is much newer (released 2022), it already contains this fix in the upstream release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:192 and is enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 is not present in jackson-databind 2.13.4.2. The vulnerability concerns deserialization of the dangerous gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The fix blocking this class was added by upstream maintainer Tatu Saloranta in commit d1c67a0396e (2020-04-24) for version 2.9.10.5. Since the target version 2.13.4.2 is much newer (released 2022), it already contains this fix in the upstream release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:192 and is enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is NOT present in jackson-databind 2.13.4.2. The vulnerability affects versions before 2.9.10.5 and involves unsafe deserialization of Oracle WebLogic JMS connection factory classes. The fix (adding 5 Oracle JMS classes to SubTypeValidator blocklist) was authored by upstream maintainer Tatu Saloranta in commit 5c8642aeae and was already present in upstream version 2.13.4.2 when TuxCare onboarded it. All 5 classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are confirmed in the blocklist at SubTypeValidator.java lines 200-204, preventing their deserialization. The defense is enforced via BeanDeserializerFactory._validateSubType() on all bean deserialization paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "CVE-2020-14061 is NOT present in jackson-databind 2.13.4.2. The vulnerability affects versions before 2.9.10.5 and involves unsafe deserialization of Oracle WebLogic JMS connection factory classes. The fix (adding 5 Oracle JMS classes to SubTypeValidator blocklist) was authored by upstream maintainer Tatu Saloranta in commit 5c8642aeae and was already present in upstream version 2.13.4.2 when TuxCare onboarded it. All 5 classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are confirmed in the blocklist at SubTypeValidator.java lines 200-204, preventing their deserialization. The defense is enforced via BeanDeserializerFactory._validateSubType() on all bean deserialization paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version 2.13.4.2 is not vulnerable because the fix was already present in the upstream release before TuxCare onboarded this version. The dangerous gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is already blacklisted in SubTypeValidator.java (line 119), preventing polymorphic deserialization attacks. This fix was committed by upstream maintainer Tatu Saloranta on May 1, 2020 (commit 840eae2ca81c) and has been present in all jackson-databind releases from 2.10.4 onwards.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version 2.13.4.2 is not vulnerable because the fix was already present in the upstream release before TuxCare onboarded this version. The dangerous gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is already blacklisted in SubTypeValidator.java (line 119), preventing polymorphic deserialization attacks. This fix was committed by upstream maintainer Tatu Saloranta on May 1, 2020 (commit 840eae2ca81c) and has been present in all jackson-databind releases from 2.10.4 onwards.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget in org.jsecurity.realm.jndi.JndiRealmFactory. The target repository (version 2.13.4.2-tuxcare.3) already contains the upstream fix that adds this class to the deserialization blocklist. The fix was authored by Tatu Saloranta (upstream maintainer) in commit f6d9c664 and was included in the upstream 2.13.4.2 release before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget in org.jsecurity.realm.jndi.JndiRealmFactory. The target repository (version 2.13.4.2-tuxcare.3) already contains the upstream fix that adds this class to the deserialization blocklist. The fix was authored by Tatu Saloranta (upstream maintainer) in commit f6d9c664 and was included in the upstream 2.13.4.2 release before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:18:54.750507+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a deserialization gadget (br.com.anteros.dbcp.AnterosDBCPDataSource). The target version 2.13.4.2-tuxcare.3 contains the upstream fix (commit 3d97153944) that adds this class to the SubTypeValidator blocklist. The fix was authored by upstream maintainer Tatu Saloranta and shipped in release 2.9.10.6, which predates the 2.13.4.2 upstream release that TuxCare onboarded. The vulnerable pattern (absence of the gadget block) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a deserialization gadget (br.com.anteros.dbcp.AnterosDBCPDataSource). The target version 2.13.4.2-tuxcare.3 contains the upstream fix (commit 3d97153944) that adds this class to the SubTypeValidator blocklist. The fix was authored by upstream maintainer Tatu Saloranta and shipped in release 2.9.10.6, which predates the 2.13.4.2 upstream release that TuxCare onboarded. The vulnerable pattern (absence of the gadget block) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:14:37.389349+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is NOT present in jackson-databind 2.13.4.2. The vulnerability involves deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration, which can be exploited for remote code execution via JNDI injection. The fix (adding JndiConfiguration to the deserialization blocklist) was already present in the upstream release 2.13.4.2 that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java line 210 and is enforced by the validateSubType method at line 269, which blocks deserialization of classes in the deny list and reports a security error.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 is NOT present in jackson-databind 2.13.4.2. The vulnerability involves deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration, which can be exploited for remote code execution via JNDI injection. The fix (adding JndiConfiguration to the deserialization blocklist) was already present in the upstream release 2.13.4.2 that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java line 210 and is enforced by the validateSubType method at line 269, which blocks deserialization of classes in the deny list and reports a security error.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in jackson-databind 2.13.4.2-tuxcare.3. The upstream fix (commit 612f971b78 by Tatu Saloranta) was already included in the upstream 2.13.4.2 release before TuxCare onboarded it. The target code contains the required XML security features: disallow-doctype-decl and load-external-dtd disabled, preventing XXE attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in jackson-databind 2.13.4.2-tuxcare.3. The upstream fix (commit 612f971b78 by Tatu Saloranta) was already included in the upstream 2.13.4.2 release before TuxCare onboarded it. The target code contains the required XML security features: disallow-doctype-decl and load-external-dtd disabled, preventing XXE attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:20:46.497840+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target version (2.13.4.2-tuxcare.3) already contains the upstream vendor fix. Both vulnerable classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java lines 217-218, added by upstream commit 41b8bdb5ccc (Tatu Saloranta, 2020-12-15). This fix was included in the upstream release 2.13.4.2 before TuxCare onboarded it (first TuxCare commit: e675c916cf3, \"Onboard version 2.13.4.2\"). The blocklist is enforced during deserialization via BeanDeserializerFactory._validateSubType, which rejects any attempt to deserialize these classes with a JsonMappingException.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target version (2.13.4.2-tuxcare.3) already contains the upstream vendor fix. Both vulnerable classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java lines 217-218, added by upstream commit 41b8bdb5ccc (Tatu Saloranta, 2020-12-15). This fix was included in the upstream release 2.13.4.2 before TuxCare onboarded it (first TuxCare commit: e675c916cf3, \"Onboard version 2.13.4.2\"). The blocklist is enforced during deserialization via BeanDeserializerFactory._validateSubType, which rejects any attempt to deserialize these classes with a JsonMappingException.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:31:59.702907+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is NOT present in jackson-databind 2.13.4.2-tuxcare.2. The vulnerability concerns missing blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource, which allow deserialization gadget exploitation. These blocklist entries are present in the target at SubTypeValidator.java:217-218. The fix was introduced by upstream commit 41b8bdb5cc (Tatu Saloranta) in version 2.9.10.8 (December 2020) and was already included in the upstream 2.13.4 release that TuxCare onboarded. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "CVE-2020-35491 is NOT present in jackson-databind 2.13.4.2-tuxcare.2. The vulnerability concerns missing blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource, which allow deserialization gadget exploitation. These blocklist entries are present in the target at SubTypeValidator.java:217-218. The fix was introduced by upstream commit 41b8bdb5cc (Tatu Saloranta) in version 2.9.10.8 (December 2020) and was already included in the upstream 2.13.4 release that TuxCare onboarded. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:54:00.210651+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.13.4.2. The vulnerability involves polymorphic deserialization of the dangerous JNDI gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit 1ca0388c2fb by Tatu Saloranta, dated 2020-12-26) adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This fix was included in upstream version 2.9.10.8 and all subsequent releases. The target version 2.13.4.2 already contained this upstream fix when TuxCare onboarded it (first TuxCare commit e675c916cf is an \"Onboard\" commit that comes after the fix commit in git ancestry). The vulnerable pattern is therefore not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.13.4.2. The vulnerability involves polymorphic deserialization of the dangerous JNDI gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit 1ca0388c2fb by Tatu Saloranta, dated 2020-12-26) adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This fix was included in upstream version 2.9.10.8 and all subsequent releases. The target version 2.13.4.2 already contained this upstream fix when TuxCare onboarded it (first TuxCare commit e675c916cf is an \"Onboard\" commit that comes after the fix commit in git ancestry). The vulnerable pattern is therefore not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:23:14.873847+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 affects jackson-databind versions before 2.9.10.8, involving deserialization gadget exploitation via DriverAdapterCPDS classes. The target repository (jackson-databind 2.13.4.2-tuxcare.3) is NOT AFFECTED because the upstream fix (commit 3ded28aece by Tatu Saloranta) was already present in the upstream release 2.13.4.2 before TuxCare onboarded it. All five DriverAdapterCPDS class variants are blocked in SubTypeValidator.java lines 123, 193, 219, 228, and 234. This is an upstream-authored fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "CVE-2020-36179 affects jackson-databind versions before 2.9.10.8, involving deserialization gadget exploitation via DriverAdapterCPDS classes. The target repository (jackson-databind 2.13.4.2-tuxcare.3) is NOT AFFECTED because the upstream fix (commit 3ded28aece by Tatu Saloranta) was already present in the upstream release 2.13.4.2 before TuxCare onboarded it. All five DriverAdapterCPDS class variants are blocked in SubTypeValidator.java lines 123, 193, 219, 228, and 234. This is an upstream-authored fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:33:21.899203+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.4.2-tuxcare.3) is NOT affected by CVE-2020-36180. The fix for this vulnerability was already present in the upstream release that TuxCare onboarded. The vulnerable class org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS is present in the deserialization blocklist in SubTypeValidator.java (line 219), preventing exploitation. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3ded28aece, which predates the first TuxCare commit by 1778 commits, confirming it was part of the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "The target repository (jackson-databind 2.13.4.2-tuxcare.3) is NOT affected by CVE-2020-36180. The fix for this vulnerability was already present in the upstream release that TuxCare onboarded. The vulnerable class org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS is present in the deserialization blocklist in SubTypeValidator.java (line 219), preventing exploitation. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3ded28aece, which predates the first TuxCare commit by 1778 commits, confirming it was part of the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:40:52.879992+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 affects jackson-databind versions before 2.9.10.8 and relates to unsafe deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The target version 2.13.4.2 already contains the fix from upstream commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b, which adds this class to the deserialization blocklist in SubTypeValidator.java (line 228). This fix was part of the upstream 2.13.4.2 release when TuxCare onboarded it, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 affects jackson-databind versions before 2.9.10.8 and relates to unsafe deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The target version 2.13.4.2 already contains the fix from upstream commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b, which adds this class to the deserialization blocklist in SubTypeValidator.java (line 228). This fix was part of the upstream 2.13.4.2 release when TuxCare onboarded it, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:12:02.519749+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.4.2-tuxcare.3) is not affected by CVE-2020-36182. The vulnerability pattern is not present because the fix was already included in the upstream release 2.13.4.2 that TuxCare onboarded. The fix (commit 3ded28aece by upstream maintainer Tatu Saloranta) added all DBCP DriverAdapterCPDS gadget class variants to Jackson's SubTypeValidator blocklist, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "The target repository (jackson-databind 2.13.4.2-tuxcare.3) is not affected by CVE-2020-36182. The vulnerability pattern is not present because the fix was already included in the upstream release 2.13.4.2 that TuxCare onboarded. The fix (commit 3ded28aece by upstream maintainer Tatu Saloranta) added all DBCP DriverAdapterCPDS gadget class variants to Jackson's SubTypeValidator blocklist, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:20:29.978023+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not present in jackson-databind 2.13.4.2. The vulnerability involves JNDI injection via deserialization of the org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class. The fix\u2014adding this class to the SubTypeValidator blocklist\u2014was implemented by upstream author Tatu Saloranta in commit 12e23c962ff (Dec 31, 2020) and shipped in jackson-databind 2.12.1 and all subsequent versions including 2.13.4.2. The blocklist entry at SubTypeValidator.java:243 prevents instantiation of this dangerous class during polymorphic deserialization. This is an upstream fix that was already present when TuxCare onboarded version 2.13.4.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "CVE-2020-36183 is not present in jackson-databind 2.13.4.2. The vulnerability involves JNDI injection via deserialization of the org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class. The fix\u2014adding this class to the SubTypeValidator blocklist\u2014was implemented by upstream author Tatu Saloranta in commit 12e23c962ff (Dec 31, 2020) and shipped in jackson-databind 2.12.1 and all subsequent versions including 2.13.4.2. The blocklist entry at SubTypeValidator.java:243 prevents instantiation of this dangerous class during polymorphic deserialization. This is an upstream fix that was already present when TuxCare onboarded version 2.13.4.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-02T13:12:07.986694+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes. The target version 2.13.4.2-tuxcare.2 contains the upstream vendor fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by Tatu Saloranta) that adds blocklist entries for PerUserPoolDataSource and SharedPoolDataSource. The vulnerable code pattern is not present because the fix shipped in upstream release 2.13.4.2 before TuxCare onboarded this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes. The target version 2.13.4.2-tuxcare.2 contains the upstream vendor fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by Tatu Saloranta) that adds blocklist entries for PerUserPoolDataSource and SharedPoolDataSource. The vulnerable code pattern is not present because the fix shipped in upstream release 2.13.4.2 before TuxCare onboarded this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:05:19.852884+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8. The target version 2.13.4.2 already contains the upstream fix (commit 567194c53a) which adds org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the SubTypeValidator blocklist. This fix was shipped in the upstream release 2.13.4.2, predating TuxCare's onboarding of this version. The vulnerable code pattern (missing blocklist entries for these gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8. The target version 2.13.4.2 already contains the upstream fix (commit 567194c53a) which adds org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the SubTypeValidator blocklist. This fix was shipped in the upstream release 2.13.4.2, predating TuxCare's onboarding of this version. The vulnerable code pattern (missing blocklist entries for these gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:29:58.600651+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.4.2-tuxcare.3 is not affected by CVE-2020-36186. The vulnerability concerns unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource classes. The fix (adding these classes to the deserialization blocklist in SubTypeValidator.java) was authored by upstream maintainer Tatu Saloranta in commit 3e8fa3beea and was already present in the upstream jackson-databind 2.13.4.2 release that TuxCare onboarded. The vulnerable code pattern is not present in HEAD because the upstream vendor fix shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "The target jackson-databind 2.13.4.2-tuxcare.3 is not affected by CVE-2020-36186. The vulnerability concerns unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource classes. The fix (adding these classes to the deserialization blocklist in SubTypeValidator.java) was authored by upstream maintainer Tatu Saloranta in commit 3e8fa3beea and was already present in the upstream jackson-databind 2.13.4.2 release that TuxCare onboarded. The vulnerable code pattern is not present in HEAD because the upstream vendor fix shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:43:31.851746+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.13.4.2-tuxcare.3 is not affected by CVE-2020-36187. The fix was already present in the upstream release 2.13.4.2 that TuxCare onboarded. The vulnerability involved deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta, dated 2020-12-26) added these classes to the deserialization blocklist in SubTypeValidator.java, preventing arbitrary code execution through malicious serialized data.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "The target repository jackson-databind version 2.13.4.2-tuxcare.3 is not affected by CVE-2020-36187. The fix was already present in the upstream release 2.13.4.2 that TuxCare onboarded. The vulnerability involved deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta, dated 2020-12-26) added these classes to the deserialization blocklist in SubTypeValidator.java, preventing arbitrary code execution through malicious serialized data.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:50:08.266665+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of specific newrelic-agent embedded logback classes. The target repository (jackson-databind 2.13.4.2-tuxcare.3) contains the upstream fix (commit 33d96c13fe) that adds the two dangerous classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.4.2 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of specific newrelic-agent embedded logback classes. The target repository (jackson-databind 2.13.4.2-tuxcare.3) contains the upstream fix (commit 33d96c13fe) that adds the two dangerous classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.4.2 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:59:16.129211+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is NOT present in jackson-databind 2.13.4.2. The vulnerability involves deserialization gadgets com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource that enable arbitrary code execution through polymorphic type handling. The fix (adding these classes to the deserialization blocklist) was already present in upstream release 2.13.4.2, authored by Tatu Saloranta (upstream maintainer) in commit 33d96c13fe1 on 2020-12-26. This commit is an ancestor of the first TuxCare onboarding commit (e675c916cf), confirming the fix shipped with the upstream release that TuxCare adopted.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 is NOT present in jackson-databind 2.13.4.2. The vulnerability involves deserialization gadgets com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource that enable arbitrary code execution through polymorphic type handling. The fix (adding these classes to the deserialization blocklist) was already present in upstream release 2.13.4.2, authored by Tatu Saloranta (upstream maintainer) in commit 33d96c13fe1 on 2020-12-26. This commit is an ancestor of the first TuxCare onboarding commit (e675c916cf), confirming the fix shipped with the upstream release that TuxCare adopted.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:16:00.456035+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.4.2-tuxcare.3 is NOT AFFECTED by CVE-2020-36518. The vulnerability (stack overflow via deeply nested JSON) was fixed in upstream commit fcfc4998ec2 by Taylor S. Marks, which was already part of upstream release 2.13.4.2 before TuxCare onboarded it. The fix adds MAX_DEPTH=1000 limit with depth checking in UntypedObjectDeserializer.Vanilla class, throwing JsonParseException for deeply nested JSON.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "The target jackson-databind 2.13.4.2-tuxcare.3 is NOT AFFECTED by CVE-2020-36518. The vulnerability (stack overflow via deeply nested JSON) was fixed in upstream commit fcfc4998ec2 by Taylor S. Marks, which was already part of upstream release 2.13.4.2 before TuxCare onboarded it. The fix adds MAX_DEPTH=1000 limit with depth checking in UntypedObjectDeserializer.Vanilla class, throwing JsonParseException for deeply nested JSON.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:09:26.959129+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 affects jackson-databind versions before 2.9.10.2 (and older series) due to missing xbean-reflect/JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target version 2.13.4.2-tuxcare.3 is much newer and already contains the upstream fix. The dangerous class is present in the deny list at SubTypeValidator.java:138, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (commit 9bb52c7122) and was already included in version 2.13.4.2 when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 affects jackson-databind versions before 2.9.10.2 (and older series) due to missing xbean-reflect/JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target version 2.13.4.2-tuxcare.3 is much newer and already contains the upstream fix. The dangerous class is present in the deny list at SubTypeValidator.java:138, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (commit 9bb52c7122) and was already included in version 2.13.4.2 when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target repository (jackson-databind 2.13.4.2-tuxcare.3) already contains the upstream fix that blocks this gadget class in SubTypeValidator.java. The fix was shipped in upstream release 2.13.4.2 before TuxCare onboarded it, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target repository (jackson-databind 2.13.4.2-tuxcare.3) already contains the upstream fix that blocks this gadget class in SubTypeValidator.java. The fix was shipped in upstream release 2.13.4.2 before TuxCare onboarded it, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:39:06.088867+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 concerns a deserialization gadget vulnerability related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target repository (jackson-databind 2.13.4.2-tuxcare.3) is NOT AFFECTED because the upstream vendor (FasterXML) fixed this vulnerability in commit 1e64db6a, which was already included in the upstream version 2.13.4.2 that TuxCare onboarded. The gadget class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java line 144, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 concerns a deserialization gadget vulnerability related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target repository (jackson-databind 2.13.4.2-tuxcare.3) is NOT AFFECTED because the upstream vendor (FasterXML) fixed this vulnerability in commit 1e64db6a, which was already included in the upstream version 2.13.4.2 that TuxCare onboarded. The gadget class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java line 144, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:14:34.572852+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is not present in jackson-databind version 2.13.4.2-tuxcare.3. The vulnerability involves deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class for arbitrary code execution. The upstream fix (commit 1e64db6a2f from 2020-02-29) added \"br.com.anteros.dbcp.AnterosDBCPConfig\" to the SubTypeValidator blocklist in SubTypeValidator.java line 145, preventing deserialization of this class. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release when TuxCare onboarded version 2.13.4.2 on 2026-08-26, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 is not present in jackson-databind version 2.13.4.2-tuxcare.3. The vulnerability involves deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class for arbitrary code execution. The upstream fix (commit 1e64db6a2f from 2020-02-29) added \"br.com.anteros.dbcp.AnterosDBCPConfig\" to the SubTypeValidator blocklist in SubTypeValidator.java line 145, preventing deserialization of this class. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release when TuxCare onboarded version 2.13.4.2 on 2026-08-26, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:11:46.166695+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 addresses deserialization gadget chains in jackson-databind via javax.swing.JTextPane and related classes. The target repository version 2.13.4.2-tuxcare.3 contains the upstream fix that was already present in the base version 2.13.4.2 before TuxCare's onboarding. The SubTypeValidator blocklist includes javax.swing.JTextPane (line 151) and all other CVE-2021-20190 gadget classes. The fix commits (7dbf51bf, 08fbfacf) were authored by upstream maintainers and are ancestors of HEAD, predating the first TuxCare commit (e675c916cf). The blocklist validation is hardcoded, actively enforced during deserialization by BeanDeserializerFactory, and cannot be disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 addresses deserialization gadget chains in jackson-databind via javax.swing.JTextPane and related classes. The target repository version 2.13.4.2-tuxcare.3 contains the upstream fix that was already present in the base version 2.13.4.2 before TuxCare's onboarding. The SubTypeValidator blocklist includes javax.swing.JTextPane (line 151) and all other CVE-2021-20190 gadget classes. The fix commits (7dbf51bf, 08fbfacf) were authored by upstream maintainers and are ancestors of HEAD, predating the first TuxCare commit (e675c916cf). The blocklist validation is hardcoded, actively enforced during deserialization by BeanDeserializerFactory, and cannot be disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 is NOT present in jackson-databind 2.13.4.2-tuxcare.3. The vulnerability affects JDK serialization of JsonNode objects, where a maliciously crafted serialization stream with a large declared byte-array length (e.g., 2 GB) could cause immediate heap allocation of that size, leading to denial of service. The upstream fix (commit 3ccde7d938) limits eager allocation to 100KB and uses incremental segmented allocation for larger declared lengths. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.13.4.2 release that TuxCare onboarded (first TuxCare commit e675c916cf \"Onboard version 2.13.4.2\"). The target code contains the complete fix unchanged. TuxCare backported this CVE to older affected versions (2.10.x, 2.11.x, 2.12.x, 2.13.0) but did not need to backport to 2.13.4.2 because the upstream release already included it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "CVE-2021-46877 is NOT present in jackson-databind 2.13.4.2-tuxcare.3. The vulnerability affects JDK serialization of JsonNode objects, where a maliciously crafted serialization stream with a large declared byte-array length (e.g., 2 GB) could cause immediate heap allocation of that size, leading to denial of service. The upstream fix (commit 3ccde7d938) limits eager allocation to 100KB and uses incremental segmented allocation for larger declared lengths. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.13.4.2 release that TuxCare onboarded (first TuxCare commit e675c916cf \"Onboard version 2.13.4.2\"). The target code contains the complete fix unchanged. TuxCare backported this CVE to older affected versions (2.10.x, 2.11.x, 2.12.x, 2.13.0) but did not need to backport to 2.13.4.2 because the upstream release already included it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:44:06.899174+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.13.4.2-tuxcare.3 is NOT affected by CVE-2022-42003. The vulnerability was fixed in the upstream release 2.13.4.2 before TuxCare onboarded this version. The fix commits (cd090979b7 for 2.12.x and 2c4a601c62 for 2.13.x) added checks to prevent deep wrapper array nesting when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. These fixes are present in the target code at StdDeserializer.java (handleNestedArrayForSingle method and checks in primitive deserializers) and BeanDeserializer.java (_deserializeFromArray method). The vulnerable pattern (unbounded recursive array unwrapping) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "The target repository jackson-databind 2.13.4.2-tuxcare.3 is NOT affected by CVE-2022-42003. The vulnerability was fixed in the upstream release 2.13.4.2 before TuxCare onboarded this version. The fix commits (cd090979b7 for 2.12.x and 2c4a601c62 for 2.13.x) added checks to prevent deep wrapper array nesting when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. These fixes are present in the target code at StdDeserializer.java (handleNestedArrayForSingle method and checks in primitive deserializers) and BeanDeserializer.java (_deserializeFromArray method). The vulnerable pattern (unbounded recursive array unwrapping) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 has been fixed in jackson-databind 2.13.4.2. The vulnerability allowed resource exhaustion through deeply nested JSON arrays when UNWRAP_SINGLE_VALUE_ARRAYS feature was enabled. The fix (upstream commit 063183589) adds a check in BeanDeserializer._deserializeFromArray() that detects and rejects arrays nested more than one level deep, preventing unbounded recursion. This fix was included in upstream release 2.13.4, and 2.13.4.2 is a later patch release on the same line, so it carries the guard: _deserializeFromArray() rejects a second START_ARRAY through handleUnexpectedToken, reporting that only a single wrapper array is allowed, and the reproducer DeepArrayWrappingForDeser3582Test asserts that a 9999-deep array now fails. The advisory records the affected ranges as 2.13.0 up to 2.13.4 and 2.4.0-rc1 up to 2.12.7.1.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "CVE-2022-42004 has been fixed in jackson-databind 2.13.4.2. The vulnerability allowed resource exhaustion through deeply nested JSON arrays when UNWRAP_SINGLE_VALUE_ARRAYS feature was enabled. The fix (upstream commit 063183589) adds a check in BeanDeserializer._deserializeFromArray() that detects and rejects arrays nested more than one level deep, preventing unbounded recursion. This fix was included in upstream release 2.13.4, and 2.13.4.2 is a later patch release on the same line, so it carries the guard: _deserializeFromArray() rejects a second START_ARRAY through handleUnexpectedToken, reporting that only a single wrapper array is allowed, and the reproducer DeepArrayWrappingForDeser3582Test asserts that a 9999-deep array now fails. The advisory records the affected ranges as 2.13.0 up to 2.13.4 and 2.4.0-rc1 up to 2.12.7.1." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-03T02:00:46.216689+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.13.4.2 is not affected by CVE-2026-54518. The vulnerability requires support for @JsonUnwrapped with @JsonCreator (feature #1467), which does not exist in this version. The vulnerable method UnwrappedPropertyHandler.processUnwrappedCreatorProperties() and the code path that processes unwrapped creator parameters were only introduced in version 2.19.0 (November 2024). In version 2.13.4...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Version 2.13.4.2 is not affected by CVE-2026-54518. The vulnerability requires support for @JsonUnwrapped with @JsonCreator (feature #1467), which does not exist in this version. The vulnerable method UnwrappedPropertyHandler.processUnwrappedCreatorProperties() and the code path that processes unwrapped creator parameters were only introduced in version 2.19.0 (November 2024). In version 2.13.4..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-05T11:10:46.140407+00:00", "status_notes": "Vulnerability CVE-2026-59888 affects version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.4.2-tuxcare.4.", "vulnerability": { "name": "CVE-2026-59888" }, "action_statement": "Vulnerability CVE-2026-59888 affects version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.4.2-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.13.4.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:24:11.874004+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.13.4.2-tuxcare.3.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }