{ "@id": "urn:uuid:572ede5d-2da1-47b7-ad5c-ea38138aceae", "role": "Document Creator", "author": "https://tuxcare.com", "version": 82, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T18:07:00.029185+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T13:17:11.201920+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability involves unsafe polymorphic deserialization that allows arbitrary code execution via malicious JSON payloads containing dangerous gadget class names. The upstream vendor (FasterXML) fixed this in 2017-2018 by implementing a blacklist mechanism in SubTypeValidator.java that blocks deserialization of exploit classes including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and various Spring/C3P0 DataSource types. The fix was already present in upstream version 2.15.0 when TuxCare onboarded it in July 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability involves unsafe polymorphic deserialization that allows arbitrary code execution via malicious JSON payloads containing dangerous gadget class names. The upstream vendor (FasterXML) fixed this in 2017-2018 by implementing a blacklist mechanism in SubTypeValidator.java that blocks deserialization of exploit classes including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and various Spring/C3P0 DataSource types. The fix was already present in upstream version 2.15.0 when TuxCare onboarded it in July 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T15:48:33.739879+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3 due to an incomplete blacklist fix for polymorphic deserialization. The target version 2.15.0 already contains the complete fix (SubTypeValidator with comprehensive blacklisting and Spring/C3P0 hierarchy checking) that shipped in upstream release 2.15.0. The vulnerable pattern is not present because the fix was included in the upstream release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3 due to an incomplete blacklist fix for polymorphic deserialization. The target version 2.15.0 already contains the complete fix (SubTypeValidator with comprehensive blacklisting and Spring/C3P0 hierarchy checking) that shipped in upstream release 2.15.0. The vulnerable pattern is not present because the fix was included in the upstream release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T14:38:19.408252+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 (Jackson deserialization RCE via TemplatesImpl gadget) is not present in jackson-databind 2.15.0. The fix was already included in the upstream 2.15.0 release that TuxCare onboarded. The target contains SubTypeValidator with a comprehensive blocklist including both TemplatesImpl variants (com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl and org.apache.xalan.xsltc.trax.TemplatesImpl), and this validation is enforced unconditionally during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 (Jackson deserialization RCE via TemplatesImpl gadget) is not present in jackson-databind 2.15.0. The fix was already included in the upstream 2.15.0 release that TuxCare onboarded. The target contains SubTypeValidator with a comprehensive blocklist including both TemplatesImpl variants (com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl and org.apache.xalan.xsltc.trax.TemplatesImpl), and this validation is enforced unconditionally during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T13:24:51.671524+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability involved deserialization of the iBatis XPathParser gadget class when Jackson's default typing is enabled, allowing data exfiltration via XML external entities. The upstream vendor (FasterXML) fixed this in version 2.7.9.4 by adding org.apache.ibatis.parsing.XPathParser to the SubTypeValidator blacklist. This fix was already present in the upstream release that TuxCare onboarded, appearing in commit 27b4defc27 by upstream maintainer tatu.saloranta@iki.fi. The blacklist entry is at SubTypeValidator.java line 65 and is actively enforced during polymorphic deserialization via BeanDeserializerFactory line 141. Version 2.15.0 is significantly newer than the fixed versions (2.7.9.4, 2.8.11.2, 2.9.6) and inherited the fix from upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability involved deserialization of the iBatis XPathParser gadget class when Jackson's default typing is enabled, allowing data exfiltration via XML external entities. The upstream vendor (FasterXML) fixed this in version 2.7.9.4 by adding org.apache.ibatis.parsing.XPathParser to the SubTypeValidator blacklist. This fix was already present in the upstream release that TuxCare onboarded, appearing in commit 27b4defc27 by upstream maintainer tatu.saloranta@iki.fi. The blacklist entry is at SubTypeValidator.java line 65 and is actively enforced during polymorphic deserialization via BeanDeserializerFactory line 141. Version 2.15.0 is significantly newer than the fixed versions (2.7.9.4, 2.8.11.2, 2.9.6) and inherited the fix from upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability involves polymorphic deserialization of Jodd-db and Oracle JDBC classes that can trigger JNDI/LDAP lookups leading to remote code execution when Default Typing is enabled. The upstream fix (commits 28badf7ef6 and 7487cf7eb1) added these classes to SubTypeValidator's blacklist, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in the upstream 2.15.0 release that TuxCare onboarded. The blacklist entries are confirmed present in SubTypeValidator.java lines 67-72 and actively enforced in the deserialization path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability involves polymorphic deserialization of Jodd-db and Oracle JDBC classes that can trigger JNDI/LDAP lookups leading to remote code execution when Default Typing is enabled. The upstream fix (commits 28badf7ef6 and 7487cf7eb1) added these classes to SubTypeValidator's blacklist, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in the upstream 2.15.0 release that TuxCare onboarded. The blacklist entries are confirmed present in SubTypeValidator.java lines 67-72 and actively enforced in the deserialization path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T16:26:23.100345+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability allowed arbitrary code execution via polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing was enabled. The upstream fix, which blacklists these dangerous classes in SubTypeValidator.java, was already present in the upstream jackson-databind 2.15.0 release that TuxCare onboarded. The target is not affected because the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability allowed arbitrary code execution via polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing was enabled. The upstream fix, which blacklists these dangerous classes in SubTypeValidator.java, was already present in the upstream jackson-databind 2.15.0 release that TuxCare onboarded. The target is not affected because the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T14:04:28.993792+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 affects jackson-databind versions before 2.6.7.3, 2.7.9.5, 2.8.11.3, and 2.9.7 due to missing blocklist entries for slf4j-ext and other dangerous classes in polymorphic deserialization. The target version 2.15.0-tuxcare.2 is NOT affected because the upstream vendor fix (commit 87d29af25e) was already present in the upstream release 2.15.0 that TuxCare onboarded. The defense blocklist entries are present in SubTypeValidator.java (lines 75-78) and actively enforced by validateSubType() during deserialization (line 269). The vulnerable pattern (missing blocklist validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 affects jackson-databind versions before 2.6.7.3, 2.7.9.5, 2.8.11.3, and 2.9.7 due to missing blocklist entries for slf4j-ext and other dangerous classes in polymorphic deserialization. The target version 2.15.0-tuxcare.2 is NOT affected because the upstream vendor fix (commit 87d29af25e) was already present in the upstream release 2.15.0 that TuxCare onboarded. The defense blocklist entries are present in SubTypeValidator.java (lines 75-78) and actively enforced by validateSubType() during deserialization (line 269). The vulnerable pattern (missing blocklist validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T16:06:01.860590+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is not present in jackson-databind 2.15.0. The vulnerability involves polymorphic deserialization of BlazeDS (flex.messaging) classes leading to arbitrary code execution. The upstream fix from commit 87d29af25e (authored by Tatu Saloranta) adds flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor to the deserialization blocklist, and this fix was already included in the upstream 2.15.0 release before TuxCare onboarded it. The defense is present and active in SubTypeValidator.java:76, and the validation is executed unconditionally during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 is not present in jackson-databind 2.15.0. The vulnerability involves polymorphic deserialization of BlazeDS (flex.messaging) classes leading to arbitrary code execution. The upstream fix from commit 87d29af25e (authored by Tatu Saloranta) adds flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor to the deserialization blocklist, and this fix was already included in the upstream 2.15.0 release before TuxCare onboarded it. The defense is present and active in SubTypeValidator.java:76, and the validation is executed unconditionally during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T14:11:33.363226+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 affects jackson-databind versions before 2.9.7. The target version 2.15.0-tuxcare.2 already contains the upstream vendor fix that blocks the four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) from polymorphic deserialization. The fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream 2.15.0 release before TuxCare onboarded it. The blocklist is actively enforced through SubTypeValidator during bean deserialization, preventing XXE attacks via these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 affects jackson-databind versions before 2.9.7. The target version 2.15.0-tuxcare.2 already contains the upstream vendor fix that blocks the four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) from polymorphic deserialization. The fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream 2.15.0 release before TuxCare onboarded it. The blocklist is actively enforced through SubTypeValidator during bean deserialization, preventing XXE attacks via these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T14:41:24.721852+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721: Target is NOT AFFECTED. The vulnerability allows SSRF attacks via polymorphic deserialization of the axis2-jaxws class. The fix blocking \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" is present in SubTypeValidator.java:78, actively enforced during deserialization at BeanDeserializerFactory.java:141. This fix was authored by upstream maintainer Tatu Saloranta in commit 87d29af2 and shipped in upstream release 2.15.0 before TuxCare onboarded it. The dangerous class cannot be deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721: Target is NOT AFFECTED. The vulnerability allows SSRF attacks via polymorphic deserialization of the axis2-jaxws class. The fix blocking \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" is present in SubTypeValidator.java:78, actively enforced during deserialization at BeanDeserializerFactory.java:141. This fix was authored by upstream maintainer Tatu Saloranta in commit 87d29af2 and shipped in upstream release 2.15.0 before TuxCare onboarded it. The dangerous class cannot be deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T12:59:16.129211+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. The target repository (jackson-databind 2.15.0-tuxcare.2) is NOT AFFECTED because the fix was already included in the upstream 2.15.0 release. The dangerous class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:85, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the original 2.15.0 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. The target repository (jackson-databind 2.15.0-tuxcare.2) is NOT AFFECTED because the fix was already included in the upstream 2.15.0 release. The dangerous class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:85, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the original 2.15.0 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T17:04:40.164782+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.15.0-tuxcare.2 is not affected by CVE-2018-19361. The vulnerability, which allowed polymorphic deserialization of dangerous OpenJPA classes, was fixed in upstream jackson-databind before version 2.15.0 was released. The fix (commit 72cd4025a2 \"Fix #2186\" by Tatu Saloranta) adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.0 release that TuxCare onboarded, as confirmed by merge-base analysis showing the fix commit predates the first TuxCare commit (34b5cb2df0 \"For Grails 6.2.3: Onboard version 2.15.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "The target repository jackson-databind version 2.15.0-tuxcare.2 is not affected by CVE-2018-19361. The vulnerability, which allowed polymorphic deserialization of dangerous OpenJPA classes, was fixed in upstream jackson-databind before version 2.15.0 was released. The fix (commit 72cd4025a2 \"Fix #2186\" by Tatu Saloranta) adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.0 release that TuxCare onboarded, as confirmed by merge-base analysis showing the fix commit predates the first TuxCare commit (34b5cb2df0 \"For Grails 6.2.3: Onboard version 2.15.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T15:30:13.587550+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.jboss.util.propertyeditor.DocumentEditor, which enables polymorphic deserialization gadget attacks. The target repository (version 2.15.0-tuxcare.2) contains the upstream fix from commit 72cd4025a2 (Nov 2018), which adds DocumentEditor to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java at line 81. This fix was already present in the upstream 2.15.0 release that TuxCare onboarded, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.jboss.util.propertyeditor.DocumentEditor, which enables polymorphic deserialization gadget attacks. The target repository (version 2.15.0-tuxcare.2) contains the upstream fix from commit 72cd4025a2 (Nov 2018), which adds DocumentEditor to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java at line 81. This fix was already present in the upstream 2.15.0 release that TuxCare onboarded, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3, allowing RCE via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory). The target version 2.15.0-tuxcare.2 is NOT affected because the upstream fix (commit 038b471e2e) was already included in the 2.15.0 release that TuxCare onboarded. Both gadget classes are present in the SubTypeValidator blacklist (lines 62-63), and the validation is enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3, allowing RCE via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory). The target version 2.15.0-tuxcare.2 is NOT affected because the upstream fix (commit 038b471e2e) was already included in the 2.15.0 release that TuxCare onboarded. Both gadget classes are present in the SubTypeValidator blacklist (lines 62-63), and the validation is enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T14:03:03.714600+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability allowed remote code execution via unsafe deserialization of c3p0 DataSource classes. The fix (commit 6799f8f10c by upstream author tatu.saloranta@iki.fi) blocks deserialization of classes matching the pattern `com.mchange.v2.c3p0.*DataSource` and was already present in the upstream 2.15.0 release that TuxCare onboarded. The target contains the complete blocking logic in SubTypeValidator.java lines 288-297.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability allowed remote code execution via unsafe deserialization of c3p0 DataSource classes. The fix (commit 6799f8f10c by upstream author tatu.saloranta@iki.fi) blocks deserialization of classes matching the pattern `com.mchange.v2.c3p0.*DataSource` and was already present in the upstream 2.15.0 release that TuxCare onboarded. The target contains the complete blocking logic in SubTypeValidator.java lines 288-297.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T16:37:30.400386+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind 2.15.0. The vulnerability affects versions before 2.9.9 where the MySQL JDBC gadget class com.mysql.cj.jdbc.admin.MiniAdmin was missing from the polymorphic deserialization blocklist. The upstream vendor (Tatu Saloranta) fixed this in commit dda513bd (May 2019) for version 2.9.9. Target version 2.15.0 was released years later (2023) with the fix already present in SubTypeValidator.java:87. TuxCare onboarded the already-fixed upstream 2.15.0 release. The vulnerable pattern (missing MiniAdmin blocklist entry) is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind 2.15.0. The vulnerability affects versions before 2.9.9 where the MySQL JDBC gadget class com.mysql.cj.jdbc.admin.MiniAdmin was missing from the polymorphic deserialization blocklist. The upstream vendor (Tatu Saloranta) fixed this in commit dda513bd (May 2019) for version 2.9.9. Target version 2.15.0 was released years later (2023) with the fix already present in SubTypeValidator.java:87. TuxCare onboarded the already-fixed upstream 2.15.0 release. The vulnerable pattern (missing MiniAdmin blocklist entry) is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-01T18:53:00.171889+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.15.0-tuxcare.2 is not affected by CVE-2019-12384. The vulnerability was fixed upstream in version 2.9.9.1 by adding ch.qos.logback.core.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.0 release that TuxCare onboarded, confirmed by commit c9ef4a10d6f6633cf470d6a469514b68fa2be234 being a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 Target version 2.15.0-tuxcare.2 is not affected by CVE-2019-12384. The vulnerability was fixed upstream in version 2.9.9.1 by adding ch.qos.logback.core.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.0 release that TuxCare onboarded, confirmed by commit c9ef4a10d6f6633cf470d6a469514b68fa2be234 being a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-02T07:35:00.435715+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability affects jackson-databind when polymorphic typing is enabled and allows attackers to instantiate dangerous classes like org.jdom.transform.XSLTransformer. The upstream fix (commit 5f7c69bba07) added these classes to the deserialization blacklist in SubTypeValidator.java and was already included in the upstream ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability affects jackson-databind when polymorphic typing is enabled and allows attackers to instantiate dangerous classes like org.jdom.transform.XSLTransformer. The upstream fix (commit 5f7c69bba07) added these classes to the deserialization blacklist in SubTypeValidator.java and was already included in the upstream ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T12:19:18.164920+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability was fixed in upstream release 2.9.9.2 (July 2019) by adding blacklist entries for dangerous deserialization classes including 'net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup'. The target repository version 2.15.0 (released April 2023) already contains this upstream fix, which was included when TuxCare onboarded the 2.15.0 release. The fix commit (ad418eeb974e357f2797aef64aa0e3ffaaa6125b) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability was fixed in upstream release 2.9.9.2 (July 2019) by adding blacklist entries for dangerous deserialization classes including 'net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup'. The target repository version 2.15.0 (released April 2023) already contains this upstream fix, which was included when TuxCare onboarded the 2.15.0 release. The fix commit (ad418eeb974e357f2797aef64aa0e3ffaaa6125b) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T13:49:07.796693+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 when Default Typing is enabled with logback in classpath. The target version 2.15.0-tuxcare.2 already contains the upstream fix that blacklists ch.qos.logback.core.db.JNDIConnectionSource. The fix commit (ad418eeb974e357f2797aef64aa0e3ffaaa6125b) was authored by upstream maintainer Tatu Saloranta in July 2019 and is part of the upstream 2.15.0 release that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 when Default Typing is enabled with logback in classpath. The target version 2.15.0-tuxcare.2 already contains the upstream fix that blacklists ch.qos.logback.core.db.JNDIConnectionSource. The fix commit (ad418eeb974e357f2797aef64aa0e3ffaaa6125b) was authored by upstream maintainer Tatu Saloranta in July 2019 and is part of the upstream 2.15.0 release that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T16:53:33.389442+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.15.0-tuxcare.2 is NOT AFFECTED by CVE-2019-14540. The upstream vendor (Tatu Saloranta) fixed this polymorphic deserialization vulnerability in August 2019 by adding com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the deserialization blocklist (commit d4983c740f). This fix shipped in upstream release 2.9.10 and all subsequent versions. When TuxCare onboarded version 2.15.0 in the target repository, the fix was already present in the upstream code. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "Target jackson-databind 2.15.0-tuxcare.2 is NOT AFFECTED by CVE-2019-14540. The upstream vendor (Tatu Saloranta) fixed this polymorphic deserialization vulnerability in August 2019 by adding com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the deserialization blocklist (commit d4983c740f). This fix shipped in upstream release 2.9.10 and all subsequent versions. When TuxCare onboarded version 2.15.0 in the target repository, the fix was already present in the upstream code. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T16:01:11.316675+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3, allowing polymorphic deserialization of malicious commons-configuration JNDI classes leading to arbitrary code execution. The target version 2.15.0 already contains the upstream fix (commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af by Tatu Saloranta, dated 2019-09-19) that adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist in SubTypeValidator.java. This fix was part of the upstream release 2.15.0 before TuxCare onboarded the project on 2023-04-24. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3, allowing polymorphic deserialization of malicious commons-configuration JNDI classes leading to arbitrary code execution. The target version 2.15.0 already contains the upstream fix (commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af by Tatu Saloranta, dated 2019-09-19) that adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist in SubTypeValidator.java. This fix was part of the upstream release 2.15.0 before TuxCare onboarded the project on 2023-04-24. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 does not affect jackson-databind 2.15.0-tuxcare.2. The vulnerability affects versions before 2.9.10 and 2.10.0. The target version 2.15.0 already contains the upstream fix (commit 998efd7082) which adds \"org.apache.xalan.lib.sql.JNDIConnectionPool\" to the deserialization blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was included in the upstream jackson-databind 2.9.10 release, prior to TuxCare's onboarding of version 2.15.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893 does not affect jackson-databind 2.15.0-tuxcare.2. The vulnerability affects versions before 2.9.10 and 2.10.0. The target version 2.15.0 already contains the upstream fix (commit 998efd7082) which adds \"org.apache.xalan.lib.sql.JNDIConnectionPool\" to the deserialization blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was included in the upstream jackson-databind 2.9.10 release, prior to TuxCare's onboarding of version 2.15.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T17:10:09.687234+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.15.0-tuxcare.2 is NOT AFFECTED by CVE-2019-16335. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource as a gadget type for RCE. The upstream fix (commit 73c1c2cc76 by Tatu Saloranta) added HikariDataSource to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in upstream release 2.15.0 that TuxCare onboarded (first TuxCare commit 34b5cb2df0). The defense is active at SubTypeValidator.java:107 and unconditionally enforced during bean deserialization at BeanDeserializerFactory.java:141. No configuration required - the protection is enabled by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "Target jackson-databind 2.15.0-tuxcare.2 is NOT AFFECTED by CVE-2019-16335. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource as a gadget type for RCE. The upstream fix (commit 73c1c2cc76 by Tatu Saloranta) added HikariDataSource to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in upstream release 2.15.0 that TuxCare onboarded (first TuxCare commit 34b5cb2df0). The defense is active at SubTypeValidator.java:107 and unconditionally enforced during bean deserialization at BeanDeserializerFactory.java:141. No configuration required - the protection is enabled by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T15:13:02.714408+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability affects versions 2.0.0-2.9.10 and involves polymorphic deserialization of commons-dbcp classes (SharedPoolDataSource, PerUserPoolDataSource) and p6spy (P6DataSource) when Default Typing is enabled. The target version 2.15.0 already contains the upstream fix (commit 9593e16cf5 by tatu.saloranta@iki.fi) that adds these classes to the deny-list in SubTypeValidator.java. This fix was included in the upstream release before TuxCare onboarded version 2.15.0, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability affects versions 2.0.0-2.9.10 and involves polymorphic deserialization of commons-dbcp classes (SharedPoolDataSource, PerUserPoolDataSource) and p6spy (P6DataSource) when Default Typing is enabled. The target version 2.15.0 already contains the upstream fix (commit 9593e16cf5 by tatu.saloranta@iki.fi) that adds these classes to the deny-list in SubTypeValidator.java. This fix was included in the upstream release before TuxCare onboarded version 2.15.0, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T17:21:23.053995+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability was fixed in upstream jackson-databind by adding com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes to the SubTypeValidator denylist. This fix was committed by upstream maintainer Tatu Saloranta on 2019-09-28 (commit 9593e16cf5) and was already present in the upstream 2.15.0 release when TuxCare onboarded it on 2026-07-30. The target code contains all three denylisted classes at lines 124-127 of SubTypeValidator.java, and the denylist is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability was fixed in upstream jackson-databind by adding com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes to the SubTypeValidator denylist. This fix was committed by upstream maintainer Tatu Saloranta on 2019-09-28 (commit 9593e16cf5) and was already present in the upstream 2.15.0 release when TuxCare onboarded it on 2026-07-30. The target code contains all three denylisted classes at lines 124-127 of SubTypeValidator.java, and the denylist is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T15:30:53.892571+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is NOT present in jackson-databind 2.15.0. The vulnerability involved a polymorphic deserialization gadget (net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup) that could enable arbitrary code execution. The upstream fix (commit 191a4cdf87, issue #2460) added this class to the SubTypeValidator blacklist, preventing its instantiation during deserialization. This fix was already included in the upstream jackson-databind 2.15.0 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (34b5cb2df0). The blacklist entry is present and active at SubTypeValidator.java:99.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 is NOT present in jackson-databind 2.15.0. The vulnerability involved a polymorphic deserialization gadget (net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup) that could enable arbitrary code execution. The upstream fix (commit 191a4cdf87, issue #2460) added this class to the SubTypeValidator blacklist, preventing its instantiation during deserialization. This fix was already included in the upstream jackson-databind 2.15.0 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (34b5cb2df0). The blacklist entry is present and active at SubTypeValidator.java:99.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T14:51:16.476690+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3 (fixed in October 2019). The target version 2.15.0 was released in May 2023, long after the fix. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) that blocks deserialization of the two dangerous log4j-extras classes was already present in the upstream 2.15.0 release when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3 (fixed in October 2019). The target version 2.15.0 was released in May 2023, long after the fix. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) that blocks deserialization of the two dangerous log4j-extras classes was already present in the upstream 2.15.0 release when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability concerns missing blocklist entries for two net.sf.ehcache classes (GenericJndiSelector and GlassfishSelector) that could enable JNDI-based deserialization attacks. The upstream fix (commit fc4214a883d by Tatu Saloranta, 2019-11-01) was already included in the jackson-databind 2.15.0 release before TuxCare onboarded it. The blocklist entries are present in SubTypeValidator.java lines 133-135 and actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability concerns missing blocklist entries for two net.sf.ehcache classes (GenericJndiSelector and GlassfishSelector) that could enable JNDI-based deserialization attacks. The upstream fix (commit fc4214a883d by Tatu Saloranta, 2019-11-01) was already included in the jackson-databind 2.15.0 release before TuxCare onboarded it. The blocklist entries are present in SubTypeValidator.java lines 133-135 and actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T17:09:06.581572+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.15.0-tuxcare.2) is NOT AFFECTED by CVE-2020-10650. The vulnerability involves unsafe deserialization of ignite-jta classes that can lead to arbitrary code execution. The upstream vendor fix (commit a424c038ba) added three classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.15.0 that TuxCare onboarded, well before this CVE's affected version range (before 2.9.10.4). The vulnerable code pattern does not exist in the target because the fix was shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "The target repository (jackson-databind 2.15.0-tuxcare.2) is NOT AFFECTED by CVE-2020-10650. The vulnerability involves unsafe deserialization of ignite-jta classes that can lead to arbitrary code execution. The upstream vendor fix (commit a424c038ba) added three classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.15.0 that TuxCare onboarded, well before this CVE's affected version range (before 2.9.10.4). The vulnerable code pattern does not exist in the target because the fix was shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.15.0-tuxcare.2 is NOT vulnerable to CVE-2020-10672. The fix for this deserialization gadget vulnerability was already present in the upstream 2.15.0 release (committed March 15, 2020 by upstream maintainer Tatu Saloranta). The vulnerable class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory is blocked in SubTypeValidator.java at line 163, preventing malicious deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "The target jackson-databind version 2.15.0-tuxcare.2 is NOT vulnerable to CVE-2020-10672. The fix for this deserialization gadget vulnerability was already present in the upstream 2.15.0 release (committed March 15, 2020 by upstream maintainer Tatu Saloranta). The vulnerable class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory is blocked in SubTypeValidator.java at line 163, preventing malicious deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T16:35:21.882986+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerable deserialization gadget class com.caucho.config.types.ResourceRef is blocked by the SubTypeValidator blocklist at line 167. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 1645efbd392989cf015f459a91c999e59c921b15 (March 2020) and shipped in the upstream 2.15.0 release that TuxCare onboarded. The validation mechanism is enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerable deserialization gadget class com.caucho.config.types.ResourceRef is blocked by the SubTypeValidator blocklist at line 167. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 1645efbd392989cf015f459a91c999e59c921b15 (March 2020) and shipped in the upstream 2.15.0 release that TuxCare onboarded. The validation mechanism is enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.15.0 is not affected by CVE-2020-10968. The vulnerability affects versions before 2.9.10.4. The fix was introduced in upstream commit 05d7e0e13f (March 25, 2020) by Tatu Saloranta and shipped in upstream release 2.9.10.4 (April 11, 2020). The target version 2.15.0 already contains the fix, which adds blocklist entries for org.aoju.bus.proxy.provider.remoting.RmiProvider and related gadget classes to SubTypeValidator.java, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "The target jackson-databind version 2.15.0 is not affected by CVE-2020-10968. The vulnerability affects versions before 2.9.10.4. The fix was introduced in upstream commit 05d7e0e13f (March 25, 2020) by Tatu Saloranta and shipped in upstream release 2.9.10.4 (April 11, 2020). The target version 2.15.0 already contains the fix, which adds blocklist entries for org.aoju.bus.proxy.provider.remoting.RmiProvider and related gadget classes to SubTypeValidator.java, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target version 2.15.0 is not affected by CVE-2020-10969. The fix that adds \"javax.swing.JEditorPane\" to the deserialization blocklist (preventing polymorphic deserialization gadget attacks) was already present in the upstream release 2.15.0 that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream version 2.9.10.4, which predates version 2.15.0. The vulnerable pattern does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "The target version 2.15.0 is not affected by CVE-2020-10969. The fix that adds \"javax.swing.JEditorPane\" to the deserialization blocklist (preventing polymorphic deserialization gadget attacks) was already present in the upstream release 2.15.0 that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream version 2.9.10.4, which predates version 2.15.0. The vulnerable pattern does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.15.0-tuxcare.2 is NOT affected by CVE-2020-11111. The vulnerability concerns deserialization gadgets in org.apache.activemq.* classes. The upstream fix (commit c14c9f99ed by tatu.saloranta@iki.fi) was already present in the 2.15.0 release before TuxCare onboarded it. SubTypeValidator.java (lines 173-183) contains a complete blocklist of all nine ActiveMQ classes mentioned in the patches, preventing their deserialization. The validator is enforced during deserialization via BeanDeserializerFactory, throwing JsonMappingException before gadget instantiation. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "The target repository jackson-databind 2.15.0-tuxcare.2 is NOT affected by CVE-2020-11111. The vulnerability concerns deserialization gadgets in org.apache.activemq.* classes. The upstream fix (commit c14c9f99ed by tatu.saloranta@iki.fi) was already present in the 2.15.0 release before TuxCare onboarded it. SubTypeValidator.java (lines 173-183) contains a complete blocklist of all nine ActiveMQ classes mentioned in the patches, preventing their deserialization. The validator is enforced during deserialization via BeanDeserializerFactory, throwing JsonMappingException before gadget instantiation. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is not present in jackson-databind 2.15.0. The vulnerability relates to unsafe deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider. The target contains the upstream fix (commit 05d7e0e13f by Tatu Saloranta, March 25, 2020) which adds this class to the SubTypeValidator blocklist at line 186, preventing its deserialization. This fix was included in the upstream 2.15.0 release that TuxCare onboarded, making it an upstream-provided defense rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 is not present in jackson-databind 2.15.0. The vulnerability relates to unsafe deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider. The target contains the upstream fix (commit 05d7e0e13f by Tatu Saloranta, March 25, 2020) which adds this class to the SubTypeValidator blocklist at line 186, preventing its deserialization. This fix was included in the upstream 2.15.0 release that TuxCare onboarded, making it an upstream-provided defense rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is not present in jackson-databind 2.15.0. The vulnerability involved unsafe deserialization of the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix (adding this class to SubTypeValidator's blocklist) was already included in the upstream 2.15.0 release, which TuxCare onboarded. The fix commit e2ba12d5d was authored by upstream maintainer Tatu Saloranta and was present before any TuxCare work on this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 is not present in jackson-databind 2.15.0. The vulnerability involved unsafe deserialization of the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix (adding this class to SubTypeValidator's blocklist) was already included in the upstream 2.15.0 release, which TuxCare onboarded. The fix commit e2ba12d5d was authored by upstream maintainer Tatu Saloranta and was present before any TuxCare work on this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 concerns jackson-databind deserialization gadgets related to Spring Framework classes (org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean). The upstream fix (commit 113e89fb08, April 2020) adds these classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was already present in upstream jackson-databind 2.15.0 release, which TuxCare onboarded into version 2.15.0-tuxcare.2. The CVE affects versions \"before 2.9.10.4\" and target version 2.15.0 is significantly newer. The target is not vulnerable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 concerns jackson-databind deserialization gadgets related to Spring Framework classes (org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean). The upstream fix (commit 113e89fb08, April 2020) adds these classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was already present in upstream jackson-databind 2.15.0 release, which TuxCare onboarded into version 2.15.0-tuxcare.2. The CVE affects versions \"before 2.9.10.4\" and target version 2.15.0 is significantly newer. The target is not vulnerable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.15.0-tuxcare.2 is NOT affected by CVE-2020-11620. The vulnerability involves deserialization gadgets related to org.apache.commons.jelly.impl.Embedded. The upstream fix, which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, was shipped in upstream release 2.9.10.4 (April 2020) and is present in the target's version 2.15.0. The fix commit (77040d85e3) was authored by upstream maintainer Tatu Saloranta and was part of the upstream release that TuxCare onboarded, not a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "The target repository jackson-databind version 2.15.0-tuxcare.2 is NOT affected by CVE-2020-11620. The vulnerability involves deserialization gadgets related to org.apache.commons.jelly.impl.Embedded. The upstream fix, which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, was shipped in upstream release 2.9.10.4 (April 2020) and is present in the target's version 2.15.0. The fix commit (77040d85e3) was authored by upstream maintainer Tatu Saloranta and was part of the upstream release that TuxCare onboarded, not a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability involved Jackson deserialization gadgets allowing remote code execution via JNDI injection when polymorphic type handling is enabled. The vendor fix added the gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` (and related classes) to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already included in the upstream jackson-databind 2.15.0 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta in commit d1c67a0396 (April 2020). The target contains the complete fix at SubTypeValidator.java:192-195, blocking all CVE-2020-14060 gadget classes from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability involved Jackson deserialization gadgets allowing remote code execution via JNDI injection when polymorphic type handling is enabled. The vendor fix added the gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` (and related classes) to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already included in the upstream jackson-databind 2.15.0 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta in commit d1c67a0396 (April 2020). The target contains the complete fix at SubTypeValidator.java:192-195, blocking all CVE-2020-14060 gadget classes from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 does not affect jackson-databind 2.15.0-tuxcare.2. The fix blocking deserialization of Oracle JMS gadget classes (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) was already included in the upstream 2.15.0 release. These classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 200-204), preventing the deserialization attack described in the CVE. The fix commit (5c8642aeae9c756b438ab7637c90ef3c77966e6e) was authored by upstream maintainer Tatu Saloranta on 2020-04-24, over 6 years before TuxCare onboarded version 2.15.0 on 2026-07-30.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "CVE-2020-14061 does not affect jackson-databind 2.15.0-tuxcare.2. The fix blocking deserialization of Oracle JMS gadget classes (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) was already included in the upstream 2.15.0 release. These classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 200-204), preventing the deserialization attack described in the CVE. The fix commit (5c8642aeae9c756b438ab7637c90ef3c77966e6e) was authored by upstream maintainer Tatu Saloranta on 2020-04-24, over 6 years before TuxCare onboarded version 2.15.0 on 2026-07-30.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget (com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool). The target version 2.15.0 contains the upstream fix (commit 840eae2ca8 by Tatu Saloranta) that blacklists this dangerous class in SubTypeValidator.java:119. The fix was already present in the upstream 2.15.0 release when TuxCare onboarded it, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget (com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool). The target version 2.15.0 contains the upstream fix (commit 840eae2ca8 by Tatu Saloranta) that blacklists this dangerous class in SubTypeValidator.java:119. The fix was already present in the upstream 2.15.0 release when TuxCare onboarded it, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects Jackson-databind versions before 2.9.10.5 due to a deserialization gadget (org.jsecurity.realm.jndi.JndiRealmFactory) that can lead to arbitrary code execution. The target repository (jackson-databind 2.15.0-tuxcare.2) is NOT affected because the fix was already present in the upstream 2.15.0 release that TuxCare onboarded. The blacklist entry preventing deserialization of this gadget class exists at line 207 of SubTypeValidator.java, added by upstream commit f6d9c664f6 (authored by Tatu Saloranta, the upstream maintainer) which predates the TuxCare onboarding commit 34b5cb2df0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 affects Jackson-databind versions before 2.9.10.5 due to a deserialization gadget (org.jsecurity.realm.jndi.JndiRealmFactory) that can lead to arbitrary code execution. The target repository (jackson-databind 2.15.0-tuxcare.2) is NOT affected because the fix was already present in the upstream 2.15.0 release that TuxCare onboarded. The blacklist entry preventing deserialization of this gadget class exists at line 207 of SubTypeValidator.java, added by upstream commit f6d9c664f6 (authored by Tatu Saloranta, the upstream maintainer) which predates the TuxCare onboarding commit 34b5cb2df0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T14:22:45.297248+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a deserialization gadget class `br.com.anteros.dbcp.AnterosDBCPDataSource` that was not blocklisted. The target repository (version 2.15.0-tuxcare.2) is NOT vulnerable because the fix was already present in the upstream 2.15.0 release when TuxCare onboarded it. The SubTypeValidator.java file at line 147 contains the required blocklist entry that prevents deserialization of this gadget class. The fix was authored by the upstream maintainer Tatu Saloranta in commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7 on 2020-08-10, which is an ancestor of the first TuxCare commit (34b5cb2df0 - onboarding of version 2.15.0).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a deserialization gadget class `br.com.anteros.dbcp.AnterosDBCPDataSource` that was not blocklisted. The target repository (version 2.15.0-tuxcare.2) is NOT vulnerable because the fix was already present in the upstream 2.15.0 release when TuxCare onboarded it. The SubTypeValidator.java file at line 147 contains the required blocklist entry that prevents deserialization of this gadget class. The fix was authored by the upstream maintainer Tatu Saloranta in commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7 on 2020-08-10, which is an ancestor of the first TuxCare commit (34b5cb2df0 - onboarding of version 2.15.0).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T15:18:09.376674+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is not present in jackson-databind 2.15.0. The vulnerability involves deserialization of the dangerous gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration that enables JNDI injection leading to RCE. The upstream fix (commit 6cc9f1a1af3 by Tatu Saloranta, 2020-07-20) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.0 release that TuxCare onboarded (first TuxCare commit 34b5cb2df0e by ssaprikin@cloudlinux.com). The target version 2.15.0 is outside the affected version range (2.x before 2.6.7.5 and 2.7.x before 2.9.10.6). The dangerous class does not exist in the target repository, and the blacklist defense is active and reachable through BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 is not present in jackson-databind 2.15.0. The vulnerability involves deserialization of the dangerous gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration that enables JNDI injection leading to RCE. The upstream fix (commit 6cc9f1a1af3 by Tatu Saloranta, 2020-07-20) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.0 release that TuxCare onboarded (first TuxCare commit 34b5cb2df0e by ssaprikin@cloudlinux.com). The target version 2.15.0 is outside the affected version range (2.x before 2.6.7.5 and 2.7.x before 2.9.10.6). The dangerous class does not exist in the target repository, and the blacklist defense is active and reachable through BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.15.0 is not affected by CVE-2020-25649 (XXE vulnerability in DOMDeserializer). The fix was already present in the upstream release 2.15.0 that TuxCare onboarded. The DOMDeserializer class at lines 40-46 contains both required XXE protections: disallow-doctype-decl=true and load-external-dtd=false. The fix commit (612f971b78) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "The target jackson-databind version 2.15.0 is not affected by CVE-2020-25649 (XXE vulnerability in DOMDeserializer). The fix was already present in the upstream release 2.15.0 that TuxCare onboarded. The DOMDeserializer class at lines 40-46 contains both required XXE protections: disallow-doctype-decl=true and load-external-dtd=false. The fix commit (612f971b78) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T14:23:14.032161+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 is not present in jackson-databind version 2.15.0-tuxcare.2. The vulnerability relates to deserialization gadgets involving org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta from FasterXML) that adds these classes to Jackson's deserialization blocklist was already present in the upstream release 2.15.0 when TuxCare onboarded it. The target contains the complete fix at SubTypeValidator.java lines 217-218, blocking deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "CVE-2020-35490 is not present in jackson-databind version 2.15.0-tuxcare.2. The vulnerability relates to deserialization gadgets involving org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta from FasterXML) that adds these classes to Jackson's deserialization blocklist was already present in the upstream release 2.15.0 when TuxCare onboarded it. The target contains the complete fix at SubTypeValidator.java lines 217-218, blocking deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T12:52:53.936815+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 does not affect jackson-databind 2.15.0-tuxcare.2. The vulnerability (missing blacklist entry for org.apache.commons.dbcp2.datasources.SharedPoolDataSource) was fixed in upstream release 2.9.10.8 (December 2020). Version 2.15.0 (May 2023) already contains the fix from upstream - SharedPoolDataSource is blacklisted at SubTypeValidator.java:218, preventing deserialization-based JNDI injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "CVE-2020-35491 does not affect jackson-databind 2.15.0-tuxcare.2. The vulnerability (missing blacklist entry for org.apache.commons.dbcp2.datasources.SharedPoolDataSource) was fixed in upstream release 2.9.10.8 (December 2020). Version 2.15.0 (May 2023) already contains the fix from upstream - SharedPoolDataSource is blacklisted at SubTypeValidator.java:218, preventing deserialization-based JNDI injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T14:55:46.062749+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.0 already contains the upstream fix for CVE-2020-35728. The vulnerable class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool is blocked in SubTypeValidator.java line 240, preventing exploitation of this deserialization gadget. The fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84) was shipped in the upstream Jackson 2.15.0 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "Target version 2.15.0 already contains the upstream fix for CVE-2020-35728. The vulnerable class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool is blocked in SubTypeValidator.java line 240, preventing exploitation of this deserialization gadget. The fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84) was shipped in the upstream Jackson 2.15.0 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T13:26:57.486633+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.0-tuxcare.2 is NOT AFFECTED by CVE-2020-36179. The vulnerability was fixed in upstream commit 3ded28aece6 (Dec 31, 2020) by vendor maintainer Tatu Saloranta, which added all five DriverAdapterCPDS class variants to the SubTypeValidator blocklist. This fix was included in jackson-databind 2.12.1 and all subsequent releases. Since the target is version 2.15.0, the fix was already present in the upstream release that TuxCare onboarded (commit 34b5cb2df0e). The vulnerable deserialization gadget pattern is not present in the target codebase because the upstream vendor's fix was already applied before TuxCare's involvement with this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "The target jackson-databind 2.15.0-tuxcare.2 is NOT AFFECTED by CVE-2020-36179. The vulnerability was fixed in upstream commit 3ded28aece6 (Dec 31, 2020) by vendor maintainer Tatu Saloranta, which added all five DriverAdapterCPDS class variants to the SubTypeValidator blocklist. This fix was included in jackson-databind 2.12.1 and all subsequent releases. Since the target is version 2.15.0, the fix was already present in the upstream release that TuxCare onboarded (commit 34b5cb2df0e). The vulnerable deserialization gadget pattern is not present in the target codebase because the upstream vendor's fix was already applied before TuxCare's involvement with this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T15:42:44.997491+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability involves deserialization of malicious DriverAdapterCPDS gadget classes. The fix (commit 3ded28aece by upstream author Tatu Saloranta) adds five DriverAdapterCPDS class name variants to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. This fix was already included in the upstream 2.15.0 release that TuxCare onboarded (first TuxCare commit 34b5cb2df0). All five blocklist entries are present in the target at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java. When jackson attempts to deserialize JSON specifying these classes, validateSubType() checks the blocklist (line 269) and calls reportBadTypeDefinition() (line 302) with \"Illegal type to deserialize: prevented for security reasons\", blocking the attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "CVE-2020-36180 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability involves deserialization of malicious DriverAdapterCPDS gadget classes. The fix (commit 3ded28aece by upstream author Tatu Saloranta) adds five DriverAdapterCPDS class name variants to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. This fix was already included in the upstream 2.15.0 release that TuxCare onboarded (first TuxCare commit 34b5cb2df0). All five blocklist entries are present in the target at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java. When jackson attempts to deserialize JSON specifying these classes, validateSubType() checks the blocklist (line 269) and calls reportBadTypeDefinition() (line 302) with \"Illegal type to deserialize: prevented for security reasons\", blocking the attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T16:46:18.460067+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is not present in jackson-databind 2.15.0-tuxcare.2. The upstream vendor (FasterXML) fixed this vulnerability in commit 3ded28aece (dated 2020-12-31) by adding org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS to the SubTypeValidator blocklist. This fix was first included in upstream version 2.12.1 and is present in all subsequent versions including 2.15.0, which was released in April 2023. The blocklist entry is confirmed present at SubTypeValidator.java:228 and is actively enforced during deserialization via BeanDeserializerFactory._validateSubType(). The target version has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 is not present in jackson-databind 2.15.0-tuxcare.2. The upstream vendor (FasterXML) fixed this vulnerability in commit 3ded28aece (dated 2020-12-31) by adding org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS to the SubTypeValidator blocklist. This fix was first included in upstream version 2.12.1 and is present in all subsequent versions including 2.15.0, which was released in April 2023. The blocklist entry is confirmed present at SubTypeValidator.java:228 and is actively enforced during deserialization via BeanDeserializerFactory._validateSubType(). The target version has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T14:14:08.658611+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability relates to a deserialization gadget class (org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS) that could enable remote code execution through polymorphic deserialization. The fix, which adds this class to the deserialization blocklist in SubTypeValidator.java, was already present in the upstream 2.15.0 release (commit 3ded28aece by upstream maintainer Tatu Saloranta, dated Dec 31, 2020). The target repository inherited this fix when TuxCare onboarded version 2.15.0 on commit 34b5cb2df0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability relates to a deserialization gadget class (org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS) that could enable remote code execution through polymorphic deserialization. The fix, which adds this class to the deserialization blocklist in SubTypeValidator.java, was already present in the upstream 2.15.0 release (commit 3ded28aece by upstream maintainer Tatu Saloranta, dated Dec 31, 2020). The target repository inherited this fix when TuxCare onboarded version 2.15.0 on commit 34b5cb2df0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T15:22:31.962063+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability concerns deserialization of the gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, which allows remote code execution through JNDI injection. The upstream vendor (FasterXML) fixed this in commit 12e23c962ff by adding the class to a deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.0 release that TuxCare onboarded, making the target not affected. The CVE affects versions before 2.9.10.8 and 2.6.7.5; version 2.15.0 is well beyond that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "CVE-2020-36183 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability concerns deserialization of the gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, which allows remote code execution through JNDI injection. The upstream vendor (FasterXML) fixed this in commit 12e23c962ff by adding the class to a deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.0 release that TuxCare onboarded, making the target not affected. The CVE affects versions before 2.9.10.8 and 2.6.7.5; version 2.15.0 is well beyond that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T12:37:57.932432+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability involves deserialization gadgets that allow arbitrary code execution when Jackson processes JSON with polymorphic type information specifying dangerous classes (org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource). The fix, which adds these classes to the SubTypeValidator blacklist, was already present in the upstream release 2.15.0 (commit 567194c53a by Tatu Saloranta on 2020-12-26) before TuxCare onboarding. The dangerous classes are blacklisted at SubTypeValidator.java lines 235-236, and the validation is enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability involves deserialization gadgets that allow arbitrary code execution when Jackson processes JSON with polymorphic type information specifying dangerous classes (org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource). The fix, which adds these classes to the SubTypeValidator blacklist, was already present in the upstream release 2.15.0 (commit 567194c53a by Tatu Saloranta on 2020-12-26) before TuxCare onboarding. The dangerous classes are blacklisted at SubTypeValidator.java lines 235-236, and the validation is enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T16:09:26.959129+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability relates to unsafe deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The fix (commit 567194c53a by upstream author Tatu Saloranta on 2020-12-26) adds these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already included in the upstream Jackson 2.15.0 release that TuxCare onboarded, so the vulnerable pattern never existed in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 is not present in jackson-databind 2.15.0-tuxcare.2. The vulnerability relates to unsafe deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The fix (commit 567194c53a by upstream author Tatu Saloranta on 2020-12-26) adds these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already included in the upstream Jackson 2.15.0 release that TuxCare onboarded, so the vulnerable pattern never existed in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T14:38:50.686696+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix (adding these classes to the SubTypeValidator blocklist) was applied by upstream in commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 on Dec 26, 2020, and shipped with the upstream 2.15.0 release that TuxCare onboarded. The dangerous classes are blocked at lines 229-230 of SubTypeValidator.java, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "CVE-2020-36186 is NOT present in jackson-databind 2.15.0-tuxcare.2. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix (adding these classes to the SubTypeValidator blocklist) was applied by upstream in commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 on Dec 26, 2020, and shipped with the upstream 2.15.0 release that TuxCare onboarded. The dangerous classes are blocked at lines 229-230 of SubTypeValidator.java, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T14:50:17.320852+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.0-tuxcare.2 is NOT affected by CVE-2020-36187. The vulnerability involves deserialization of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) that enable remote code execution. The fix\u2014adding these classes to SubTypeValidator's deserialization blocklist\u2014was already present in the upstream 2.15.0 release before TuxCare onboarded it. The blocklist entries exist at SubTypeValidator.java lines 229-230 and are actively enforced during deserialization validation (line 269), triggering an error for blocked classes (lines 302-303). Fix commit 3e8fa3beea by upstream author Tatu Saloranta is an ancestor of the first TuxCare commit 34b5cb2df0, confirming this is an upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "The target jackson-databind 2.15.0-tuxcare.2 is NOT affected by CVE-2020-36187. The vulnerability involves deserialization of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) that enable remote code execution. The fix\u2014adding these classes to SubTypeValidator's deserialization blocklist\u2014was already present in the upstream 2.15.0 release before TuxCare onboarded it. The blocklist entries exist at SubTypeValidator.java lines 229-230 and are actively enforced during deserialization validation (line 269), triggering an error for blocked classes (lines 302-303). Fix commit 3e8fa3beea by upstream author Tatu Saloranta is an ancestor of the first TuxCare commit 34b5cb2df0, confirming this is an upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T15:56:28.365878+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188: Target version 2.15.0-tuxcare.2 is not affected. The vulnerability affects jackson-databind versions before 2.9.10.8, which allowed deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource gadget class leading to JNDI injection attacks. The fix was added to upstream in December 2020 (commit 33d96c13) and was already present in the upstream 2.15.0 release (April 2023) that TuxCare onboarded. The target includes the upstream blocklist entries that prevent deserialization of the malicious classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188: Target version 2.15.0-tuxcare.2 is not affected. The vulnerability affects jackson-databind versions before 2.9.10.8, which allowed deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource gadget class leading to JNDI injection attacks. The fix was added to upstream in December 2020 (commit 33d96c13) and was already present in the upstream 2.15.0 release (April 2023) that TuxCare onboarded. The target includes the upstream blocklist entries that prevent deserialization of the malicious classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T13:08:13.759745+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is not a vulnerability in jackson-databind 2.15.0-tuxcare.2. The fix (blacklist entries for com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) was already present in the upstream jackson-databind 2.15.0 release, which TuxCare onboarded without modification. The fix was authored by upstream maintainer Tatu Saloranta on 2020-12-26 in commit 33d96c13fe1, which predates the upstream 2.15.0 release by 2285 commits. TuxCare backported this CVE to older versions (2.7.x, 2.9.x) but not to 2.15.0 because the fix was already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 is not a vulnerability in jackson-databind 2.15.0-tuxcare.2. The fix (blacklist entries for com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) was already present in the upstream jackson-databind 2.15.0 release, which TuxCare onboarded without modification. The fix was authored by upstream maintainer Tatu Saloranta on 2020-12-26 in commit 33d96c13fe1, which predates the upstream 2.15.0 release by 2285 commits. TuxCare backported this CVE to older versions (2.7.x, 2.9.x) but not to 2.15.0 because the fix was already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T14:18:05.506292+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 describes a stack overflow DoS via deeply nested JSON. The upstream vendor (FasterXML) fixed this in version 2.14+ by replacing the recursive UntypedObjectDeserializer.Vanilla implementation with a non-recursive UntypedObjectDeserializerNR that uses heap-based iteration instead of stack recursion. Target version 2.15.0 includes this upstream fix (commit 8238ab41d0, authored by tatu.saloranta@iki.fi), which was shipped in the upstream release before TuxCare onboarding (first TuxCare commit 34b5cb2df0). The vulnerable recursive code path is not used by default in 2.15.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "CVE-2020-36518 describes a stack overflow DoS via deeply nested JSON. The upstream vendor (FasterXML) fixed this in version 2.14+ by replacing the recursive UntypedObjectDeserializer.Vanilla implementation with a non-recursive UntypedObjectDeserializerNR that uses heap-based iteration instead of stack recursion. Target version 2.15.0 includes this upstream fix (commit 8238ab41d0, authored by tatu.saloranta@iki.fi), which was shipped in the upstream release before TuxCare onboarding (first TuxCare commit 34b5cb2df0). The vulnerable recursive code path is not used by default in 2.15.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T16:15:35.096684+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.15.0-tuxcare.2 is NOT AFFECTED by CVE-2020-8840. The vulnerability involves unsafe deserialization of org.apache.xbean.propertyeditor.JndiConverter that can lead to JNDI-based remote code execution. The fix for this CVE (blocking JndiConverter from deserialization) was already present in the upstream jackson-databind 2.15.0 release that TuxCare onboarded. The blacklist entry exists at SubTypeValidator.java:138 and is actively enforced during polymorphic type validation. This is an upstream fix authored by Tatu Saloranta (jackson-databind maintainer) in commit 9bb52c7122, which predates the first TuxCare commit 34b5cb2df0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "The target repository jackson-databind version 2.15.0-tuxcare.2 is NOT AFFECTED by CVE-2020-8840. The vulnerability involves unsafe deserialization of org.apache.xbean.propertyeditor.JndiConverter that can lead to JNDI-based remote code execution. The fix for this CVE (blocking JndiConverter from deserialization) was already present in the upstream jackson-databind 2.15.0 release that TuxCare onboarded. The blacklist entry exists at SubTypeValidator.java:138 and is actively enforced during polymorphic type validation. This is an upstream fix authored by Tatu Saloranta (jackson-databind maintainer) in commit 9bb52c7122, which predates the first TuxCare commit 34b5cb2df0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of the HikariConfig gadget class. The target version 2.15.0-tuxcare.2 is not affected because the upstream fix (adding org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to the deserialization blocklist) was already present in the upstream 2.15.0 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in February 2020 and included in all subsequent releases including 2.15.0 (released April 2023).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of the HikariConfig gadget class. The target version 2.15.0-tuxcare.2 is not affected because the upstream fix (adding org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to the deserialization blocklist) was already present in the upstream 2.15.0 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in February 2020 and included in all subsequent releases including 2.15.0 (released April 2023).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T15:46:24.540154+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.15.0-tuxcare.2) is not affected by CVE-2020-9547. The vulnerability was fixed in upstream commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb (Feb 29, 2020) by adding com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig to the blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.0 release when TuxCare onboarded it. The blocklist entry exists at line 144 of SubTypeValidator.java and is actively enforced during deserialization by BeanDeserializerFactory. The target version is much newer than the CVE-affected versions (before 2.9.10.4, 2.8.11.6, and 2.7.9.7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "The target repository (jackson-databind 2.15.0-tuxcare.2) is not affected by CVE-2020-9547. The vulnerability was fixed in upstream commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb (Feb 29, 2020) by adding com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig to the blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.0 release when TuxCare onboarded it. The blocklist entry exists at line 144 of SubTypeValidator.java and is actively enforced during deserialization by BeanDeserializerFactory. The target version is much newer than the CVE-affected versions (before 2.9.10.4, 2.8.11.6, and 2.7.9.7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T16:20:17.888209+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing blocklist entries for dangerous gadget classes including br.com.anteros.dbcp.AnterosDBCPConfig. The target version 2.15.0 already contains the upstream fix (commit 1e64db6a2f by Tatu Saloranta) that adds br.com.anteros.dbcp.AnterosDBCPConfig to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was shipped in the upstream release before TuxCare onboarded version 2.15.0 (first TuxCare commit 34b5cb2df0). The vulnerable code pattern has never been present in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing blocklist entries for dangerous gadget classes including br.com.anteros.dbcp.AnterosDBCPConfig. The target version 2.15.0 already contains the upstream fix (commit 1e64db6a2f by Tatu Saloranta) that adds br.com.anteros.dbcp.AnterosDBCPConfig to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was shipped in the upstream release before TuxCare onboarded version 2.15.0 (first TuxCare commit 34b5cb2df0). The vulnerable code pattern has never been present in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T15:17:47.351003+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 affects jackson-databind versions before 2.9.10.7 and 2.6.7.5. The target version 2.15.0-tuxcare.2 already contains the upstream fix that blocks deserialization of javax.swing.JTextPane. The fix was shipped in the upstream 2.15.0 release (commit 7dbf51bf by tatu.saloranta@iki.fi) before TuxCare onboarded this version, so the vulnerability pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 affects jackson-databind versions before 2.9.10.7 and 2.6.7.5. The target version 2.15.0-tuxcare.2 already contains the upstream fix that blocks deserialization of javax.swing.JTextPane. The fix was shipped in the upstream 2.15.0 release (commit 7dbf51bf by tatu.saloranta@iki.fi) before TuxCare onboarded this version, so the vulnerability pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 is NOT present in jackson-databind 2.15.0. The vulnerability involved unbounded memory allocation in NodeSerialization.readExternal() when processing malicious JDK-serialized data. The fix (commit 3ccde7d938 by upstream maintainer Tatu Saloranta) was already present in the upstream 2.15.0 release before TuxCare onboarded it (commit 34b5cb2df0). The target contains the LONGEST_EAGER_ALLOC defense constant and chunked reading logic that prevents the DoS attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "CVE-2021-46877 is NOT present in jackson-databind 2.15.0. The vulnerability involved unbounded memory allocation in NodeSerialization.readExternal() when processing malicious JDK-serialized data. The fix (commit 3ccde7d938 by upstream maintainer Tatu Saloranta) was already present in the upstream 2.15.0 release before TuxCare onboarded it (commit 34b5cb2df0). The target contains the LONGEST_EAGER_ALLOC defense constant and chunked reading logic that prevents the DoS attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T16:49:36.466974+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 affects jackson-databind versions 2.4.0-rc1 through 2.12.7.0 and 2.13.0 through 2.13.4.1, with fixes released in 2.12.7.1, 2.13.4.2, and 2.14.0. The target version 2.15.0 is newer than all fixed versions and shipped with the upstream fix already present. The fix prevents resource exhaustion from deeply nested wrapper arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled by rejecting nested arrays at the second level. Analysis confirms the complete fix is present in StdDeserializer (handleNestedArrayForSingle method and checks in all primitive deserializers) and BeanDeserializer. The fix was authored by upstream developers (Cesar Hernandez, Tatu Saloranta) and was already in the codebase when TuxCare onboarded version 2.15.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "CVE-2022-42003 affects jackson-databind versions 2.4.0-rc1 through 2.12.7.0 and 2.13.0 through 2.13.4.1, with fixes released in 2.12.7.1, 2.13.4.2, and 2.14.0. The target version 2.15.0 is newer than all fixed versions and shipped with the upstream fix already present. The fix prevents resource exhaustion from deeply nested wrapper arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled by rejecting nested arrays at the second level. Analysis confirms the complete fix is present in StdDeserializer (handleNestedArrayForSingle method and checks in all primitive deserializers) and BeanDeserializer. The fix was authored by upstream developers (Cesar Hernandez, Tatu Saloranta) and was already in the codebase when TuxCare onboarded version 2.15.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-06T18:07:00.029185+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 2.15.0 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-rgv9-q543-rqg4 (affected up to 2.13.4), NVD (affected up to 2.13.4), Snyk (affected up to 2.13.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 2.15.0 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-rgv9-q543-rqg4 (affected up to 2.13.4), NVD (affected up to 2.13.4), Snyk (affected up to 2.13.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-28T01:07:55.976356+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-02T20:23:00.112323+00:00", "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 (stack overflow in JsonNode.toString() for deeply nested JSON) is NOT present in jackson-databind 2.15.0-tuxcare.2. The upstream fix (commit a1fa4ae4ec by Tatu Saloranta, \"Fix #3447\") was already included in version 2.14.0 and therefore present in 2.15.0 when TuxCare onboarded it. The fix replaces recursive serialization with iterative serialization using an explicit IteratorStac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50193" }, "impact_statement": "not_affected \u2014 CVE-2026-50193 (stack overflow in JsonNode.toString() for deeply nested JSON) is NOT present in jackson-databind 2.15.0-tuxcare.2. The upstream fix (commit a1fa4ae4ec by Tatu Saloranta, \"Fix #3447\") was already included in version 2.14.0 and therefore present in 2.15.0 when TuxCare onboarded it. The fix replaces recursive serialization with iterative serialization using an explicit IteratorStac..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T03:25:45.372132+00:00", "status_notes": "Vulnerability CVE-2026-54516 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.15.0 is not affected by CVE-2026-54516. The vulnerability was introduced by commit 1fe6ee7a89 (issue #5398) in November 2025, which added conditional logic to POJOPropertiesCollector._renameProperties() that allowed properties with @JsonProperty on getter and @JsonIgnore on setter to be renamed while retaining inferred field mutators. This specific code pattern does not exist in 2.15....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54516" }, "impact_statement": "not_affected \u2014 Version 2.15.0 is not affected by CVE-2026-54516. The vulnerability was introduced by commit 1fe6ee7a89 (issue #5398) in November 2025, which added conditional logic to POJOPropertiesCollector._renameProperties() that allowed properties with @JsonProperty on getter and @JsonIgnore on setter to be renamed while retaining inferred field mutators. This specific code pattern does not exist in 2.15...." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-11-03T02:15:53.989558+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54518 affects jackson-databind's handling of @JsonView access restrictions on unwrapped creator parameters. Version 2.15.0 is NOT affected because the unwrapped creator parameter feature does not exist in this version. The codebase explicitly rejects the combination of @JsonUnwrapped with @JsonCreator parameters by throwing InvalidDefinitionException with message \"Cannot define Creator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 CVE-2026-54518 affects jackson-databind's handling of @JsonView access restrictions on unwrapped creator parameters. Version 2.15.0 is NOT affected because the unwrapped creator parameter feature does not exist in this version. The codebase explicitly rejects the combination of @JsonUnwrapped with @JsonCreator parameters by throwing InvalidDefinitionException with message \"Cannot define Creator..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59888" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-30T13:09:28.641700+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-30T13:09:28.641700+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.0-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-30T13:09:28.641700+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-30T13:09:28.641700+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.0-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.15.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0-tuxcare.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.15.0-tuxcare.1.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }