{ "@id": "urn:uuid:e2132b5a-d767-42b1-9e42-46e1af92bbb3", "role": "Document Creator", "author": "https://tuxcare.com", "version": 67, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:17:00.447062+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T13:06:00.441936+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.2-tuxcare.3 is not affected by CVE-2017-15095. The vulnerability (deserialization of dangerous classes leading to code execution) was fixed in the upstream Jackson releases 2.8.11 and 2.9.4 back in 2017. The fix introduced SubTypeValidator with a blacklist of dangerous classes that cannot be deserialized. Version 2.16.2 (released March 2024) already contains this fix from upstream, as it's 7 years beyond the initially fixed versions. The blacklist includes all CVE-2017-15095 classes: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, com.sun.rowset.JdbcRowSetImpl, and C3P0 DataSource classes. The fix was authored by Tatu Saloranta (upstream Jackson maintainer) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "The target jackson-databind 2.16.2-tuxcare.3 is not affected by CVE-2017-15095. The vulnerability (deserialization of dangerous classes leading to code execution) was fixed in the upstream Jackson releases 2.8.11 and 2.9.4 back in 2017. The fix introduced SubTypeValidator with a blacklist of dangerous classes that cannot be deserialized. Version 2.16.2 (released March 2024) already contains this fix from upstream, as it's 7 years beyond the initially fixed versions. The blacklist includes all CVE-2017-15095 classes: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, com.sun.rowset.JdbcRowSetImpl, and C3P0 DataSource classes. The fix was authored by Tatu Saloranta (upstream Jackson maintainer) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:41:15.361284+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.16.2-tuxcare.3 is NOT affected by CVE-2017-17485. The vulnerability involved an incomplete blacklist allowing deserialization of dangerous classes (Spring framework gadgets, JDK types, C3P0 DataSources) when those libraries were available on the classpath. The upstream vendor (FasterXML/jackson-databind) fixed this in December 2017 via issues #1737 and #1855 by adding blacklist entries and pattern-based checks to SubTypeValidator. Version 2.16.2 (released 2024) naturally includes these fixes as part of the upstream codebase. All required blacklist entries and pattern checks are present and actively enforced in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "Target version 2.16.2-tuxcare.3 is NOT affected by CVE-2017-17485. The vulnerability involved an incomplete blacklist allowing deserialization of dangerous classes (Spring framework gadgets, JDK types, C3P0 DataSources) when those libraries were available on the classpath. The upstream vendor (FasterXML/jackson-databind) fixed this in December 2017 via issues #1737 and #1855 by adding blacklist entries and pattern-based checks to SubTypeValidator. Version 2.16.2 (released 2024) naturally includes these fixes as part of the upstream codebase. All required blacklist entries and pattern checks are present and actively enforced in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:25:36.969179+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is not present in jackson-databind 2.16.2-tuxcare.3. The vulnerability allows code execution via unsafe deserialization of attacker-controlled class types (e.g., TemplatesImpl) when polymorphic typing is enabled. The upstream fix (commit 60d459cedc by Tatu Saloranta, April 2017) introduced SubTypeValidator with a blocklist of dangerous classes including com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl and org.apache.xalan.xsltc.trax.TemplatesImpl. This validation executes at BeanDeserializerFactory.createBeanDeserializer() line 141 before any bean deserializer is built, blocking exploitation. The fix shipped in upstream version 2.16.2, which TuxCare onboarded without modification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 is not present in jackson-databind 2.16.2-tuxcare.3. The vulnerability allows code execution via unsafe deserialization of attacker-controlled class types (e.g., TemplatesImpl) when polymorphic typing is enabled. The upstream fix (commit 60d459cedc by Tatu Saloranta, April 2017) introduced SubTypeValidator with a blocklist of dangerous classes including com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl and org.apache.xalan.xsltc.trax.TemplatesImpl. This validation executes at BeanDeserializerFactory.createBeanDeserializer() line 141 before any bean deserializer is built, blocking exploitation. The fix shipped in upstream version 2.16.2, which TuxCare onboarded without modification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T13:14:44.515379+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 does not affect jackson-databind 2.16.2. The vulnerability allowed data exfiltration via iBatis XPathParser gadget class when Jackson default typing was enabled. The fix (blacklisting org.apache.ibatis.parsing.XPathParser in SubTypeValidator) was introduced by upstream author Tatu Saloranta in commit 27b4defc270 and first released in version 2.7.9.4 (June 2018). Version 2.16.2, released in 2024, already contains this fix as part of the upstream release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 does not affect jackson-databind 2.16.2. The vulnerability allowed data exfiltration via iBatis XPathParser gadget class when Jackson default typing was enabled. The fix (blacklisting org.apache.ibatis.parsing.XPathParser in SubTypeValidator) was introduced by upstream author Tatu Saloranta in commit 27b4defc270 and first released in version 2.7.9.4 (June 2018). Version 2.16.2, released in 2024, already contains this fix as part of the upstream release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T17:16:29.149062+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, allowing remote code execution via JNDI/LDAP injection when Default Typing is enabled and Jodd-db or Oracle JDBC jars are in the classpath. The target version 2.16.2-tuxcare.3 already contains the upstream fix (commit 28badf7ef6 by Tatu Saloranta) which adds the vulnerable classes to a blacklist in SubTypeValidator.java. This fix was included in upstream release 2.16.2 before TuxCare onboarded it, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, allowing remote code execution via JNDI/LDAP injection when Default Typing is enabled and Jodd-db or Oracle JDBC jars are in the classpath. The target version 2.16.2-tuxcare.3 already contains the upstream fix (commit 28badf7ef6 by Tatu Saloranta) which adds the vulnerable classes to a blacklist in SubTypeValidator.java. This fix was included in upstream release 2.16.2 before TuxCare onboarded it, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:17:47.656427+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind versions before 2.7.9.4, 2.8.11.2, and 2.9.6. The vulnerability allows arbitrary code execution via LDAP-based deserialization gadgets when Default Typing is enabled and Oracle JDBC driver is in the classpath. Target version 2.16.2 already contains the upstream fix (commit 28badf7ef6) which blacklists Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. The fix was shipped in the upstream release before TuxCare onboarding, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 affects jackson-databind versions before 2.7.9.4, 2.8.11.2, and 2.9.6. The vulnerability allows arbitrary code execution via LDAP-based deserialization gadgets when Default Typing is enabled and Oracle JDBC driver is in the classpath. Target version 2.16.2 already contains the upstream fix (commit 28badf7ef6) which blacklists Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. The fix was shipped in the upstream release before TuxCare onboarding, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T13:43:26.013143+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.16.2-tuxcare.3) is NOT affected by CVE-2018-14718. The vulnerability required blocking org.slf4j.ext.EventData from polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e on Aug 16, 2018, and was already present in the upstream 2.16.2 release when TuxCare onboarded it (commit 9901620829 by amoniatovskiy@cloudlinux.com). The blocklist entry exists at SubTypeValidator.java line 75, and the validation mechanism is active in the normal deserialization path through BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "The target repository (jackson-databind 2.16.2-tuxcare.3) is NOT affected by CVE-2018-14718. The vulnerability required blocking org.slf4j.ext.EventData from polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e on Aug 16, 2018, and was already present in the upstream 2.16.2 release when TuxCare onboarded it (commit 9901620829 by amoniatovskiy@cloudlinux.com). The blocklist entry exists at SubTypeValidator.java line 75, and the validation mechanism is active in the normal deserialization path through BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:57:36.777269+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability involves polymorphic deserialization of dangerous blaze-ds classes (specifically flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor) that can lead to arbitrary code execution. The upstream fix (commit 87d29af25e) blocks this class in SubTypeValidator.java:76, and this fix was already present in the upstream 2.16.2 release that TuxCare onboarded. The blocklist validation is actively enforced during bean deserialization at BeanDeserializerFactory.java:141, preventing the dangerous class from being instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability involves polymorphic deserialization of dangerous blaze-ds classes (specifically flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor) that can lead to arbitrary code execution. The upstream fix (commit 87d29af25e) blocks this class in SubTypeValidator.java:76, and this fix was already present in the upstream 2.16.2 release that TuxCare onboarded. The blocklist validation is actively enforced during bean deserialization at BeanDeserializerFactory.java:141, preventing the dangerous class from being instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:05:15.819129+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 affects jackson-databind versions before 2.9.7 due to missing blocklist entries for four dangerous classes that enable XXE attacks via polymorphic deserialization. The target (jackson-databind 2.16.2-tuxcare.3) contains the upstream fix that adds all four classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) to the deserialization blocklist in SubTypeValidator.java. The fix was authored by Tatu Saloranta (upstream maintainer) on 2018-08-16 and was already present in the upstream 2.16.2 release before TuxCare onboarding. The vulnerable pattern (absence of blocklist entries) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 affects jackson-databind versions before 2.9.7 due to missing blocklist entries for four dangerous classes that enable XXE attacks via polymorphic deserialization. The target (jackson-databind 2.16.2-tuxcare.3) contains the upstream fix that adds all four classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) to the deserialization blocklist in SubTypeValidator.java. The fix was authored by Tatu Saloranta (upstream maintainer) on 2018-08-16 and was already present in the upstream 2.16.2 release before TuxCare onboarding. The vulnerable pattern (absence of blocklist entries) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:33:25.079742+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.16.2-tuxcare.3 is NOT AFFECTED by CVE-2018-14721. The vulnerability was fixed in upstream Jackson 2.9.7 (released August 2018) by adding four dangerous classes to a deserialization blocklist, including org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. Version 2.16.2 (released February 2024) is significantly newer and already contains this upstream fix. The blocklist entries are present in SubTypeValidator.java lines 75-78 and are actively enforced during polymorphic deserialization via the validateSubType() method. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the original upstream release before TuxCare onboarded version 2.16.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "Target version 2.16.2-tuxcare.3 is NOT AFFECTED by CVE-2018-14721. The vulnerability was fixed in upstream Jackson 2.9.7 (released August 2018) by adding four dangerous classes to a deserialization blocklist, including org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. Version 2.16.2 (released February 2024) is significantly newer and already contains this upstream fix. The blocklist entries are present in SubTypeValidator.java lines 75-78 and are actively enforced during polymorphic deserialization via the validateSubType() method. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the original upstream release before TuxCare onboarded version 2.16.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T12:41:38.446812+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.16.2-tuxcare.3 is not affected by CVE-2018-19360. The vulnerability involves polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo. The fix (adding this class to the SubTypeValidator denylist) was implemented by upstream maintainer Tatu Saloranta in November 2018 and was already present in the upstream 2.16.2 release that TuxCare onboarded. The defense exists at SubTypeValidator.java line 85, preventing instantiation of the dangerous class during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "The target jackson-databind version 2.16.2-tuxcare.3 is not affected by CVE-2018-19360. The vulnerability involves polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo. The fix (adding this class to the SubTypeValidator denylist) was implemented by upstream maintainer Tatu Saloranta in November 2018 and was already present in the upstream 2.16.2 release that TuxCare onboarded. The defense exists at SubTypeValidator.java line 85, preventing instantiation of the dangerous class during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:54:53.626272+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.2-tuxcare.3 is NOT AFFECTED by CVE-2018-19361. The vulnerability allowed polymorphic deserialization of dangerous openjpa classes leading to arbitrary code execution. The fix was applied by upstream maintainer Tatu Saloranta in commit 72cd4025a2 (November 2018), which added org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the SubTypeValidator blocklist. This fix shipped in upstream version 2.10.0 and was already present in version 2.16.2 when TuxCare onboarded it. The vulnerable code pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "The target jackson-databind 2.16.2-tuxcare.3 is NOT AFFECTED by CVE-2018-19361. The vulnerability allowed polymorphic deserialization of dangerous openjpa classes leading to arbitrary code execution. The fix was applied by upstream maintainer Tatu Saloranta in commit 72cd4025a2 (November 2018), which added org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the SubTypeValidator blocklist. This fix shipped in upstream version 2.10.0 and was already present in version 2.16.2 when TuxCare onboarded it. The vulnerable code pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:24:04.222754+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.16.2-tuxcare.3 is NOT affected by CVE-2018-19362. The vulnerability concerns polymorphic deserialization of dangerous gadget classes (org.jboss.util.propertyeditor.DocumentEditor, org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime, org.apache.axis2.transport.jms.JMSOutTransportInfo). All four classes are present in the blocklist in SubTypeValidator.java (lines 81-85), preventing their deserialization. The fix was applied by upstream commit 72cd4025a229fb28ec133235003dd4616f70afaa authored by tatu.saloranta@iki.fi and was already included in the upstream release 2.16.2 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "The target repository jackson-databind version 2.16.2-tuxcare.3 is NOT affected by CVE-2018-19362. The vulnerability concerns polymorphic deserialization of dangerous gadget classes (org.jboss.util.propertyeditor.DocumentEditor, org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime, org.apache.axis2.transport.jms.JMSOutTransportInfo). All four classes are present in the blocklist in SubTypeValidator.java (lines 81-85), preventing their deserialization. The fix was applied by upstream commit 72cd4025a229fb28ec133235003dd4616f70afaa authored by tatu.saloranta@iki.fi and was already included in the upstream release 2.16.2 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability involves two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass Jackson's polymorphic deserialization blacklist. The target already contains the fix: both gadget classes are blacklisted in SubTypeValidator.java lines 62-63, added by upstream commit 038b471e2ef (Tatu Saloranta, Jan 2018). This fix shipped in upstream release 2.16.2, which TuxCare onboarded. The blacklist check is enforced in BeanDeserializerFactory during all bean deserialization and cannot be bypassed. Target version 2.16.2 is significantly newer than the CVE's affected range (through 2.8.11 and 2.9.x through 2.9.3).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability involves two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass Jackson's polymorphic deserialization blacklist. The target already contains the fix: both gadget classes are blacklisted in SubTypeValidator.java lines 62-63, added by upstream commit 038b471e2ef (Tatu Saloranta, Jan 2018). This fix shipped in upstream release 2.16.2, which TuxCare onboarded. The blacklist check is enforced in BeanDeserializerFactory during all bean deserialization and cannot be bypassed. Target version 2.16.2 is significantly newer than the CVE's affected range (through 2.8.11 and 2.9.x through 2.9.3).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T13:36:59.528750+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.16.2. The fix for this vulnerability (blocking c3p0 DataSource classes from deserialization) was already included in the upstream release 2.16.2. The defense is present in SubTypeValidator.java which rejects any class whose fully-qualified name starts with \"com.mchange.v2.c3p0.\" and ends with \"DataSource\", preventing the exploit chain from reaching code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.16.2. The fix for this vulnerability (blocking c3p0 DataSource classes from deserialization) was already included in the upstream release 2.16.2. The defense is present in SubTypeValidator.java which rejects any class whose fully-qualified name starts with \"com.mchange.v2.c3p0.\" and ends with \"DataSource\", preventing the exploit chain from reaching code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:29:44.182918+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 does not affect jackson-databind 2.16.2. The vulnerability involved missing validation of the com.mysql.cj.jdbc.admin.MiniAdmin class in polymorphic deserialization, allowing arbitrary file reads when Default Typing is enabled. The fix (adding MiniAdmin to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was introduced by upstream author Tatu Saloranta in commit dda513bd725 and shipped in jackson-databind 2.9.9 (May 2019). Since version 2.16.2 (released 2024) is significantly newer than 2.9.9, the fix was already present in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 does not affect jackson-databind 2.16.2. The vulnerability involved missing validation of the com.mysql.cj.jdbc.admin.MiniAdmin class in polymorphic deserialization, allowing arbitrary file reads when Default Typing is enabled. The fix (adding MiniAdmin to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was introduced by upstream author Tatu Saloranta in commit dda513bd725 and shipped in jackson-databind 2.9.9 (May 2019). Since version 2.16.2 (released 2024) is significantly newer than 2.9.9, the fix was already present in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-01T18:25:33.996101+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 (logback-core polymorphic deserialization RCE) is NOT present in jackson-databind 2.16.2-tuxcare.3. The fix (adding \"ch.qos.logback.core.db.DriverManagerConnectionSource\" to SubTypeValidator blocklist) was already present in upstream release 2.16.2, which TuxCare onboarded. The vulnerable pattern does not exist in this version\u2014the dangerous class is blocked from deserialization a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 (logback-core polymorphic deserialization RCE) is NOT present in jackson-databind 2.16.2-tuxcare.3. The fix (adding \"ch.qos.logback.core.db.DriverManagerConnectionSource\" to SubTypeValidator blocklist) was already present in upstream release 2.16.2, which TuxCare onboarded. The vulnerable pattern does not exist in this version\u2014the dangerous class is blocked from deserialization a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-02T07:07:50.518995+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is not present in jackson-databind 2.16.2-tuxcare.3. The vulnerability, which allowed arbitrary file reading via JDOM XSLTransformer deserialization when Default Typing was enabled, was fixed in upstream version 2.9.9.1 by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blacklist in SubTypeValidator.java. The target version 2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 is not present in jackson-databind 2.16.2-tuxcare.3. The vulnerability, which allowed arbitrary file reading via JDOM XSLTransformer deserialization when Default Typing was enabled, was fixed in upstream version 2.9.9.1 by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blacklist in SubTypeValidator.java. The target version 2..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T12:02:52.397356+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.16.2-tuxcare.3. The dangerous class \"net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup\" is already in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (line 98 of SubTypeValidator.java). The fix was authored by upstream maintainer Tatu Saloranta in July 2019 (commit ad418eeb97) and was already present when TuxCare onboarded version 2.16.2 in September 2026. This is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.16.2-tuxcare.3. The dangerous class \"net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup\" is already in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (line 98 of SubTypeValidator.java). The fix was authored by upstream maintainer Tatu Saloranta in July 2019 (commit ad418eeb97) and was already present when TuxCare onboarded version 2.16.2 in September 2026. This is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T13:28:43.500801+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.7.9.6, 2.8.11.4, 2.9.9.2, and 2.6.7.3. The vulnerability allows arbitrary code execution via polymorphic deserialization of ch.qos.logback.core.db.JNDIConnectionSource when Default Typing is enabled. The target version 2.16.2-tuxcare.3 is NOT vulnerable because the upstream fix (commit ad418eeb97 adding JNDIConnectionSource to the deserialization blacklist) was already included in jackson-databind 2.7.9.6 and 2.8.11.4 releases from July 2019, well before version 2.16.2 (January 2024). The fix is present at SubTypeValidator.java:102 and actively enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.7.9.6, 2.8.11.4, 2.9.9.2, and 2.6.7.3. The vulnerability allows arbitrary code execution via polymorphic deserialization of ch.qos.logback.core.db.JNDIConnectionSource when Default Typing is enabled. The target version 2.16.2-tuxcare.3 is NOT vulnerable because the upstream fix (commit ad418eeb97 adding JNDIConnectionSource to the deserialization blacklist) was already included in jackson-databind 2.7.9.6 and 2.8.11.4 releases from July 2019, well before version 2.16.2 (January 2024). The fix is present at SubTypeValidator.java:102 and actively enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:44:24.708688+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to missing blocklist entries for com.zaxxer.hikari.HikariConfig and HikariDataSource, enabling polymorphic deserialization attacks. The target version 2.16.2-tuxcare.3 is NOT affected because the upstream fix was already present in the 2.16.2 release that TuxCare onboarded. Both required blocklist entries exist in SubTypeValidator.java (lines 105-107) and are enforced by the validateSubType() method, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to missing blocklist entries for com.zaxxer.hikari.HikariConfig and HikariDataSource, enabling polymorphic deserialization attacks. The target version 2.16.2-tuxcare.3 is NOT affected because the upstream fix was already present in the 2.16.2 release that TuxCare onboarded. Both required blocklist entries exist in SubTypeValidator.java (lines 105-107) and are enforced by the validateSubType() method, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:53:08.340092+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.16.2-tuxcare.3 is not affected by CVE-2019-14892. The vulnerability, which allowed polymorphic deserialization of malicious objects using commons-configuration JNDI classes to execute arbitrary code, was fixed in upstream version 2.9.10 (released September 2019). The fix added org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blacklist in SubTypeValidator. This upstream fix was already present in the jackson-databind 2.16.2 release that TuxCare onboarded, predating all TuxCare modifications to this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "The target jackson-databind version 2.16.2-tuxcare.3 is not affected by CVE-2019-14892. The vulnerability, which allowed polymorphic deserialization of malicious objects using commons-configuration JNDI classes to execute arbitrary code, was fixed in upstream version 2.9.10 (released September 2019). The fix added org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blacklist in SubTypeValidator. This upstream fix was already present in the jackson-databind 2.16.2 release that TuxCare onboarded, predating all TuxCare modifications to this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.16.2-tuxcare.3 is NOT affected by CVE-2019-14893. The vulnerability's fix (blocking org.apache.xalan.lib.sql.JNDIConnectionPool from deserialization) was already present in the upstream release 2.16.2 that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in commit 998efd70828 (2019-09-19), which is an ancestor of the TuxCare onboarding commit. The vulnerable pattern (unrestricted deserialization of the xalan JNDI gadget class) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "The target jackson-databind version 2.16.2-tuxcare.3 is NOT affected by CVE-2019-14893. The vulnerability's fix (blocking org.apache.xalan.lib.sql.JNDIConnectionPool from deserialization) was already present in the upstream release 2.16.2 that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in commit 998efd70828 (2019-09-19), which is an ancestor of the TuxCare onboarding commit. The vulnerable pattern (unrestricted deserialization of the xalan JNDI gadget class) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T17:02:28.386699+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target version 2.16.2 already contains the upstream fix (commit 73c1c2cc76) that adds \"com.zaxxer.hikari.HikariDataSource\" to the deserialization blacklist in SubTypeValidator.java (line 107). This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.16.2 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target version 2.16.2 already contains the upstream fix (commit 73c1c2cc76) that adds \"com.zaxxer.hikari.HikariDataSource\" to the deserialization blacklist in SubTypeValidator.java (line 107). This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.16.2 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:02:16.356690+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is NOT affecting jackson-databind 2.16.2-tuxcare.3. The vulnerability involves polymorphic deserialization of dangerous commons-dbcp classes (PerUserPoolDataSource, SharedPoolDataSource) that can enable RCE. The upstream vendor (FasterXML) fixed this in 2019 by adding these classes to the SubTypeValidator blocklist. This fix was already present in jackson-databind 2.16.2 when TuxCare onboarded it in commit 9901620829. The blocklist entries exist at SubTypeValidator.java lines 124-125 and are unconditionally enforced during bean deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 is NOT affecting jackson-databind 2.16.2-tuxcare.3. The vulnerability involves polymorphic deserialization of dangerous commons-dbcp classes (PerUserPoolDataSource, SharedPoolDataSource) that can enable RCE. The upstream vendor (FasterXML) fixed this in 2019 by adding these classes to the SubTypeValidator blocklist. This fix was already present in jackson-databind 2.16.2 when TuxCare onboarded it in commit 9901620829. The blocklist entries exist at SubTypeValidator.java lines 124-125 and are unconditionally enforced during bean deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T17:13:05.282153+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 (P6DataSource polymorphic deserialization gadget) is NOT present in jackson-databind 2.16.2-tuxcare.3. The fix that blocks deserialization of com.p6spy.engine.spy.P6DataSource and related dangerous classes was already present in the upstream release 2.16.2 that TuxCare onboarded. The blacklist entry exists in SubTypeValidator.java:127 and is enforced unconditionally during bean deserialization, with no bypass possible even when LaissezFaireSubTypeValidator is used.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 (P6DataSource polymorphic deserialization gadget) is NOT present in jackson-databind 2.16.2-tuxcare.3. The fix that blocks deserialization of com.p6spy.engine.spy.P6DataSource and related dangerous classes was already present in the upstream release 2.16.2 that TuxCare onboarded. The blacklist entry exists in SubTypeValidator.java:127 and is enforced unconditionally during bean deserialization, with no bypass possible even when LaissezFaireSubTypeValidator is used.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:27:13.005239+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to a polymorphic typing vulnerability related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.16.2-tuxcare.3) is NOT AFFECTED because the fix was already included in the upstream release 2.16.2. The vulnerable code pattern (missing blocklist entry) is not present. The fix at SubTypeValidator.java:99 adds the dangerous class to the blocklist, preventing deserialization attacks. This fix was authored by upstream vendor Tatu Saloranta (tatu.saloranta@iki.fi) in commit 191a4cdf87, which predates the TuxCare onboarding of version 2.16.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to a polymorphic typing vulnerability related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.16.2-tuxcare.3) is NOT AFFECTED because the fix was already included in the upstream release 2.16.2. The vulnerable code pattern (missing blocklist entry) is not present. The fix at SubTypeValidator.java:99 adds the dangerous class to the blocklist, preventing deserialization attacks. This fix was authored by upstream vendor Tatu Saloranta (tatu.saloranta@iki.fi) in commit 191a4cdf87, which predates the TuxCare onboarding of version 2.16.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:46:07.417160+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is not affecting jackson-databind 2.16.2. The fix was applied in upstream commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 on October 12, 2019 by upstream maintainer Tatu Saloranta, and was included in the upstream 2.16.2 release (March 9, 2024) before TuxCare onboarded it. The vulnerable log4j-extras classes (org.apache.log4j.receivers.db.JNDIConnectionSource and DriverManagerConnectionSource) are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java at lines 130-131, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is not affecting jackson-databind 2.16.2. The fix was applied in upstream commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 on October 12, 2019 by upstream maintainer Tatu Saloranta, and was included in the upstream 2.16.2 release (March 9, 2024) before TuxCare onboarded it. The vulnerable log4j-extras classes (org.apache.log4j.receivers.db.JNDIConnectionSource and DriverManagerConnectionSource) are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java at lines 130-131, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:05:53.304095+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability affects versions before 2.9.10.2 due to missing blocklist entries for two net.sf.ehcache JNDI selector classes that enable deserialization gadget chain attacks. The target version 2.16.2 already contains the upstream fix (blocklist entries at SubTypeValidator.java:133-135) that was introduced by FasterXML in November 2019. This fix shipped with the upstream 2.16.2 release and was present when TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability affects versions before 2.9.10.2 due to missing blocklist entries for two net.sf.ehcache JNDI selector classes that enable deserialization gadget chain attacks. The target version 2.16.2 already contains the upstream fix (blocklist entries at SubTypeValidator.java:133-135) that was introduced by FasterXML in November 2019. This fix shipped with the upstream 2.16.2 release and was present when TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:59:33.966848+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.16.2-tuxcare.3 is NOT AFFECTED by CVE-2020-10650. The vulnerability concerns unsafe deserialization of ignite-jta classes that could lead to arbitrary code execution via JNDI exploitation. The upstream fix (commit a424c038ba by Tatu Saloranta) added three class names to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.16.2 release before TuxCare onboarded it. The blocklist entries are confirmed present at lines 157-160 of SubTypeValidator.java in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "The target repository jackson-databind version 2.16.2-tuxcare.3 is NOT AFFECTED by CVE-2020-10650. The vulnerability concerns unsafe deserialization of ignite-jta classes that could lead to arbitrary code execution via JNDI exploitation. The upstream fix (commit a424c038ba by Tatu Saloranta) added three class names to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.16.2 release before TuxCare onboarded it. The blocklist entries are confirmed present at lines 157-160 of SubTypeValidator.java in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.16.2-tuxcare.3) is NOT affected by CVE-2020-10672. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of dangerous gadget classes from org.apache.aries.transaction.jms package. The fix (adding these classes to a deserialization blocklist in SubTypeValidator.java) was already present in the upstream jackson-databind 2.16.2 release that TuxCare onboarded. Both XaPooledConnectionFactory and RecoverablePooledConnectionFactory are blocked at lines 163-164 of SubTypeValidator.java, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "The target repository (jackson-databind 2.16.2-tuxcare.3) is NOT affected by CVE-2020-10672. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of dangerous gadget classes from org.apache.aries.transaction.jms package. The fix (adding these classes to a deserialization blocklist in SubTypeValidator.java) was already present in the upstream jackson-databind 2.16.2 release that TuxCare onboarded. Both XaPooledConnectionFactory and RecoverablePooledConnectionFactory are blocked at lines 163-164 of SubTypeValidator.java, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:24:15.830231+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 concerns unsafe deserialization of com.caucho.config.types.ResourceRef gadget class in jackson-databind. The fix blocks deserialization by adding this class to SubTypeValidator's blocklist. Analysis confirms the fix is present in the target (jackson-databind 2.16.2-tuxcare.3) at SubTypeValidator.java:167. The fix was authored by upstream maintainer tatu.saloranta@iki.fi in commit 1645efbd39 and was already present in the upstream jackson-databind 2.16.2 release when TuxCare onboarded it (first TuxCare commit 9901620829). Verdict: not_affected because the upstream vendor's fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 concerns unsafe deserialization of com.caucho.config.types.ResourceRef gadget class in jackson-databind. The fix blocks deserialization by adding this class to SubTypeValidator's blocklist. Analysis confirms the fix is present in the target (jackson-databind 2.16.2-tuxcare.3) at SubTypeValidator.java:167. The fix was authored by upstream maintainer tatu.saloranta@iki.fi in commit 1645efbd39 and was already present in the upstream jackson-databind 2.16.2 release when TuxCare onboarded it (first TuxCare commit 9901620829). Verdict: not_affected because the upstream vendor's fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.16.2-tuxcare.3) contains the upstream fix that was added in commit 05d7e0e13f by upstream maintainer Tatu Saloranta and shipped in version 2.9.10.4. The gadget class is blocked in SubTypeValidator.java at line 171, and the blocklist check is active in the deserialization path (BeanDeserializerFactory.java:141\u21921032). The fix was already present in upstream version 2.16.2 when TuxCare onboarded it (first TuxCare commit: 9901620829).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.16.2-tuxcare.3) contains the upstream fix that was added in commit 05d7e0e13f by upstream maintainer Tatu Saloranta and shipped in version 2.9.10.4. The gadget class is blocked in SubTypeValidator.java at line 171, and the blocklist check is active in the deserialization path (BeanDeserializerFactory.java:141\u21921032). The fix was already present in upstream version 2.16.2 when TuxCare onboarded it (first TuxCare commit: 9901620829).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.2-tuxcare.3 is not affected by CVE-2020-10969. The vulnerability involves deserialization gadgets using javax.swing.JEditorPane to achieve unintended execution of operations that modify system state. The upstream vendor (FasterXML) fixed this in commit 4d038c9de0a (March 3, 2020) by adding javax.swing.JEditorPane to the SubTypeValidator deserialization blocklist. This fix was already present in the upstream 2.16.2 release that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport. The blocklist is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "The target jackson-databind 2.16.2-tuxcare.3 is not affected by CVE-2020-10969. The vulnerability involves deserialization gadgets using javax.swing.JEditorPane to achieve unintended execution of operations that modify system state. The upstream vendor (FasterXML) fixed this in commit 4d038c9de0a (March 3, 2020) by adding javax.swing.JEditorPane to the SubTypeValidator deserialization blocklist. This fix was already present in the upstream 2.16.2 release that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport. The blocklist is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 affects jackson-databind versions before 2.9.10.4. The target version 2.16.2-tuxcare.3 is not vulnerable because the upstream fix was already included in the 2.16.2 release. The fix adds org.apache.activemq.* classes to the deserialization blacklist in SubTypeValidator.java (lines 173-183), preventing instantiation of these gadget classes during JSON deserialization with polymorphic typing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 affects jackson-databind versions before 2.9.10.4. The target version 2.16.2-tuxcare.3 is not vulnerable because the upstream fix was already included in the 2.16.2 release. The fix adds org.apache.activemq.* classes to the deserialization blacklist in SubTypeValidator.java (lines 173-183), preventing instantiation of these gadget classes during JSON deserialization with polymorphic typing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability concerns a deserialization gadget (org.apache.commons.proxy.provider.remoting.RmiProvider) that allows remote code execution when Jackson's polymorphic typing is enabled. The upstream fix (commit 05d7e0e13f by Tatu Saloranta) added this class to the SubTypeValidator blocklist in version 2.9.10.4. The target version 2.16.2 already includes this fix, which was shipped in the upstream release before TuxCare onboarded it. The blocklist entry is confirmed present at SubTypeValidator.java:186.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability concerns a deserialization gadget (org.apache.commons.proxy.provider.remoting.RmiProvider) that allows remote code execution when Jackson's polymorphic typing is enabled. The upstream fix (commit 05d7e0e13f by Tatu Saloranta) added this class to the SubTypeValidator blocklist in version 2.9.10.4. The target version 2.16.2 already includes this fix, which was shipped in the upstream release before TuxCare onboarded it. The blocklist entry is confirmed present at SubTypeValidator.java:186.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.16.2-tuxcare.3 is not affected by CVE-2020-11113. The vulnerability involves deserialization of the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class, which the upstream fix blocks by adding it to SubTypeValidator's blocklist. This fix was already present in the upstream jackson-databind 2.16.2 release (committed upstream on 2020-03-28, included since version 2.10.4). When TuxCare onboarded version 2.16.2 on 2026-09-17, the fix was already part of the upstream codebase. The vulnerable pattern was never present in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "The target jackson-databind version 2.16.2-tuxcare.3 is not affected by CVE-2020-11113. The vulnerability involves deserialization of the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class, which the upstream fix blocks by adding it to SubTypeValidator's blocklist. This fix was already present in the upstream jackson-databind 2.16.2 release (committed upstream on 2020-03-28, included since version 2.10.4). When TuxCare onboarded version 2.16.2 on 2026-09-17, the fix was already part of the upstream codebase. The vulnerable pattern was never present in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository version 2.16.2-tuxcare.3 is NOT affected by CVE-2020-11619. The vulnerability involves jackson-databind allowing deserialization of dangerous Spring gadget classes (MethodLocatingFactoryBean, BeanReferenceFactoryBean) that can lead to code execution. However, the upstream fix that blacklists these classes was already present in upstream version 2.16.2 before TuxCare onboarded it. The fix commit 113e89fb08 by Tatu Saloranta (upstream maintainer) added these classes to SubTypeValidator's blacklist on April 6, 2020, and this commit is an ancestor of TuxCare's onboarding commit from 2024. The CVE affects \"before 2.9.10.4\" while this is version 2.16.2 (released years later with the fix already included).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "The target repository version 2.16.2-tuxcare.3 is NOT affected by CVE-2020-11619. The vulnerability involves jackson-databind allowing deserialization of dangerous Spring gadget classes (MethodLocatingFactoryBean, BeanReferenceFactoryBean) that can lead to code execution. However, the upstream fix that blacklists these classes was already present in upstream version 2.16.2 before TuxCare onboarded it. The fix commit 113e89fb08 by Tatu Saloranta (upstream maintainer) added these classes to SubTypeValidator's blacklist on April 6, 2020, and this commit is an ancestor of TuxCare's onboarding commit from 2024. The CVE affects \"before 2.9.10.4\" while this is version 2.16.2 (released years later with the fix already included).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 (jackson-databind commons-jelly deserialization gadget) is NOT AFFECTED in this target. The vulnerability involves arbitrary code execution through polymorphic deserialization of org.apache.commons.jelly.impl.Embedded. The fix blocking this gadget class was already present in the upstream jackson-databind 2.16.2 release that TuxCare onboarded. SubTypeValidator.java line 189 adds the malicious class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing its instantiation. The fix commit (77040d85e3) was authored by upstream FasterXML maintainer Tatu Saloranta and predates all TuxCare activity on this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 (jackson-databind commons-jelly deserialization gadget) is NOT AFFECTED in this target. The vulnerability involves arbitrary code execution through polymorphic deserialization of org.apache.commons.jelly.impl.Embedded. The fix blocking this gadget class was already present in the upstream jackson-databind 2.16.2 release that TuxCare onboarded. SubTypeValidator.java line 189 adds the malicious class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing its instantiation. The fix commit (77040d85e3) was authored by upstream FasterXML maintainer Tatu Saloranta and predates all TuxCare activity on this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not present in jackson-databind 2.16.2. The vulnerability, which affects versions before 2.9.10.5, involves deserialization gadgets related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool that could lead to arbitrary code execution. The fix was already included in the upstream 2.16.2 release that TuxCare onboarded. The blocklist entry preventing deserialization of the dangerous gadget classes is present in SubTypeValidator.java at lines 191-195.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 is not present in jackson-databind 2.16.2. The vulnerability, which affects versions before 2.9.10.5, involves deserialization gadgets related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool that could lead to arbitrary code execution. The fix was already included in the upstream 2.16.2 release that TuxCare onboarded. The blocklist entry preventing deserialization of the dangerous gadget classes is present in SubTypeValidator.java at lines 191-195.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.16.2 is not affected by CVE-2020-14061. The vulnerability concerns deserialization of five oracle.jms.AQjms* connection factory gadget classes. The upstream fix (commit 5c8642aeae) added these classes to SubTypeValidator's deny list, blocking their deserialization. This fix was already present in the upstream 2.16.2 release that TuxCare onboarded, predating any TuxCare modifications. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "Target jackson-databind 2.16.2 is not affected by CVE-2020-14061. The vulnerability concerns deserialization of five oracle.jms.AQjms* connection factory gadget classes. The upstream fix (commit 5c8642aeae) added these classes to SubTypeValidator's deny list, blocking their deserialization. This fix was already present in the upstream 2.16.2 release that TuxCare onboarded, predating any TuxCare modifications. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version 2.16.2-tuxcare.3 already contains the upstream fix that adds com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to the deserialization deny list (SubTypeValidator.java:119). This fix was present in the upstream 2.16.2 release when TuxCare onboarded it; no separate TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version 2.16.2-tuxcare.3 already contains the upstream fix that adds com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to the deserialization deny list (SubTypeValidator.java:119). This fix was present in the upstream 2.16.2 release when TuxCare onboarded it; no separate TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.2-tuxcare.3 is NOT affected by CVE-2020-14195. The vulnerability involves deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory to achieve arbitrary code execution. The upstream fix (commit f6d9c664f6 by Tatu Saloranta) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java was already present in the upstream release 2.16.2 that TuxCare onboarded. The blocklist entry at line 207 prevents deserialization of this class, blocking the attack vector. The validation is enforced by BeanDeserializerFactory during all bean deserialization operations and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "The target jackson-databind 2.16.2-tuxcare.3 is NOT affected by CVE-2020-14195. The vulnerability involves deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory to achieve arbitrary code execution. The upstream fix (commit f6d9c664f6 by Tatu Saloranta) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java was already present in the upstream release 2.16.2 that TuxCare onboarded. The blocklist entry at line 207 prevents deserialization of this class, blocking the attack vector. The validation is enforced by BeanDeserializerFactory during all bean deserialization operations and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:17:47.001354+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a deserialization gadget vulnerability involving br.com.anteros.dbcp.AnterosDBCPDataSource. The target repository (jackson-databind 2.16.2-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream 2.16.2 release that TuxCare onboarded. The blocklist entry for the vulnerable class exists at line 147 of SubTypeValidator.java, added by upstream commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7 (authored by tatu.saloranta@iki.fi on Aug 10, 2020). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a deserialization gadget vulnerability involving br.com.anteros.dbcp.AnterosDBCPDataSource. The target repository (jackson-databind 2.16.2-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream 2.16.2 release that TuxCare onboarded. The blocklist entry for the vulnerable class exists at line 147 of SubTypeValidator.java, added by upstream commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7 (authored by tatu.saloranta@iki.fi on Aug 10, 2020). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:12:30.450582+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is not present in jackson-databind 2.16.2. The vulnerable gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration is blocked in the SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 210. This protection was added by upstream commit 6cc9f1a1af3 (authored by Tatu Saloranta on 2020-07-20) and shipped in the upstream 2.16.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 is not present in jackson-databind 2.16.2. The vulnerable gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration is blocked in the SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 210. This protection was added by upstream commit 6cc9f1a1af3 (authored by Tatu Saloranta on 2020-07-20) and shipped in the upstream 2.16.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.16.2-tuxcare.3 is NOT affected by CVE-2020-25649 (XXE vulnerability in DOMDeserializer). The vulnerability was fixed in upstream version 2.11.0 (January 2020) via commit 612f971b78 authored by tatu.saloranta@iki.fi. The fix adds two XML parser security features: disallow-doctype-decl (blocks DOCTYPE declarations) and load-external-dtd=false (prevents external DTD loading). Since version 2.16.2 is 5+ major versions newer than 2.11.0, this fix was already present in the upstream release when TuxCare onboarded version 2.16.2. The vulnerable pattern (unprotected XML parsing allowing external entity expansion) does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "The target jackson-databind version 2.16.2-tuxcare.3 is NOT affected by CVE-2020-25649 (XXE vulnerability in DOMDeserializer). The vulnerability was fixed in upstream version 2.11.0 (January 2020) via commit 612f971b78 authored by tatu.saloranta@iki.fi. The fix adds two XML parser security features: disallow-doctype-decl (blocks DOCTYPE declarations) and load-external-dtd=false (prevents external DTD loading). Since version 2.16.2 is 5+ major versions newer than 2.11.0, this fix was already present in the upstream release when TuxCare onboarded version 2.16.2. The vulnerable pattern (unprotected XML parsing allowing external entity expansion) does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:19:24.952513+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 affects jackson-databind versions before 2.9.10.8. The target is at version 2.16.2, which already contains the upstream fix (commit 41b8bdb5cc) that adds org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java. The fix was shipped in the upstream release 2.16.2 (before TuxCare onboarding), making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "CVE-2020-35490 affects jackson-databind versions before 2.9.10.8. The target is at version 2.16.2, which already contains the upstream fix (commit 41b8bdb5cc) that adds org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java. The fix was shipped in the upstream release 2.16.2 (before TuxCare onboarding), making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T12:29:43.002778+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 due to a deserialization gadget in org.apache.commons.dbcp2.datasources.SharedPoolDataSource. The target version 2.16.2-tuxcare.3 already contains the upstream fix (commit 41b8bdb5cc from 2020-12-15) that blacklists this class in SubTypeValidator.java line 218. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.16.2 release, which TuxCare onboarded in commit 9901620829. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 due to a deserialization gadget in org.apache.commons.dbcp2.datasources.SharedPoolDataSource. The target version 2.16.2-tuxcare.3 already contains the upstream fix (commit 41b8bdb5cc from 2020-12-15) that blacklists this class in SubTypeValidator.java line 218. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.16.2 release, which TuxCare onboarded in commit 9901620829. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:53:26.160394+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.16.2-tuxcare.3 is NOT affected by CVE-2020-35728. The vulnerability involves a deserialization gadget (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) that allows arbitrary code execution via JNDI injection. The fix, which adds this class to the SubTypeValidator blocklist, was already present in the upstream jackson-databind 2.16.2 release when TuxCare onboarded it. The fix commit (1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84) was authored by upstream maintainer Tatu Saloranta on 2020-12-26, predating the TuxCare onboarding by approximately 6 years. The blocklist entry is confirmed present at line 240 of SubTypeValidator.java in the current HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "The target jackson-databind version 2.16.2-tuxcare.3 is NOT affected by CVE-2020-35728. The vulnerability involves a deserialization gadget (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) that allows arbitrary code execution via JNDI injection. The fix, which adds this class to the SubTypeValidator blocklist, was already present in the upstream jackson-databind 2.16.2 release when TuxCare onboarded it. The fix commit (1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84) was authored by upstream maintainer Tatu Saloranta on 2020-12-26, predating the TuxCare onboarding by approximately 6 years. The blocklist entry is confirmed present at line 240 of SubTypeValidator.java in the current HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T13:21:55.137725+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.16.2-tuxcare.3 is NOT affected by CVE-2020-36179. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already present in the upstream jackson-databind 2.16.2 release that TuxCare onboarded. All five DriverAdapterCPDS gadget class variants are present in the SubTypeValidator blocklist, preventing deserialization of these dangerous classes. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "Target version 2.16.2-tuxcare.3 is NOT affected by CVE-2020-36179. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already present in the upstream jackson-databind 2.16.2 release that TuxCare onboarded. All five DriverAdapterCPDS gadget class variants are present in the SubTypeValidator blocklist, preventing deserialization of these dangerous classes. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:33:21.899203+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target (jackson-databind 2.16.2-tuxcare.3) is not affected by CVE-2020-36180. The vulnerability involves deserialization of dangerous DriverAdapterCPDS gadget classes that can trigger JNDI injection attacks. The upstream fix (commit 3ded28aece, Dec 31 2020) added all five DriverAdapterCPDS class variants to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was already present in the upstream jackson-databind 2.16.2 release when TuxCare onboarded it in Sep 2026. The target contains all required blocklist entries and the validateSubType method properly enforces the deny list.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "The target (jackson-databind 2.16.2-tuxcare.3) is not affected by CVE-2020-36180. The vulnerability involves deserialization of dangerous DriverAdapterCPDS gadget classes that can trigger JNDI injection attacks. The upstream fix (commit 3ded28aece, Dec 31 2020) added all five DriverAdapterCPDS class variants to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was already present in the upstream jackson-databind 2.16.2 release when TuxCare onboarded it in Sep 2026. The target contains all required blocklist entries and the validateSubType method properly enforces the deny list.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:40:07.551074+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.2-tuxcare.3 is NOT AFFECTED by CVE-2020-36181. The vulnerability involves a deserialization gadget class (org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS) that was missing from jackson-databind's SubTypeValidator blocklist in versions before 2.9.10.8. The upstream fix (commit 3ded28aece, authored by Tatu Saloranta) added this class to the deny-list and was already present in the upstream 2.16.2 release that TuxCare onboarded. The vulnerable code pattern (missing blocklist entry) does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "The target jackson-databind 2.16.2-tuxcare.3 is NOT AFFECTED by CVE-2020-36181. The vulnerability involves a deserialization gadget class (org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS) that was missing from jackson-databind's SubTypeValidator blocklist in versions before 2.9.10.8. The upstream fix (commit 3ded28aece, authored by Tatu Saloranta) added this class to the deny-list and was already present in the upstream 2.16.2 release that TuxCare onboarded. The vulnerable code pattern (missing blocklist entry) does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:11:01.674474+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.2-tuxcare.3 is NOT affected by CVE-2020-36182. The vulnerability concerns deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS through polymorphic type handling. The fix (blacklisting this class in SubTypeValidator) was already present in the upstream jackson-databind 2.16.2 release, which is well above the vulnerable version range (before 2.9.10.8). The fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "The target jackson-databind 2.16.2-tuxcare.3 is NOT affected by CVE-2020-36182. The vulnerability concerns deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS through polymorphic type handling. The fix (blacklisting this class in SubTypeValidator) was already present in the upstream jackson-databind 2.16.2 release, which is well above the vulnerable version range (before 2.9.10.8). The fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:20:07.841451+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.2-tuxcare.3 is not affected by CVE-2020-36183. The fix (blocklist entry for org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) was already present in the upstream 2.16.2 release when TuxCare onboarded it. The vulnerability affects versions before 2.9.10.8, and the fix was committed upstream by Tatu Saloranta on December 31, 2020, years before the 2.16.2 release. The blocklist entry is present at line 243 of SubTypeValidator.java, preventing deserialization of this JNDI gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "The target jackson-databind 2.16.2-tuxcare.3 is not affected by CVE-2020-36183. The fix (blocklist entry for org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) was already present in the upstream 2.16.2 release when TuxCare onboarded it. The vulnerability affects versions before 2.9.10.8, and the fix was committed upstream by Tatu Saloranta on December 31, 2020, years before the 2.16.2 release. The blocklist entry is present at line 243 of SubTypeValidator.java, preventing deserialization of this JNDI gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T12:22:29.685630+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability involves deserialization gadget exploitation via org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. The upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) was already included in the 2.16.2 release before TuxCare onboarding. The fix adds PerUserPoolDataSource to the blacklist in SubTypeValidator.java (lines 235-236), which blocks deserialization of this dangerous class during bean deserializer creation. The validator is invoked at BeanDeserializerFactory.java line 141 in the standard deserialization path, providing effective protection against the CVE-2020-36184 gadget chain attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability involves deserialization gadget exploitation via org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. The upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) was already included in the 2.16.2 release before TuxCare onboarding. The fix adds PerUserPoolDataSource to the blacklist in SubTypeValidator.java (lines 235-236), which blocks deserialization of this dangerous class during bean deserializer creation. The validator is invoked at BeanDeserializerFactory.java line 141 in the standard deserialization path, providing effective protection against the CVE-2020-36184 gadget chain attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:03:43.787457+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability affects versions before 2.9.10.8. The fix (blocking deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource) is present in the target at SubTypeValidator.java lines 232-236. This fix was authored by upstream (Tatu Saloranta) in commit 567194c53ae91f0a14dc27239afb739b1c10448a and shipped with the upstream 2.16.2 release, predating all TuxCare commits on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability affects versions before 2.9.10.8. The fix (blocking deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource) is present in the target at SubTypeValidator.java lines 232-236. This fix was authored by upstream (Tatu Saloranta) in commit 567194c53ae91f0a14dc27239afb739b1c10448a and shipped with the upstream 2.16.2 release, predating all TuxCare commits on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:28:36.636935+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. The target (jackson-databind 2.16.2-tuxcare.3) is NOT AFFECTED because the upstream fix (commit 3e8fa3beea) was already present in the upstream release 2.16.2 that TuxCare onboarded. The vulnerable gadget classes are blocked in SubTypeValidator.java lines 226-230.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. The target (jackson-databind 2.16.2-tuxcare.3) is NOT AFFECTED because the upstream fix (commit 3e8fa3beea) was already present in the upstream release 2.16.2 that TuxCare onboarded. The vulnerable gadget classes are blocked in SubTypeValidator.java lines 226-230.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:42:56.737779+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.16.2-tuxcare.3 is NOT vulnerable to CVE-2020-36187. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource classes. The fix blocking these classes was already present in upstream release 2.16.2 (committed Dec 26, 2020 by upstream author Tatu Saloranta) before TuxCare onboarded this version. The vulnerable pattern is not present in the target - both dangerous classes are properly blocklisted in SubTypeValidator.java lines 229-230.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "The target repository jackson-databind version 2.16.2-tuxcare.3 is NOT vulnerable to CVE-2020-36187. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource classes. The fix blocking these classes was already present in upstream release 2.16.2 (committed Dec 26, 2020 by upstream author Tatu Saloranta) before TuxCare onboarded this version. The vulnerable pattern is not present in the target - both dangerous classes are properly blocklisted in SubTypeValidator.java lines 229-230.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:49:18.906233+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5 due to deserialization gadget classes in com.newrelic.agent.deps.ch.qos.logback.core.db package. The target version 2.16.2-tuxcare.3 already contains the upstream fix (commit 33d96c13) that adds these classes to the deserialization denylist. The fix was shipped in the upstream 2.16.2 release before TuxCare onboarded it, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5 due to deserialization gadget classes in com.newrelic.agent.deps.ch.qos.logback.core.db package. The target version 2.16.2-tuxcare.3 already contains the upstream fix (commit 33d96c13) that adds these classes to the deserialization denylist. The fix was shipped in the upstream 2.16.2 release before TuxCare onboarded it, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T12:58:17.463230+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability involves missing deserialization blocklist entries for com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource, which could enable deserialization gadget attacks. However, the fix was already included in the upstream FasterXML jackson-databind 2.16.2 release that TuxCare onboarded. The blocklist entries exist at SubTypeValidator.java lines 223-224, added by upstream commit 33d96c13fe1 (Tatu Saloranta, 2020-12-26). This commit predates TuxCare's onboarding of version 2.16.2, confirming the vulnerable pattern was never present in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability involves missing deserialization blocklist entries for com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource, which could enable deserialization gadget attacks. However, the fix was already included in the upstream FasterXML jackson-databind 2.16.2 release that TuxCare onboarded. The blocklist entries exist at SubTypeValidator.java lines 223-224, added by upstream commit 33d96c13fe1 (Tatu Saloranta, 2020-12-26). This commit predates TuxCare's onboarding of version 2.16.2, confirming the vulnerable pattern was never present in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:15:24.867676+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.2-tuxcare.3 is not affected by CVE-2020-36518 (stack overflow via deeply nested JSON). The upstream project fixed this vulnerability in version 2.14 by replacing the recursive UntypedObjectDeserializer.Vanilla implementation with a non-recursive implementation (UntypedObjectDeserializerNR). The target version 2.16.2 inherited this fix from the upstream release, eliminating the vulnerable recursive deserialization pattern. The fix (commit 8238ab41d0) was authored by upstream maintainer Tatu Saloranta and was already present when TuxCare onboarded version 2.16.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "The target jackson-databind 2.16.2-tuxcare.3 is not affected by CVE-2020-36518 (stack overflow via deeply nested JSON). The upstream project fixed this vulnerability in version 2.14 by replacing the recursive UntypedObjectDeserializer.Vanilla implementation with a non-recursive implementation (UntypedObjectDeserializerNR). The target version 2.16.2 inherited this fix from the upstream release, eliminating the vulnerable recursive deserialization pattern. The fix (commit 8238ab41d0) was authored by upstream maintainer Tatu Saloranta and was already present when TuxCare onboarded version 2.16.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:08:45.993587+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 affects jackson-databind versions lacking xbean-reflect/JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target repository (jackson-databind 2.16.2-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already present in the 2.16.2 release before TuxCare onboarded it. The blocklist entry preventing deserialization of JndiConverter is present at SubTypeValidator.java:138, and the validateSubType() method enforces this blocklist at lines 269-270, blocking the attack path from malicious JSON input to JNDI injection-based RCE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 affects jackson-databind versions lacking xbean-reflect/JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target repository (jackson-databind 2.16.2-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already present in the 2.16.2 release before TuxCare onboarded it. The blocklist entry preventing deserialization of JndiConverter is present at SubTypeValidator.java:138, and the validateSubType() method enforces this blocklist at lines 269-270, blocking the attack path from malicious JSON input to JNDI injection-based RCE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.16.2-tuxcare.3) is NOT affected by CVE-2020-9546. The vulnerability, which allows remote code execution via deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, has been mitigated by an upstream fix that was already present in the 2.16.2 release. The fix adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 141), preventing its deserialization. This upstream fix by Tatu Saloranta was included in the version TuxCare onboarded, making the vulnerable pattern absent from all commits in the target branch's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "The target repository (jackson-databind 2.16.2-tuxcare.3) is NOT affected by CVE-2020-9546. The vulnerability, which allows remote code execution via deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, has been mitigated by an upstream fix that was already present in the 2.16.2 release. The fix adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 141), preventing its deserialization. This upstream fix by Tatu Saloranta was included in the version TuxCare onboarded, making the vulnerable pattern absent from all commits in the target branch's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:37:21.976714+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing deny list entry for the JtaTransactionConfig deserialization gadget. Target version 2.16.2-tuxcare.3 is not affected because the fix was already present in the upstream 2.16.2 release. The vulnerable gadget class 'com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig' is blocked in SubTypeValidator.java at line 144, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing deny list entry for the JtaTransactionConfig deserialization gadget. Target version 2.16.2-tuxcare.3 is not affected because the fix was already present in the upstream 2.16.2 release. The vulnerable gadget class 'com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig' is blocked in SubTypeValidator.java at line 144, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:13:14.329691+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is not present in jackson-databind 2.16.2-tuxcare.3. The fix (adding br.com.anteros.dbcp.AnterosDBCPConfig to the deserialization blacklist) was already included in upstream version 2.16.2 when TuxCare onboarded it. The vulnerable gadget class is blocked at line 145 of SubTypeValidator.java, preventing exploitation through polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 is not present in jackson-databind 2.16.2-tuxcare.3. The fix (adding br.com.anteros.dbcp.AnterosDBCPConfig to the deserialization blacklist) was already included in upstream version 2.16.2 when TuxCare onboarded it. The vulnerable gadget class is blocked at line 145 of SubTypeValidator.java, preventing exploitation through polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:09:27.722120+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability involves deserialization of dangerous gadget classes (javax.swing.JTextPane and others). The upstream fix, which adds these classes to the SubTypeValidator blocklist, was already included in the jackson-databind 2.16.2 release that TuxCare onboarded. The fix commits (7dbf51bf78 and 08fbfacf89) are ancestors of the TuxCare onboarding commit (9901620829), confirming the vulnerability was patched upstream before TuxCare maintenance began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.16.2-tuxcare.3. The vulnerability involves deserialization of dangerous gadget classes (javax.swing.JTextPane and others). The upstream fix, which adds these classes to the SubTypeValidator blocklist, was already included in the jackson-databind 2.16.2 release that TuxCare onboarded. The fix commits (7dbf51bf78 and 08fbfacf89) are ancestors of the TuxCare onboarding commit (9901620829), confirming the vulnerability was patched upstream before TuxCare maintenance began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 (DoS via 2GB heap allocation during JsonNode JDK deserialization) is NOT present in jackson-databind 2.16.2-tuxcare.3. The upstream fix commit 3ccde7d938 (by Tatu Saloranta, dated 2021-12-03) was already included in the upstream 2.16.2 release before TuxCare onboarded it. The vulnerable pattern (direct allocation of attacker-controlled size in NodeSerialization.readExternal) has been replaced with chunked reading that limits eager allocation to 100KB. The target contains the complete fix: LONGEST_EAGER_ALLOC constant, _read() method with ByteArrayBuilder-based incremental reading for payloads > 100KB.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "CVE-2021-46877 (DoS via 2GB heap allocation during JsonNode JDK deserialization) is NOT present in jackson-databind 2.16.2-tuxcare.3. The upstream fix commit 3ccde7d938 (by Tatu Saloranta, dated 2021-12-03) was already included in the upstream 2.16.2 release before TuxCare onboarded it. The vulnerable pattern (direct allocation of attacker-controlled size in NodeSerialization.readExternal) has been replaced with chunked reading that limits eager allocation to 100KB. The target contains the complete fix: LONGEST_EAGER_ALLOC constant, _read() method with ByteArrayBuilder-based incremental reading for payloads > 100KB.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:42:38.207193+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.16.2 is not affected by CVE-2022-42003. The vulnerability (resource exhaustion via unbounded recursive array unwrapping when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream version 2.14.0. The fix commit d78d00ee7b by upstream maintainer Tatu Saloranta was already present in the upstream 2.16.2 release that TuxCare onboarded. The vulnerable pattern (missing nested array depth check) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "Target version 2.16.2 is not affected by CVE-2022-42003. The vulnerability (resource exhaustion via unbounded recursive array unwrapping when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream version 2.14.0. The fix commit d78d00ee7b by upstream maintainer Tatu Saloranta was already present in the upstream 2.16.2 release that TuxCare onboarded. The vulnerable pattern (missing nested array depth check) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:57:07.115751+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 is not present in jackson-databind 2.16.2. The vulnerability (resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed by upstream commit 063183589218fec19a9293ed2f17ec53ea80ba88 authored by Tatu Saloranta, which was included in the upstream 2.16.2 release that TuxCare onboarded. The fix adds a check in BeanDeserializer._deserializeFromArray() that detects and rejects nested START_ARRAY tokens before recursive processing can cause stack exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "CVE-2022-42004 is not present in jackson-databind 2.16.2. The vulnerability (resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed by upstream commit 063183589218fec19a9293ed2f17ec53ea80ba88 authored by Tatu Saloranta, which was included in the upstream 2.16.2 release that TuxCare onboarded. The fix adds a check in BeanDeserializer._deserializeFromArray() that detects and rejects nested START_ARRAY tokens before recursive processing can cause stack exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-29T06:20:18.500468+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-29T06:20:18.500468+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-02T20:19:31.303832+00:00", "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository jackson-databind 2.16.2-tuxcare.3 is NOT vulnerable to CVE-2026-50193. The fix for deeply nested JSON causing stack overflow during JsonNode.toString() serialization was already present in the upstream release 2.16.2 (original fix was in upstream version 2.14.0). The InternalNodeMapper class uses iterative serialization with an explicit IteratorStack instead of recursive c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50193" }, "impact_statement": "not_affected \u2014 The target repository jackson-databind 2.16.2-tuxcare.3 is NOT vulnerable to CVE-2026-50193. The fix for deeply nested JSON causing stack overflow during JsonNode.toString() serialization was already present in the upstream release 2.16.2 (original fix was in upstream version 2.14.0). The InternalNodeMapper class uses iterative serialization with an explicit IteratorStack instead of recursive c..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-29T06:20:18.500468+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-29T06:20:18.500468+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-29T06:20:18.500468+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-29T06:20:18.500468+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-03T02:56:05.988560+00:00", "status_notes": "Vulnerability CVE-2026-54516 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.16.2 is NOT affected by CVE-2026-54516. The vulnerable code path that allows @JsonProperty-renamed getters with @JsonIgnore setters to bypass setter restrictions and write to backing fields was introduced in version 2.21.0 (commit 1fe6ee7a89, Fix #5398, Nov 2025). The target version predates this change and lacks the specific code in POJOPropertiesCollector._renameProperties() ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54516" }, "impact_statement": "not_affected \u2014 Target version 2.16.2 is NOT affected by CVE-2026-54516. The vulnerable code path that allows @JsonProperty-renamed getters with @JsonIgnore setters to bypass setter restrictions and write to backing fields was introduced in version 2.21.0 (commit 1fe6ee7a89, Fix #5398, Nov 2025). The target version predates this change and lacks the specific code in POJOPropertiesCollector._renameProperties() ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-29T06:20:18.500468+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-11-10T04:17:00.447062+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because unwrapped constructor parameters are rejected before deserialization, preventing the vulnerable configuration from being used. src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:1173 reports the unsupported combination for unnamed parameters. src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:1014 also rejects named creator properties with unwrapping annotations.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because unwrapped constructor parameters are rejected before deserialization, preventing the vulnerable configuration from being used. src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:1173 reports the unsupported combination for unnamed parameters. src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:1014 also rejects named creator properties with unwrapping annotations." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-29T06:20:18.500468+00:00", "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59888" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-29T06:20:18.500468+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-29T06:20:18.500468+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-30T13:00:26.830408+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.16.2-tuxcare.3.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.16.2-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-29T06:20:18.500468+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-30T13:01:00.109784+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.16.2-tuxcare.3.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.16.2-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-30T13:00:26.830408+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.16.2-tuxcare.3.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.16.2-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-29T06:20:18.500468+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.16.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2-tuxcare.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.16.2-tuxcare.2.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }