{ "@id": "urn:uuid:60d5977a-38ef-4570-a335-1095b326ce85", "role": "Document Creator", "author": "https://tuxcare.com", "version": 83, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T11:24:30.529432+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T13:08:13.759745+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 (Jackson deserialization gadget blacklist extension) is NOT present in jackson-databind 2.17.3. The upstream vendor (FasterXML) fixed this vulnerability in versions 2.8.11/2.9.4 (2017), and the fix is included in the 2.17.3 upstream release that TuxCare onboarded. The dangerous classes from CVE-2017-15095 (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring and C3P0 gadgets) are blacklisted in SubTypeValidator.java, preventing their polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 (Jackson deserialization gadget blacklist extension) is NOT present in jackson-databind 2.17.3. The upstream vendor (FasterXML) fixed this vulnerability in versions 2.8.11/2.9.4 (2017), and the fix is included in the 2.17.3 upstream release that TuxCare onboarded. The dangerous classes from CVE-2017-15095 (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring and C3P0 gadgets) are blacklisted in SubTypeValidator.java, preventing their polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:43:13.146994+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through versions 2.8.10 and 2.9.x through 2.9.3 due to an incomplete blacklist for polymorphic deserialization. The target version 2.17.3 includes upstream fixes from issues #1737 and #1855 that were shipped in versions 2.8.11 and 2.9.4. The SubTypeValidator class contains the complete blacklist and pattern-based blocking for Spring framework classes (AbstractPointcutAdvisor, AbstractApplicationContext) and C3P0 DataSource classes. These fixes were authored by upstream developers and were already present in version 2.17.3 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 affects jackson-databind through versions 2.8.10 and 2.9.x through 2.9.3 due to an incomplete blacklist for polymorphic deserialization. The target version 2.17.3 includes upstream fixes from issues #1737 and #1855 that were shipped in versions 2.8.11 and 2.9.4. The SubTypeValidator class contains the complete blacklist and pattern-based blocking for Spring framework classes (AbstractPointcutAdvisor, AbstractApplicationContext) and C3P0 DataSource classes. These fixes were authored by upstream developers and were already present in version 2.17.3 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:26:13.547967+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.3-tuxcare.4 is NOT AFFECTED by CVE-2017-7525. The vulnerability (unsafe polymorphic deserialization allowing arbitrary code execution via malicious class instantiation) has been fixed by the upstream vendor. The defense mechanism (SubTypeValidator with blacklist validation) is present and active in the target code, blocking deserialization of dangerous classes including TemplatesImpl, InvokerTransformer, and other gadget classes identified in the CVE. The fix was authored by Tatu Saloranta (upstream FasterXML maintainer) and was already included in the upstream release 2.17.3 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "The target jackson-databind 2.17.3-tuxcare.4 is NOT AFFECTED by CVE-2017-7525. The vulnerability (unsafe polymorphic deserialization allowing arbitrary code execution via malicious class instantiation) has been fixed by the upstream vendor. The defense mechanism (SubTypeValidator with blacklist validation) is present and active in the target code, blocking deserialization of dangerous classes including TemplatesImpl, InvokerTransformer, and other gadget classes identified in the CVE. The fix was authored by Tatu Saloranta (upstream FasterXML maintainer) and was already included in the upstream release 2.17.3 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T13:16:19.686333+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5 where Jackson default typing with iBatis XPathParser gadget class enables data exfiltration. Target version 2.17.3-tuxcare.4 contains upstream fix from commit 27b4defc27 (May 2018) which adds org.apache.ibatis.parsing.XPathParser to deserialization blacklist in SubTypeValidator.java. Fix was authored by upstream maintainer (tatu.saloranta@iki.fi) and included in upstream release 2.17.3 before TuxCare onboarding. Vulnerable pattern not present in target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5 where Jackson default typing with iBatis XPathParser gadget class enables data exfiltration. Target version 2.17.3-tuxcare.4 contains upstream fix from commit 27b4defc27 (May 2018) which adds org.apache.ibatis.parsing.XPathParser to deserialization blacklist in SubTypeValidator.java. Fix was authored by upstream maintainer (tatu.saloranta@iki.fi) and included in upstream release 2.17.3 before TuxCare onboarding. Vulnerable pattern not present in target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T17:17:53.657243+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is NOT present in jackson-databind 2.17.3-tuxcare.4. The upstream fix that blacklists the Jodd-db gadget class (jodd.db.connection.DataSourceConnectionProvider) was already included in version 2.17.3 when TuxCare onboarded it. The vulnerable deserialization pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 is NOT present in jackson-databind 2.17.3-tuxcare.4. The upstream fix that blacklists the Jodd-db gadget class (jodd.db.connection.DataSourceConnectionProvider) was already included in version 2.17.3 when TuxCare onboarded it. The vulnerable deserialization pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T16:19:28.543087+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is not present in jackson-databind 2.17.3. The vulnerability involves unsafe deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled, leading to remote code execution via LDAP service connections. The fix, which adds these classes to a hardcoded deny list in SubTypeValidator.java, was authored by upstream (Tatu Saloranta) and shipped in upstream release 2.7.9.4. Target version 2.17.3 contains this fix as it was already present in the upstream release onboarded by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is not present in jackson-databind 2.17.3. The vulnerability involves unsafe deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled, leading to remote code execution via LDAP service connections. The fix, which adds these classes to a hardcoded deny list in SubTypeValidator.java, was authored by upstream (Tatu Saloranta) and shipped in upstream release 2.7.9.4. Target version 2.17.3 contains this fix as it was already present in the upstream release onboarded by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T13:47:16.155569+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.17.3. The vulnerability allowed remote code execution via polymorphic deserialization of org.slf4j.ext.EventData. The fix (commit 87d29af25e by upstream maintainer Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java:75. This fix was already part of upstream release 2.17.3 when TuxCare onboarded it (commit f1946ec0c8). The SubTypeValidator.validateSubType() method blocks instantiation of dangerous classes before deserialization, preventing the attack chain from reaching its goal. Target version 2.17.3 is far newer than affected versions (2.x before 2.9.7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.17.3. The vulnerability allowed remote code execution via polymorphic deserialization of org.slf4j.ext.EventData. The fix (commit 87d29af25e by upstream maintainer Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java:75. This fix was already part of upstream release 2.17.3 when TuxCare onboarded it (commit f1946ec0c8). The SubTypeValidator.validateSubType() method blocks instantiation of dangerous classes before deserialization, preventing the attack chain from reaching its goal. Target version 2.17.3 is far newer than affected versions (2.x before 2.9.7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:58:58.868131+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 concerns polymorphic deserialization vulnerabilities in jackson-databind related to blaze-ds classes. The target repository (jackson-databind 2.17.3-tuxcare.4) is NOT AFFECTED because the upstream fix was already present in the version TuxCare onboarded. The blaze-ds class 'flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor' and related gadget classes are blacklisted in SubTypeValidator.java lines 74-78, preventing their deserialization. This fix was introduced by upstream maintainer Tatu Saloranta in commit 87d29af before TuxCare's first commit (setup 2.11.2), making this an upstream fix that shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 concerns polymorphic deserialization vulnerabilities in jackson-databind related to blaze-ds classes. The target repository (jackson-databind 2.17.3-tuxcare.4) is NOT AFFECTED because the upstream fix was already present in the version TuxCare onboarded. The blaze-ds class 'flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor' and related gadget classes are blacklisted in SubTypeValidator.java lines 74-78, preventing their deserialization. This fix was introduced by upstream maintainer Tatu Saloranta in commit 87d29af before TuxCare's first commit (setup 2.11.2), making this an upstream fix that shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:07:13.542936+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.3-tuxcare.4 is not affected by CVE-2018-14720. The vulnerability allows XXE attacks via polymorphic deserialization of dangerous JDK classes. The vendor patch (commit 87d29af25e) blocked four specific class names from deserialization. This fix is present in the target repository and shipped in the upstream jackson-databind release before TuxCare onboarded version 2.17.3. The blocklist entries are in SubTypeValidator.java lines 74-77 and are enforced during bean deserialization to reject dangerous types with the error \"Illegal type (%s) to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "The target jackson-databind 2.17.3-tuxcare.4 is not affected by CVE-2018-14720. The vulnerability allows XXE attacks via polymorphic deserialization of dangerous JDK classes. The vendor patch (commit 87d29af25e) blocked four specific class names from deserialization. This fix is present in the target repository and shipped in the upstream jackson-databind release before TuxCare onboarded version 2.17.3. The blocklist entries are in SubTypeValidator.java lines 74-77 and are enforced during bean deserialization to reject dangerous types with the error \"Illegal type (%s) to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:35:42.158102+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 affects jackson-databind versions before 2.9.7 due to missing blocklist entry for org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. The target version 2.17.3-tuxcare.4 is NOT affected because the fix was already present in the upstream release 2.9.7 (August 2018). The axis2 class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:78, preventing polymorphic deserialization that could lead to SSRF attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 affects jackson-databind versions before 2.9.7 due to missing blocklist entry for org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. The target version 2.17.3-tuxcare.4 is NOT affected because the fix was already present in the upstream release 2.9.7 (August 2018). The axis2 class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:78, preventing polymorphic deserialization that could lead to SSRF attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T12:46:12.447284+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is not present in jackson-databind 2.17.3. The vulnerability required the absence of a blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in SubTypeValidator. This entry was added by upstream commit 72cd4025a2 on 2018-11-19, which is an ancestor of the first TuxCare onboarding commit (f1946ec0c8 from 2026-09-10). The fix was already present in the upstream release 2.17.3 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 is not present in jackson-databind 2.17.3. The vulnerability required the absence of a blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in SubTypeValidator. This entry was added by upstream commit 72cd4025a2 on 2018-11-19, which is an ancestor of the first TuxCare onboarding commit (f1946ec0c8 from 2026-09-10). The fix was already present in the upstream release 2.17.3 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T16:55:41.476005+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is not present in jackson-databind 2.17.3. The vulnerable pattern (unblocked openjpa classes in polymorphic deserialization) was fixed in upstream commit 72cd4025a2 by Tatu Saloranta and shipped in upstream version 2.9.8 (December 2018). The target version 2.17.3 already contains this fix - the openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) are present in the SubTypeValidator blocklist at lines 82-83, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 is not present in jackson-databind 2.17.3. The vulnerable pattern (unblocked openjpa classes in polymorphic deserialization) was fixed in upstream commit 72cd4025a2 by Tatu Saloranta and shipped in upstream version 2.9.8 (December 2018). The target version 2.17.3 already contains this fix - the openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) are present in the SubTypeValidator blocklist at lines 82-83, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:24:04.222754+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.3-tuxcare.4 is NOT vulnerable to CVE-2018-19362. The fix that blocks org.jboss.util.propertyeditor.DocumentEditor (and related classes) from polymorphic deserialization is present in SubTypeValidator.java at line 81. This fix was introduced by upstream commit 72cd4025a2 authored by Tatu Saloranta (tatu.saloranta@iki.fi) and was already included in the upstream jackson-databind 2.17.3 release that TuxCare onboarded. The CVE affects versions before 2.9.8, and the target is version 2.17.3, which is well past the fix version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "The target jackson-databind 2.17.3-tuxcare.4 is NOT vulnerable to CVE-2018-19362. The fix that blocks org.jboss.util.propertyeditor.DocumentEditor (and related classes) from polymorphic deserialization is present in SubTypeValidator.java at line 81. This fix was introduced by upstream commit 72cd4025a2 authored by Tatu Saloranta (tatu.saloranta@iki.fi) and was already included in the upstream jackson-databind 2.17.3 release that TuxCare onboarded. The CVE affects versions before 2.9.8, and the target is version 2.17.3, which is well past the fix version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.17.3. The two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist in vulnerable versions are properly blacklisted in SubTypeValidator.java at lines 62-63. The fix was authored by upstream maintainer Tatu Saloranta (commit 038b471e2e) and shipped in the upstream 2.17.3 release that TuxCare onboarded. The SubTypeValidator is actively enforced in the deserialization pipeline through BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.17.3. The two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist in vulnerable versions are properly blacklisted in SubTypeValidator.java at lines 62-63. The fix was authored by upstream maintainer Tatu Saloranta (commit 038b471e2e) and shipped in the upstream 2.17.3 release that TuxCare onboarded. The SubTypeValidator is actively enforced in the deserialization pipeline through BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T13:44:14.640121+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 affects jackson-databind versions before 2.9.5 and allows RCE via c3p0 deserialization gadgets. The target version 2.17.3-tuxcare.4 contains the upstream fix that blocks c3p0 DataSource class deserialization. The fix was authored by Tatu Saloranta and shipped in the upstream 2.17.3 release, which TuxCare onboarded via commit f1946ec0. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 affects jackson-databind versions before 2.9.5 and allows RCE via c3p0 deserialization gadgets. The target version 2.17.3-tuxcare.4 contains the upstream fix that blocks c3p0 DataSource class deserialization. The fix was authored by Tatu Saloranta and shipped in the upstream 2.17.3 release, which TuxCare onboarded via commit f1946ec0. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T16:31:30.745035+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability (polymorphic deserialization of com.mysql.cj.jdbc.admin.MiniAdmin allowing arbitrary file reads) is mitigated by the upstream fix that blacklists this class in SubTypeValidator.java line 88. This fix was included in the upstream release 2.17.3 that TuxCare onboarded, not applied as a TuxCare backport. The defense is active and prevents deserialization of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability (polymorphic deserialization of com.mysql.cj.jdbc.admin.MiniAdmin allowing arbitrary file reads) is mitigated by the upstream fix that blacklists this class in SubTypeValidator.java line 88. This fix was included in the upstream release 2.17.3 that TuxCare onboarded, not applied as a TuxCare backport. The defense is active and prevents deserialization of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-01T18:30:16.509417+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.17.3 is not affected by CVE-2019-12384. The vulnerability involves polymorphic deserialization of the logback-core gadget class `ch.qos.logback.core.db.DriverManagerConnectionSource` to achieve arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit c9ef4a10d6f by adding a blocklist entry in SubTypeValidator.java. This fix was already present in upstream ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 Target version 2.17.3 is not affected by CVE-2019-12384. The vulnerability involves polymorphic deserialization of the logback-core gadget class `ch.qos.logback.core.db.DriverManagerConnectionSource` to achieve arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit c9ef4a10d6f by adding a blocklist entry in SubTypeValidator.java. This fix was already present in upstream ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-02T07:12:00.167059+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind version 2.17.3 is not affected by CVE-2019-12814. The vulnerability was fixed in upstream version 2.9.10 (September 2019) by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. The fix commit (5f7c69bba07a7155adde130d9dee2e54a54f1fa5) by upstream maintainer Tatu Saloranta is presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 The target jackson-databind version 2.17.3 is not affected by CVE-2019-12814. The vulnerability was fixed in upstream version 2.9.10 (September 2019) by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. The fix commit (5f7c69bba07a7155adde130d9dee2e54a54f1fa5) by upstream maintainer Tatu Saloranta is presen..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T12:07:34.733429+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.17.3. The vulnerability concerns unsafe deserialization of the ehcache class 'net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup' leading to RCE. The upstream fix (commit ad418eeb) added this class to the deserialization blocklist in SubTypeValidator.java (line 98). This fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream 2.17.3 release before TuxCare onboarding. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.17.3. The vulnerability concerns unsafe deserialization of the ehcache class 'net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup' leading to RCE. The upstream fix (commit ad418eeb) added this class to the deserialization blocklist in SubTypeValidator.java (line 98). This fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream 2.17.3 release before TuxCare onboarding. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T13:30:30.768655+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability affects jackson-databind 2.x before versions 2.9.9.2, 2.8.11.4, 2.7.9.6, and 2.6.7.3. The target version 2.17.3 is significantly newer than the fixed version 2.9.9.2 and already contains the upstream fix that blacklists ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.17.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability affects jackson-databind 2.x before versions 2.9.9.2, 2.8.11.4, 2.7.9.6, and 2.6.7.3. The target version 2.17.3 is significantly newer than the fixed version 2.9.9.2 and already contains the upstream fix that blacklists ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.17.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T16:46:51.408476+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to unsafe polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource. The target repository (jackson-databind 2.17.3-tuxcare.4) is NOT affected because the fix was already included in the upstream jackson-databind 2.17.3 release. The SubTypeValidator blocklist (lines 105-107 of SubTypeValidator.java) contains both com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource, preventing deserialization of these gadget classes. This defense was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to unsafe polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource. The target repository (jackson-databind 2.17.3-tuxcare.4) is NOT affected because the fix was already included in the upstream jackson-databind 2.17.3 release. The SubTypeValidator blocklist (lines 105-107 of SubTypeValidator.java) contains both com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource, preventing deserialization of these gadget classes. This defense was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:54:05.163421+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is not present in jackson-databind 2.17.3-tuxcare.4. The vulnerability involves polymorphic deserialization of commons-configuration JNDI classes leading to arbitrary code execution. The upstream fix (commit 41b7f9b901) added org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist in SubTypeValidator.java. This fix was already present in jackson-databind 2.17.3 when TuxCare onboarded the version, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 is not present in jackson-databind 2.17.3-tuxcare.4. The vulnerability involves polymorphic deserialization of commons-configuration JNDI classes leading to arbitrary code execution. The upstream fix (commit 41b7f9b901) added org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist in SubTypeValidator.java. This fix was already present in jackson-databind 2.17.3 when TuxCare onboarded the version, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is NOT present in jackson-databind 2.17.3. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution. The fix, which adds this class to the SubTypeValidator blacklist, was authored by upstream maintainer Tatu Saloranta in commit 998efd7082 and was already included in the upstream release 2.17.3 that TuxCare onboarded. The target version contains the complete defense mechanism preventing instantiation of this malicious class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893 is NOT present in jackson-databind 2.17.3. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution. The fix, which adds this class to the SubTypeValidator blacklist, was authored by upstream maintainer Tatu Saloranta in commit 998efd7082 and was already included in the upstream release 2.17.3 that TuxCare onboarded. The target version contains the complete defense mechanism preventing instantiation of this malicious class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T17:03:58.617275+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic deserialization gadget involving com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.17.3-tuxcare.4) is NOT AFFECTED because the upstream vendor fix was already present in version 2.17.3 before TuxCare onboarding. The fix adds HikariDataSource to the SubTypeValidator blocklist, preventing its instantiation during polymorphic deserialization. Commit 73c1c2cc76 by Tatu Saloranta (upstream maintainer) implemented this fix, which shipped in the upstream 2.17.3 release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic deserialization gadget involving com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.17.3-tuxcare.4) is NOT AFFECTED because the upstream vendor fix was already present in version 2.17.3 before TuxCare onboarding. The fix adds HikariDataSource to the SubTypeValidator blocklist, preventing its instantiation during polymorphic deserialization. Commit 73c1c2cc76 by Tatu Saloranta (upstream maintainer) implemented this fix, which shipped in the upstream 2.17.3 release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:03:40.830954+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind 2.0.0 through 2.9.10, enabling arbitrary code execution via polymorphic deserialization of commons-dbcp datasource classes. The target version 2.17.3-tuxcare.4 already contains the upstream fix that blocks deserialization of org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix was applied by upstream maintainer Tatu Saloranta in September 2019 (commits 328a0f83 and 9593e16c) and shipped in upstream release 2.9.10.1, well before the 2.17.3 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 affects jackson-databind 2.0.0 through 2.9.10, enabling arbitrary code execution via polymorphic deserialization of commons-dbcp datasource classes. The target version 2.17.3-tuxcare.4 already contains the upstream fix that blocks deserialization of org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix was applied by upstream maintainer Tatu Saloranta in September 2019 (commits 328a0f83 and 9593e16c) and shipped in upstream release 2.9.10.1, well before the 2.17.3 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T17:13:44.782673+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.17.3. The vulnerability involves polymorphic deserialization of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource) that can trigger JNDI lookups and remote code execution. The upstream fix (commit 9593e16c by Tatu Saloranta) blacklists these classes in SubTypeValidator, preventing their deserialization. This fix was already included in upstream jackson-databind 2.17.3 when TuxCare onboarded it. All three dangerous classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java lines 124-127), and the validator is properly invoked during deserialization by BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.17.3. The vulnerability involves polymorphic deserialization of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource) that can trigger JNDI lookups and remote code execution. The upstream fix (commit 9593e16c by Tatu Saloranta) blacklists these classes in SubTypeValidator, preventing their deserialization. This fix was already included in upstream jackson-databind 2.17.3 when TuxCare onboarded it. All three dangerous classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java lines 124-127), and the validator is properly invoked during deserialization by BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:27:45.237635+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.3-tuxcare.4 is NOT AFFECTED by CVE-2019-17267. The vulnerability involves polymorphic deserialization of the dangerous class `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup` which could lead to arbitrary code execution via JNDI lookup. The upstream fix (commit 191a4cdf87) adding this class to the deserialization blacklist was already present in the upstream release 2.17.3 before TuxCare onboarded it. The fix was authored by Tatu Saloranta (Jackson maintainer) and shipped in upstream version 2.9.10, long before version 2.17.3. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "The target jackson-databind 2.17.3-tuxcare.4 is NOT AFFECTED by CVE-2019-17267. The vulnerability involves polymorphic deserialization of the dangerous class `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup` which could lead to arbitrary code execution via JNDI lookup. The upstream fix (commit 191a4cdf87) adding this class to the deserialization blacklist was already present in the upstream release 2.17.3 before TuxCare onboarded it. The fix was authored by Tatu Saloranta (Jackson maintainer) and shipped in upstream version 2.9.10, long before version 2.17.3. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:47:05.724799+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.17.3-tuxcare.4 is NOT AFFECTED by CVE-2019-17531. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta, dated October 12, 2019) was already present in the upstream jackson-databind 2.17.3 release that TuxCare onboarded. The fix adds two log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) to the SubTypeValidator blocklist, preventing their deserialization and blocking the JNDI-based remote code execution attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "The target repository jackson-databind 2.17.3-tuxcare.4 is NOT AFFECTED by CVE-2019-17531. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta, dated October 12, 2019) was already present in the upstream jackson-databind 2.17.3 release that TuxCare onboarded. The fix adds two log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) to the SubTypeValidator blocklist, preventing their deserialization and blocking the JNDI-based remote code execution attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:05:53.304095+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330: Target version 2.17.3-tuxcare.4 is NOT AFFECTED. The vulnerability (missing blocklist entries for two ehcache gadget classes that enable JNDI-based RCE) is not present because the upstream fix was already included in jackson-databind 2.17.3 when TuxCare onboarded it. The SubTypeValidator class at lines 134-135 contains the required blocklist entries for net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector, preventing their deserialization. Fix commit eb254813cc by Tatu Saloranta was already present in the upstream release before the first TuxCare commit f1946ec0c8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330: Target version 2.17.3-tuxcare.4 is NOT AFFECTED. The vulnerability (missing blocklist entries for two ehcache gadget classes that enable JNDI-based RCE) is not present because the upstream fix was already included in jackson-databind 2.17.3 when TuxCare onboarded it. The SubTypeValidator class at lines 134-135 contains the required blocklist entries for net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector, preventing their deserialization. Fix commit eb254813cc by Tatu Saloranta was already present in the upstream release before the first TuxCare commit f1946ec0c8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T17:01:04.850496+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.17.3-tuxcare.4) is NOT AFFECTED by CVE-2020-10650. The fix for this vulnerability was already present in the upstream release 2.17.3 before TuxCare onboarded it. The fix commit a424c038ba (authored by upstream maintainer Tatu Saloranta) added blocklist entries for three dangerous classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) to SubTypeValidator.java, preventing their deserialization. These protections are active in the target and enforced during bean deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "The target repository (jackson-databind 2.17.3-tuxcare.4) is NOT AFFECTED by CVE-2020-10650. The fix for this vulnerability was already present in the upstream release 2.17.3 before TuxCare onboarded it. The fix commit a424c038ba (authored by upstream maintainer Tatu Saloranta) added blocklist entries for three dangerous classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) to SubTypeValidator.java, preventing their deserialization. These protections are active in the target and enforced during bean deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.17.3-tuxcare.4 is NOT AFFECTED by CVE-2020-10672. The vulnerability required the absence of blocklist entries for org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory in SubTypeValidator. These entries are present at lines 163-164 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta (commit 592872f423) and was already included in the upstream 2.17.3 release that TuxCare onboarded (first TuxCare commit f1946ec0). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "Target jackson-databind 2.17.3-tuxcare.4 is NOT AFFECTED by CVE-2020-10672. The vulnerability required the absence of blocklist entries for org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory in SubTypeValidator. These entries are present at lines 163-164 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta (commit 592872f423) and was already included in the upstream 2.17.3 release that TuxCare onboarded (first TuxCare commit f1946ec0). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T16:25:43.115991+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.17.3-tuxcare.4. The upstream fix (commit 1645efbd39) that blocks deserialization of the dangerous gadget class com.caucho.config.types.ResourceRef was already included in the upstream jackson-databind 2.17.3 release before TuxCare onboarding. The fix adds ResourceRef to the DEFAULT_NO_DESER_CLASS_NAMES deny-list in SubTypeValidator.java (line 167), which is enforced by BeanDeserializerFactory during deserialization, throwing a JsonMappingException with \"Illegal type to deserialize: prevented for security reasons\" if an attacker attempts to exploit this gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.17.3-tuxcare.4. The upstream fix (commit 1645efbd39) that blocks deserialization of the dangerous gadget class com.caucho.config.types.ResourceRef was already included in the upstream jackson-databind 2.17.3 release before TuxCare onboarding. The fix adds ResourceRef to the DEFAULT_NO_DESER_CLASS_NAMES deny-list in SubTypeValidator.java (line 167), which is enforced by BeanDeserializerFactory during deserialization, throwing a JsonMappingException with \"Illegal type to deserialize: prevented for security reasons\" if an attacker attempts to exploit this gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4, related to deserialization of the gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.17.3-tuxcare.4) contains the fix that blocks this gadget class in SubTypeValidator.java. The fix was introduced by upstream commit 05d7e0e13f (authored by Tatu Saloranta, the Jackson maintainer) and was already present in the upstream 2.17.3 release that TuxCare onboarded. The vulnerable pattern was never present in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4, related to deserialization of the gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.17.3-tuxcare.4) contains the fix that blocks this gadget class in SubTypeValidator.java. The fix was introduced by upstream commit 05d7e0e13f (authored by Tatu Saloranta, the Jackson maintainer) and was already present in the upstream 2.17.3 release that TuxCare onboarded. The vulnerable pattern was never present in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 is not present in jackson-databind 2.17.3-tuxcare.4. The vulnerability required adding javax.swing.JEditorPane to the deserialization blocklist to prevent RCE via polymorphic type handling. This fix was already present in the upstream 2.17.3 release (commit 4d038c9de0a by Tatu Saloranta on 2020-03-03), which TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:150 and is actively enforced during deserialization. Since this is an upstream fix that shipped with the release (not a TuxCare backport), the verdict is not_affected with code_not_present justification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "CVE-2020-10969 is not present in jackson-databind 2.17.3-tuxcare.4. The vulnerability required adding javax.swing.JEditorPane to the deserialization blocklist to prevent RCE via polymorphic type handling. This fix was already present in the upstream 2.17.3 release (commit 4d038c9de0a by Tatu Saloranta on 2020-03-03), which TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:150 and is actively enforced during deserialization. Since this is an upstream fix that shipped with the release (not a TuxCare backport), the verdict is not_affected with code_not_present justification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 does not affect jackson-databind 2.17.3-tuxcare.4. The vulnerability involves unsafe deserialization of Apache ActiveMQ classes that can be exploited as gadgets in polymorphic deserialization attacks. The upstream fix adds these ActiveMQ classes to a blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.17.3 release that TuxCare onboarded (commit 08fbfacf89 by qxo, authored upstream before TuxCare's first commit f1946ec0c8). The target's SubTypeValidator.java contains all required blocklist entries at lines 173-183, preventing deserialization of the dangerous ActiveMQ classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 does not affect jackson-databind 2.17.3-tuxcare.4. The vulnerability involves unsafe deserialization of Apache ActiveMQ classes that can be exploited as gadgets in polymorphic deserialization attacks. The upstream fix adds these ActiveMQ classes to a blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.17.3 release that TuxCare onboarded (commit 08fbfacf89 by qxo, authored upstream before TuxCare's first commit f1946ec0c8). The target's SubTypeValidator.java contains all required blocklist entries at lines 173-183, preventing deserialization of the dangerous ActiveMQ classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entry for org.apache.commons.proxy.provider.remoting.RmiProvider, allowing arbitrary code execution via deserialization gadgets. The target version 2.17.3-tuxcare.4 already contains the upstream fix (commit 05d7e0e13f by Tatu Saloranta) that adds RmiProvider to the deserialization blacklist in SubTypeValidator.java at line 186. This fix was present in the upstream release when TuxCare onboarded version 2.17.3, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entry for org.apache.commons.proxy.provider.remoting.RmiProvider, allowing arbitrary code execution via deserialization gadgets. The target version 2.17.3-tuxcare.4 already contains the upstream fix (commit 05d7e0e13f by Tatu Saloranta) that adds RmiProvider to the deserialization blacklist in SubTypeValidator.java at line 186. This fix was present in the upstream release when TuxCare onboarded version 2.17.3, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 does not affect jackson-databind 2.17.3. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The upstream vendor (FasterXML) fixed this by adding the class to the SubTypeValidator blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in commit e2ba12d5d6 dated March 28, 2020. This fix was already present in the upstream jackson-databind 2.17.3 release that TuxCare onboarded. The target repository contains the blocklist entry at SubTypeValidator.java:84, preventing deserialization of the vulnerable class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 does not affect jackson-databind 2.17.3. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The upstream vendor (FasterXML) fixed this by adding the class to the SubTypeValidator blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in commit e2ba12d5d6 dated March 28, 2020. This fix was already present in the upstream jackson-databind 2.17.3 release that TuxCare onboarded. The target repository contains the blocklist entry at SubTypeValidator.java:84, preventing deserialization of the vulnerable class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.17.3 is not affected by CVE-2020-11619. The vulnerability (missing blocklist entries for MethodLocatingFactoryBean and BeanReferenceFactoryBean) was fixed in upstream version 2.9.10.4, and the fix is present in all subsequent versions including 2.17.3. The blocklist entries exist in SubTypeValidator.java (lines 52-54) and are actively enforced during polymorphic deserialization via BeanDeserializerFactory. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.17.3 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "Target version 2.17.3 is not affected by CVE-2020-11619. The vulnerability (missing blocklist entries for MethodLocatingFactoryBean and BeanReferenceFactoryBean) was fixed in upstream version 2.9.10.4, and the fix is present in all subsequent versions including 2.17.3. The blocklist entries exist in SubTypeValidator.java (lines 52-54) and are actively enforced during polymorphic deserialization via BeanDeserializerFactory. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.17.3 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is not present in jackson-databind 2.17.3. The vulnerability relates to deserialization gadgets with the class org.apache.commons.jelly.impl.Embedded. The upstream fix (commit 77040d85e3) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream 2.17.3 release that TuxCare onboarded, so the target has never been vulnerable at this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 is not present in jackson-databind 2.17.3. The vulnerability relates to deserialization gadgets with the class org.apache.commons.jelly.impl.Embedded. The upstream fix (commit 77040d85e3) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream 2.17.3 release that TuxCare onboarded, so the target has never been vulnerable at this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 does not affect jackson-databind 2.17.3-tuxcare.4. The vulnerability relates to unsafe deserialization of the gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool`. The upstream fix (commit d1c67a0396, April 2020) added this class to the deserialization blocklist in SubTypeValidator.java, and this fix was already present in upstream version 2.17.3 when TuxCare onboarded it. The dangerous class cannot be instantiated during JSON deserialization because it is blocked at SubTypeValidator.java:192 and checked at line 269 during validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 does not affect jackson-databind 2.17.3-tuxcare.4. The vulnerability relates to unsafe deserialization of the gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool`. The upstream fix (commit d1c67a0396, April 2020) added this class to the deserialization blocklist in SubTypeValidator.java, and this fix was already present in upstream version 2.17.3 when TuxCare onboarded it. The dangerous class cannot be instantiated during JSON deserialization because it is blocked at SubTypeValidator.java:192 and checked at line 269 during validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability involves deserialization gadgets using oracle.jms connection factory classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The upstream fix (commit 5c8642ae by Tatu Saloranta, April 2020) added these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in the upstream jackson-databind 2.17.3 release when TuxCare onboarded it in September 2026. All five oracle.jms classes are confirmed in the blacklist at SubTypeValidator.java lines 200-204. Verdict: not_affected (upstream fix shipped in release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "CVE-2020-14061 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability involves deserialization gadgets using oracle.jms connection factory classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The upstream fix (commit 5c8642ae by Tatu Saloranta, April 2020) added these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in the upstream jackson-databind 2.17.3 release when TuxCare onboarded it in September 2026. All five oracle.jms classes are confirmed in the blacklist at SubTypeValidator.java lines 200-204. Verdict: not_affected (upstream fix shipped in release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget vulnerability involving com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The target version 2.17.3-tuxcare.4 is NOT affected because the upstream vendor (FasterXML) already fixed this vulnerability in commit 840eae2ca81 (May 2020), which was included in upstream releases starting from 2.10.4. The fix adds the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing its deserialization. Since version 2.17.3 was released years after the fix, it shipped with the protection already in place.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget vulnerability involving com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The target version 2.17.3-tuxcare.4 is NOT affected because the upstream vendor (FasterXML) already fixed this vulnerability in commit 840eae2ca81 (May 2020), which was included in upstream releases starting from 2.10.4. The fix adds the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing its deserialization. Since version 2.17.3 was released years after the fix, it shipped with the protection already in place.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is not present in jackson-databind 2.17.3-tuxcare.4. The vulnerability concerns deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory which enables JNDI injection attacks. The fix (adding this class to the blacklist in SubTypeValidator.java) was already present in the upstream release 2.17.3 that TuxCare onboarded. The vulnerable pattern does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 is not present in jackson-databind 2.17.3-tuxcare.4. The vulnerability concerns deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory which enables JNDI injection attacks. The fix (adding this class to the blacklist in SubTypeValidator.java) was already present in the upstream release 2.17.3 that TuxCare onboarded. The vulnerable pattern does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:18:54.750507+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability concerns deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The target repository contains the fix: SubTypeValidator.java line 147 blocks this class from deserialization. The fix was already present in the upstream 2.17.3 release (commit 3d97153944f7 by Tatu Saloranta, dated Aug 10, 2020) before TuxCare onboarded the version. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability concerns deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The target repository contains the fix: SubTypeValidator.java line 147 blocks this class from deserialization. The fix was already present in the upstream 2.17.3 release (commit 3d97153944f7 by Tatu Saloranta, dated Aug 10, 2020) before TuxCare onboarded the version. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:14:13.800446+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is NOT present in jackson-databind 2.17.3. The vulnerability involves the deserialization gadget class `com.pastdev.httpcomponents.configuration.JndiConfiguration` which was added to the blocklist in upstream commit 6cc9f1a1af (authored by Tatu Saloranta). This fix was already present in the upstream 2.17.3 release when TuxCare onboarded it. The blocklist prevents instantiation of this dangerous class during JSON deserialization with polymorphic typing, blocking the attack path from attacker-controlled JSON to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 is NOT present in jackson-databind 2.17.3. The vulnerability involves the deserialization gadget class `com.pastdev.httpcomponents.configuration.JndiConfiguration` which was added to the blocklist in upstream commit 6cc9f1a1af (authored by Tatu Saloranta). This fix was already present in the upstream 2.17.3 release when TuxCare onboarded it. The blocklist prevents instantiation of this dangerous class during JSON deserialization with polymorphic typing, blocking the attack path from attacker-controlled JSON to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in the target. The upstream fix (commit 612f971b78, Jan 2020) was already included in jackson-databind 2.17.3 when TuxCare onboarded it. The fix adds two XML parser security features that disable DOCTYPE declarations and external DTD loading, preventing XML external entity attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in the target. The upstream fix (commit 612f971b78, Jan 2020) was already included in jackson-databind 2.17.3 when TuxCare onboarded it. The fix adds two XML parser security features that disable DOCTYPE declarations and external DTD loading, preventing XML external entity attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:20:14.370746+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.commons.dbcp2.datasources classes (PerUserPoolDataSource and SharedPoolDataSource). The target version 2.17.3-tuxcare.4 contains the upstream fix from commit 41b8bdb5cc by Tatu Saloranta, which adds these classes to the deserialization blocklist in SubTypeValidator.java (lines 217-218). The fix was part of the upstream 2.17.3 release that TuxCare onboarded, not a TuxCare backport. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.commons.dbcp2.datasources classes (PerUserPoolDataSource and SharedPoolDataSource). The target version 2.17.3-tuxcare.4 contains the upstream fix from commit 41b8bdb5cc by Tatu Saloranta, which adds these classes to the deserialization blocklist in SubTypeValidator.java (lines 217-218). The fix was part of the upstream 2.17.3 release that TuxCare onboarded, not a TuxCare backport. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T12:31:59.702907+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 due to missing blacklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource, which are deserialization gadgets. The target (jackson-databind 2.17.3-tuxcare.4) is NOT AFFECTED because the upstream fix (commit 41b8bdb5 by Tatu Saloranta) adding these classes to the SubTypeValidator blacklist was already present in the upstream 2.17.3 release before TuxCare onboarded it. The defense blocks deserialization of these gadget classes at lines 217-218 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 due to missing blacklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource, which are deserialization gadgets. The target (jackson-databind 2.17.3-tuxcare.4) is NOT AFFECTED because the upstream fix (commit 41b8bdb5 by Tatu Saloranta) adding these classes to the SubTypeValidator blacklist was already present in the upstream 2.17.3 release before TuxCare onboarded it. The defense blocks deserialization of these gadget classes at lines 217-218 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:54:00.210651+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.17.3. The vulnerability involves a deserialization gadget (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool from org.glassfish.web/javax.servlet.jsp.jstl) that enables JNDI injection. The upstream fix was committed by Tatu Saloranta on 2020-12-26 (commit 1ca0388c2fb) and was already included in the jackson-databind 2.17.3 upstream release before TuxCare onboarding. The gadget class is properly blocked in SubTypeValidator.java line 240.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.17.3. The vulnerability involves a deserialization gadget (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool from org.glassfish.web/javax.servlet.jsp.jstl) that enables JNDI injection. The upstream fix was committed by Tatu Saloranta on 2020-12-26 (commit 1ca0388c2fb) and was already included in the jackson-databind 2.17.3 upstream release before TuxCare onboarding. The gadget class is properly blocked in SubTypeValidator.java line 240.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T13:23:14.873847+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is not present in jackson-databind 2.17.3-tuxcare.4. The upstream fix commit 3ded28aece (by Tatu Saloranta, the Jackson maintainer) that blocks deserialization of DriverAdapterCPDS gadget classes was already included in the upstream 2.17.3 release before TuxCare onboarded it. All five namespace variants of the DriverAdapterCPDS class mentioned in the CVE are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist and enforced by SubTypeValidator.validateSubType() during polymorphic deserialization. The protection is active by default with no configuration required.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "CVE-2020-36179 is not present in jackson-databind 2.17.3-tuxcare.4. The upstream fix commit 3ded28aece (by Tatu Saloranta, the Jackson maintainer) that blocks deserialization of DriverAdapterCPDS gadget classes was already included in the upstream 2.17.3 release before TuxCare onboarded it. All five namespace variants of the DriverAdapterCPDS class mentioned in the CVE are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist and enforced by SubTypeValidator.validateSubType() during polymorphic deserialization. The protection is active by default with no configuration required.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:33:21.899203+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability concerns missing blocklist entries for org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related gadget classes that could enable deserialization-based remote code execution. The upstream fix (commit 3ded28aece, issue #3004) added these classes to the SubTypeValidator denylist and was already present in the upstream 2.17.3 release that TuxCare onboarded. All five DriverAdapterCPDS variants from the patch are confirmed present in the target's SubTypeValidator.java at lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "CVE-2020-36180 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability concerns missing blocklist entries for org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related gadget classes that could enable deserialization-based remote code execution. The upstream fix (commit 3ded28aece, issue #3004) added these classes to the SubTypeValidator denylist and was already present in the upstream 2.17.3 release that TuxCare onboarded. All five DriverAdapterCPDS variants from the patch are confirmed present in the target's SubTypeValidator.java at lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T16:40:52.879992+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability affects versions before 2.9.10.8, and the target version (2.17.3) is far beyond that range. The upstream vendor (FasterXML) fixed this vulnerability in commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by adding org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS to the SubTypeValidator blocklist. This fix was already present in the upstream 2.17.3 release that TuxCare onboarded, confirmed by finding the fix commit as an ancestor of the first TuxCare commit (onboarding commit f1946ec0c814c033fe1a1f724d321fe5e121a3ad).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability affects versions before 2.9.10.8, and the target version (2.17.3) is far beyond that range. The upstream vendor (FasterXML) fixed this vulnerability in commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by adding org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS to the SubTypeValidator blocklist. This fix was already present in the upstream 2.17.3 release that TuxCare onboarded, confirmed by finding the fix commit as an ancestor of the first TuxCare commit (onboarding commit f1946ec0c814c033fe1a1f724d321fe5e121a3ad).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:11:33.363226+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5 due to deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The target (jackson-databind 2.17.3-tuxcare.4) is NOT vulnerable. The fix (commit 3ded28aece by upstream author Tatu Saloranta) was already present in the upstream release 2.17.3 when TuxCare onboarded it. The vulnerable pattern does not exist in this version because DriverAdapterCPDS and all related gadget class variants are blocked in SubTypeValidator's deny list.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "CVE-2020-36182 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5 due to deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The target (jackson-databind 2.17.3-tuxcare.4) is NOT vulnerable. The fix (commit 3ded28aece by upstream author Tatu Saloranta) was already present in the upstream release 2.17.3 when TuxCare onboarded it. The vulnerable pattern does not exist in this version because DriverAdapterCPDS and all related gadget class variants are blocked in SubTypeValidator's deny list.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:20:29.978023+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.17.3-tuxcare.4) is NOT affected by CVE-2020-36183. The vulnerability concerns the ability to deserialize the gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool for JNDI injection attacks. The fix that blocks this class was already present in the upstream jackson-databind 2.17.3 release, which TuxCare onboarded. The blocklist entry exists at line 243 of SubTypeValidator.java, added by upstream commit 12e23c962ff (authored by Tatu Saloranta on Dec 31, 2020). Since this fix shipped with the upstream release and was not a TuxCare backport, the verdict is not_affected with justification code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "The target repository (jackson-databind 2.17.3-tuxcare.4) is NOT affected by CVE-2020-36183. The vulnerability concerns the ability to deserialize the gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool for JNDI injection attacks. The fix that blocks this class was already present in the upstream jackson-databind 2.17.3 release, which TuxCare onboarded. The blocklist entry exists at line 243 of SubTypeValidator.java, added by upstream commit 12e23c962ff (authored by Tatu Saloranta on Dec 31, 2020). Since this fix shipped with the upstream release and was not a TuxCare backport, the verdict is not_affected with justification code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T12:24:19.585233+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability concerns deserialization gadgets org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 567194c53a by Tatu Saloranta, dated 2020-12-26) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.17.3 release that TuxCare onboarded (onboarding commit f1946ec0c81), confirmed by verifying the fix commit is an ancestor of the first TuxCare commit. The blocklist entries are present at lines 235-236 of SubTypeValidator.java in the current version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability concerns deserialization gadgets org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 567194c53a by Tatu Saloranta, dated 2020-12-26) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.17.3 release that TuxCare onboarded (onboarding commit f1946ec0c81), confirmed by verifying the fix commit is an ancestor of the first TuxCare commit. The blocklist entries are present at lines 235-236 of SubTypeValidator.java in the current version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T16:04:33.761797+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.17.3-tuxcare.4 is NOT affected by CVE-2020-36185. The vulnerability concerns missing blocklist entries for org.apache.tomcat.dbcp.dbcp2 deserialization gadget classes. The fix (commit 567194c53a, dated 2020-12-26) was already present in the upstream jackson-databind 2.17.3 release when TuxCare onboarded it on 2026-09-10. The dangerous classes org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource are already blocked in SubTypeValidator.java lines 234-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "The target jackson-databind version 2.17.3-tuxcare.4 is NOT affected by CVE-2020-36185. The vulnerability concerns missing blocklist entries for org.apache.tomcat.dbcp.dbcp2 deserialization gadget classes. The fix (commit 567194c53a, dated 2020-12-26) was already present in the upstream jackson-databind 2.17.3 release when TuxCare onboarded it on 2026-09-10. The dangerous classes org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource are already blocked in SubTypeValidator.java lines 234-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:29:38.548798+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 affects jackson-databind versions before 2.9.10.8. The target repository is version 2.17.3-tuxcare.4, which already contains the upstream fix. The vulnerability involved deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix (commit 3e8fa3beea by upstream author Tatu Saloranta on Dec 26, 2020) added these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was included in upstream release 2.9.10.8 and was already present in the 2.17.3 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "CVE-2020-36186 affects jackson-databind versions before 2.9.10.8. The target repository is version 2.17.3-tuxcare.4, which already contains the upstream fix. The vulnerability involved deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix (commit 3e8fa3beea by upstream author Tatu Saloranta on Dec 26, 2020) added these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was included in upstream release 2.9.10.8 and was already present in the 2.17.3 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:43:14.856496+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 affects jackson-databind versions before 2.9.10.8. The target version 2.17.3-tuxcare.4 already contains the upstream fix that was added by FasterXML in December 2020 (commit 3e8fa3beea). The fix blocks deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource by adding them to the SubTypeValidator blocklist. This fix was already present in the upstream 2.17.3 release when TuxCare onboarded it in September 2026, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "CVE-2020-36187 affects jackson-databind versions before 2.9.10.8. The target version 2.17.3-tuxcare.4 already contains the upstream fix that was added by FasterXML in December 2020 (commit 3e8fa3beea). The fix blocks deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource by adding them to the SubTypeValidator blocklist. This fix was already present in the upstream 2.17.3 release when TuxCare onboarded it in September 2026, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:50:08.266665+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.3-tuxcare.4 is not affected by CVE-2020-36188. The fix blocking deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource was authored by upstream maintainer Tatu Saloranta (commit 33d96c13fe1) and was already included in the upstream 2.17.3 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:223 and is actively enforced during deserialization via BeanDeserializerFactory._validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "The target jackson-databind 2.17.3-tuxcare.4 is not affected by CVE-2020-36188. The fix blocking deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource was authored by upstream maintainer Tatu Saloranta (commit 33d96c13fe1) and was already included in the upstream 2.17.3 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:223 and is actively enforced during deserialization via BeanDeserializerFactory._validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T12:59:16.129211+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 affects jackson-databind versions before 2.9.10.8, involving polymorphic deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db classes. The target version 2.17.3-tuxcare.4 is NOT vulnerable because the upstream fix was already present when TuxCare onboarded version 2.17.3. The two gadget classes (JNDIConnectionSource and DriverManagerConnectionSource) are present in the SubTypeValidator deny list at lines 223-224, preventing their deserialization. The fix was authored by Tatu Saloranta (upstream FasterXML maintainer) in commit 33d96c13, which predates the first TuxCare commit in this version's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 affects jackson-databind versions before 2.9.10.8, involving polymorphic deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db classes. The target version 2.17.3-tuxcare.4 is NOT vulnerable because the upstream fix was already present when TuxCare onboarded version 2.17.3. The two gadget classes (JNDIConnectionSource and DriverManagerConnectionSource) are present in the SubTypeValidator deny list at lines 223-224, preventing their deserialization. The fix was authored by Tatu Saloranta (upstream FasterXML maintainer) in commit 33d96c13, which predates the first TuxCare commit in this version's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:15:42.590601+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 (stack overflow via deeply nested JSON) is NOT present in jackson-databind 2.17.3-tuxcare.4. The upstream fix was already included in the 2.17.3 release before TuxCare onboarded it. The fix uses UntypedObjectDeserializerNR with iterative (non-recursive) deserialization and relies on jackson-core's StreamReadConstraints for depth enforcement, preventing stack overflow from deeply nested JSON.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "CVE-2020-36518 (stack overflow via deeply nested JSON) is NOT present in jackson-databind 2.17.3-tuxcare.4. The upstream fix was already included in the 2.17.3 release before TuxCare onboarded it. The fix uses UntypedObjectDeserializerNR with iterative (non-recursive) deserialization and relies on jackson-core's StreamReadConstraints for depth enforcement, preventing stack overflow from deeply nested JSON.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T16:09:26.959129+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 affects jackson-databind versions lacking blocklist entry for org.apache.xbean.propertyeditor.JndiConverter, which enables JNDI injection attacks via polymorphic deserialization. The target (jackson-databind 2.17.3-tuxcare.4) is NOT AFFECTED because the upstream fix (commit 914e7c9f2c by Tatu Saloranta) was already included in upstream release 2.17.3 before TuxCare onboarded it. The JndiConverter blocklist entry exists at SubTypeValidator.java:138 and is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 affects jackson-databind versions lacking blocklist entry for org.apache.xbean.propertyeditor.JndiConverter, which enables JNDI injection attacks via polymorphic deserialization. The target (jackson-databind 2.17.3-tuxcare.4) is NOT AFFECTED because the upstream fix (commit 914e7c9f2c by Tatu Saloranta) was already included in upstream release 2.17.3 before TuxCare onboarded it. The JndiConverter blocklist entry exists at SubTypeValidator.java:138 and is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind version 2.17.3-tuxcare.4) is not affected by CVE-2020-9546. The vulnerability involved deserialization of the dangerous gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, which could lead to arbitrary code execution via polymorphic type handling. The upstream vendor (FasterXML) fixed this in version 2.9.10.4 by adding this class to the SubTypeValidator blocklist. The target version 2.17.3 is significantly newer than 2.9.10.4 and includes this fix from the upstream release. The fix was authored by Tatu Saloranta (upstream maintainer, tatu.saloranta@iki.fi) in commit 1e64db6a2f, which was already present in upstream version 2.17.3 before TuxCare onboarded it in commit f1946ec0c8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "The target repository (jackson-databind version 2.17.3-tuxcare.4) is not affected by CVE-2020-9546. The vulnerability involved deserialization of the dangerous gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, which could lead to arbitrary code execution via polymorphic type handling. The upstream vendor (FasterXML) fixed this in version 2.9.10.4 by adding this class to the SubTypeValidator blocklist. The target version 2.17.3 is significantly newer than 2.9.10.4 and includes this fix from the upstream release. The fix was authored by Tatu Saloranta (upstream maintainer, tatu.saloranta@iki.fi) in commit 1e64db6a2f, which was already present in upstream version 2.17.3 before TuxCare onboarded it in commit f1946ec0c8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:38:44.459266+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4/2.8.11.6/2.7.9.7 due to unsafe deserialization of the gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The target repository (jackson-databind 2.17.3-tuxcare.4) is not affected because the fix was already present in the upstream 2.17.3 release. The fix adds `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` to the `DEFAULT_NO_DESER_CLASS_NAMES` blocklist in SubTypeValidator.java (line 144), preventing this gadget class from being deserialized. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 1e64db6a2f and shipped in the upstream release before TuxCare onboarded version 2.17.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4/2.8.11.6/2.7.9.7 due to unsafe deserialization of the gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The target repository (jackson-databind 2.17.3-tuxcare.4) is not affected because the fix was already present in the upstream 2.17.3 release. The fix adds `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` to the `DEFAULT_NO_DESER_CLASS_NAMES` blocklist in SubTypeValidator.java (line 144), preventing this gadget class from being deserialized. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 1e64db6a2f and shipped in the upstream release before TuxCare onboarded version 2.17.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T16:14:34.572852+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to deserialization gadget br.com.anteros.dbcp.AnterosDBCPConfig. The target (jackson-databind 2.17.3) is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability by adding AnterosDBCPConfig to the deserialization blocklist in SubTypeValidator.java. This fix was present in the upstream 2.17.3 release before TuxCare onboarded it. The blocklist entry at line 145 prevents instantiation of this gadget class during polymorphic deserialization, effectively blocking the attack chain from INPUT (JSON with type information) to GOAL (arbitrary code execution via gadget instantiation).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to deserialization gadget br.com.anteros.dbcp.AnterosDBCPConfig. The target (jackson-databind 2.17.3) is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability by adding AnterosDBCPConfig to the deserialization blocklist in SubTypeValidator.java. This fix was present in the upstream 2.17.3 release before TuxCare onboarded it. The blocklist entry at line 145 prevents instantiation of this gadget class during polymorphic deserialization, effectively blocking the attack chain from INPUT (JSON with type information) to GOAL (arbitrary code execution via gadget instantiation).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:11:26.566722+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 affects jackson-databind versions before 2.9.10.7, exploiting deserialization gadgets through polymorphic typing. The target version 2.17.3-tuxcare.4 is not affected because the upstream FasterXML release already contained the fix (commit 7dbf51bf78). All CVE-2021-20190 gadgets (javax.swing.JTextPane, various Spring/Apache/Oracle/ActiveMQ classes) are blocked in SubTypeValidator.java lines 149-214. The fix was authored by upstream maintainer tatu.saloranta@iki.fi and shipped in the 2.17.3 release that TuxCare onboarded (commit f1946ec0c8). The SubTypeValidator is actively enforced during deserialization via BeanDeserializerFactory line 1032.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 affects jackson-databind versions before 2.9.10.7, exploiting deserialization gadgets through polymorphic typing. The target version 2.17.3-tuxcare.4 is not affected because the upstream FasterXML release already contained the fix (commit 7dbf51bf78). All CVE-2021-20190 gadgets (javax.swing.JTextPane, various Spring/Apache/Oracle/ActiveMQ classes) are blocked in SubTypeValidator.java lines 149-214. The fix was authored by upstream maintainer tatu.saloranta@iki.fi and shipped in the 2.17.3 release that TuxCare onboarded (commit f1946ec0c8). The SubTypeValidator is actively enforced during deserialization via BeanDeserializerFactory line 1032.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.17.3 is NOT AFFECTED by CVE-2021-46877. The vulnerability (unbounded heap allocation during JsonNode JDK deserialization) was fixed in upstream commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by Tatu Saloranta, which was already present in the upstream 2.17.3 release that TuxCare onboarded. The fix limits eager allocation to 100KB and uses incremental ByteArrayBuilder-based allocation for larger declared lengths, preventing the DoS attack. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "Target version 2.17.3 is NOT AFFECTED by CVE-2021-46877. The vulnerability (unbounded heap allocation during JsonNode JDK deserialization) was fixed in upstream commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by Tatu Saloranta, which was already present in the upstream 2.17.3 release that TuxCare onboarded. The fix limits eager allocation to 100KB and uses incremental ByteArrayBuilder-based allocation for larger declared lengths, preventing the DoS attack. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T16:43:48.744845+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream commits cd090979b7 and d78d00ee7b, which were already included in the upstream 2.17.3 release that TuxCare onboarded. The fix adds checks in StdDeserializer primitive parsers and BeanDeserializer._deserializeFromArray() to reject payloads with more than one level of array wrapping. Both defense mechanisms are present and active in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "CVE-2022-42003 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream commits cd090979b7 and d78d00ee7b, which were already included in the upstream 2.17.3 release that TuxCare onboarded. The fix adds checks in StdDeserializer primitive parsers and BeanDeserializer._deserializeFromArray() to reject payloads with more than one level of array wrapping. Both defense mechanisms are present and active in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:57:36.079339+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta. This fix was already present in the upstream release 2.17.3 that TuxCare onboarded. The defense code is confirmed present in BeanDeserializer._deserializeFromArray (lines 642-650), which checks for a second START_ARRAY token and throws an exception before any recursive processing can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "CVE-2022-42004 is NOT present in jackson-databind 2.17.3-tuxcare.4. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta. This fix was already present in the upstream release 2.17.3 that TuxCare onboarded. The defense code is confirmed present in BeanDeserializer._deserializeFromArray (lines 642-650), which checks for a second START_ARRAY token and throws an exception before any recursive processing can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-28T01:07:55.976356+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-08T19:28:00.195688+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-02T20:16:25.026735+00:00", "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.17.3 is NOT AFFECTED by CVE-2026-50193. The vulnerability (StackOverflowError from deeply nested JsonNode serialization) was fixed in upstream version 2.14.0 via commit a1fa4ae4ec by Tatu Saloranta. The fix replaced recursive serialization with iterative serialization using an explicit IteratorStack. Since the target version 2.17.3 is newer than 2.14.0, the fix was...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50193" }, "impact_statement": "not_affected \u2014 The target jackson-databind 2.17.3 is NOT AFFECTED by CVE-2026-50193. The vulnerability (StackOverflowError from deeply nested JsonNode serialization) was fixed in upstream version 2.14.0 via commit a1fa4ae4ec by Tatu Saloranta. The fix replaced recursive serialization with iterative serialization using an explicit IteratorStack. Since the target version 2.17.3 is newer than 2.14.0, the fix was..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-08T19:28:00.195688+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-08T19:28:00.195688+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-08T19:28:00.195688+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-08T19:28:00.195688+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-05T11:24:30.529432+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.17.3-tuxcare.5.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.17.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-11-03T02:01:27.808430+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.17.3 is not affected by CVE-2026-54518. The vulnerability requires the `@JsonUnwrapped` annotation on creator parameters, a feature that was introduced in version 2.19.0 (issue #1467, commit 502fe888da). Version 2.17.3 explicitly rejects this combination with error \"Cannot define Creator parameter %d as `@JsonUnwrapped`: combination not yet supported\" (BasicDeserializerFactory.java li...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Version 2.17.3 is not affected by CVE-2026-54518. The vulnerability requires the `@JsonUnwrapped` annotation on creator parameters, a feature that was introduced in version 2.19.0 (issue #1467, commit 502fe888da). Version 2.17.3 explicitly rejects this combination with error \"Cannot define Creator parameter %d as `@JsonUnwrapped`: combination not yet supported\" (BasicDeserializerFactory.java li..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-08T19:28:00.195688+00:00", "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59888" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-08T19:28:00.195688+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-08T19:28:00.195688+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-08T19:28:00.195688+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-08T19:28:00.195688+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-08T19:28:00.195688+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-08T19:28:00.195688+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-08T19:28:00.195688+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.17.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3-tuxcare.3" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.17.3-tuxcare.3.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }