{ "@id": "urn:uuid:efb2e91f-0656-4cb5-b25e-512166fcf768", "role": "Document Creator", "author": "https://tuxcare.com", "version": 67, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:17:00.447062+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T13:13:11.896857+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind 2.18.0-tuxcare.3. The vulnerability concerns unsafe deserialization allowing arbitrary code execution via malicious class names. The fix (blacklisting dangerous classes like JdbcRowSetImpl, FileHandler, UnicastRemoteObject, and others from databind#1680 and #1737) was already present in the upstream jackson-databind 2.18.0 release that TuxCare onboarded. The SubTypeValidator class at HEAD contains the complete DEFAULT_NO_DESER_CLASS_NAMES blacklist and actively validates all bean deserializations, blocking the attack vector. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in 2017, predating TuxCare's involvement. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 is not present in jackson-databind 2.18.0-tuxcare.3. The vulnerability concerns unsafe deserialization allowing arbitrary code execution via malicious class names. The fix (blacklisting dangerous classes like JdbcRowSetImpl, FileHandler, UnicastRemoteObject, and others from databind#1680 and #1737) was already present in the upstream jackson-databind 2.18.0 release that TuxCare onboarded. The SubTypeValidator class at HEAD contains the complete DEFAULT_NO_DESER_CLASS_NAMES blacklist and actively validates all bean deserializations, blocking the attack vector. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in 2017, predating TuxCare's involvement. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T15:47:06.064229+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target is jackson-databind 2.18.0-tuxcare.3, which contains the upstream fix that introduced SubTypeValidator with comprehensive blacklist validation and Spring framework superclass checks. The fix (commit 2235894210c75f624a3d0cd60bfb0434a20a18bf) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.18.0 release, prior to TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target is jackson-databind 2.18.0-tuxcare.3, which contains the upstream fix that introduced SubTypeValidator with comprehensive blacklist validation and Spring framework superclass checks. The fix (commit 2235894210c75f624a3d0cd60bfb0434a20a18bf) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.18.0 release, prior to TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T14:31:59.864465+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.0-tuxcare.3) is not affected by CVE-2017-7525. This deserialization vulnerability, which allowed remote code execution via instantiation of dangerous Java gadget classes (TemplatesImpl, InvokerTransformer, etc.), was fixed in upstream versions 2.6.7.1, 2.7.9.1, and 2.8.9 by introducing the SubTypeValidator defense mechanism. Version 2.18.0 already contains this comprehensive fix, which was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded the version. The SubTypeValidator maintains an immutable blacklist of dangerous classes and blocks their deserialization before bean instantiation occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "The target repository (jackson-databind 2.18.0-tuxcare.3) is not affected by CVE-2017-7525. This deserialization vulnerability, which allowed remote code execution via instantiation of dangerous Java gadget classes (TemplatesImpl, InvokerTransformer, etc.), was fixed in upstream versions 2.6.7.1, 2.7.9.1, and 2.8.9 by introducing the SubTypeValidator defense mechanism. Version 2.18.0 already contains this comprehensive fix, which was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded the version. The SubTypeValidator maintains an immutable blacklist of dangerous classes and blocks their deserialization before bean instantiation occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T13:23:14.873847+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind versions 2.0.0 through 2.9.5, where default typing allows instantiation of the iBatis gadget class org.apache.ibatis.parsing.XPathParser for data exfiltration. The target repository (jackson-databind 2.18.0-tuxcare.3) is not affected because the fix was already present in the upstream 2.18.0 release. The vulnerable class org.apache.ibatis.parsing.XPathParser is blacklisted in SubTypeValidator.java at line 65, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 affects jackson-databind versions 2.0.0 through 2.9.5, where default typing allows instantiation of the iBatis gadget class org.apache.ibatis.parsing.XPathParser for data exfiltration. The target repository (jackson-databind 2.18.0-tuxcare.3) is not affected because the fix was already present in the upstream 2.18.0 release. The vulnerable class org.apache.ibatis.parsing.XPathParser is blacklisted in SubTypeValidator.java at line 65, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6 when Default Typing is enabled and the Jodd-db library is in the classpath. The vulnerability allows remote code execution via deserialization of the jodd.db.connection.DataSourceConnectionProvider class which can trigger JNDI/LDAP lookups. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED because the upstream vendor's fix (commit 28badf7ef6) that blacklists this dangerous class was already included in the upstream release 2.18.0 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6 when Default Typing is enabled and the Jodd-db library is in the classpath. The vulnerability allows remote code execution via deserialization of the jodd.db.connection.DataSourceConnectionProvider class which can trigger JNDI/LDAP lookups. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED because the upstream vendor's fix (commit 28badf7ef6) that blacklists this dangerous class was already included in the upstream release 2.18.0 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T16:23:34.424796+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.18.0-tuxcare.3. The vulnerability allowed arbitrary code execution via polymorphic deserialization of Oracle JDBC classes when Default Typing was enabled. The upstream vendor (FasterXML) fixed this in 2018 by adding oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet to the SubTypeValidator blacklist. This fix was already present in upstream version 2.18.0 before TuxCare onboarded it, as confirmed by commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a authored by tatu.saloranta@iki.fi being an ancestor of the first TuxCare commit 18ffcba6408ac903129deff3d09bbc762b56a063.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.18.0-tuxcare.3. The vulnerability allowed arbitrary code execution via polymorphic deserialization of Oracle JDBC classes when Default Typing was enabled. The upstream vendor (FasterXML) fixed this in 2018 by adding oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet to the SubTypeValidator blacklist. This fix was already present in upstream version 2.18.0 before TuxCare onboarded it, as confirmed by commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a authored by tatu.saloranta@iki.fi being an ancestor of the first TuxCare commit 18ffcba6408ac903129deff3d09bbc762b56a063.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T14:00:42.857553+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED by CVE-2018-14718. The vulnerability involves polymorphic deserialization of dangerous classes, specifically org.slf4j.ext.EventData, which could allow remote code execution. The upstream fix (commit 87d29af25e by Tatu Saloranta) adds org.slf4j.ext.EventData and related classes to a blocklist that prevents their deserialization. This fix was already present in the upstream 2.18.0 release that TuxCare onboarded, so the vulnerable pattern does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED by CVE-2018-14718. The vulnerability involves polymorphic deserialization of dangerous classes, specifically org.slf4j.ext.EventData, which could allow remote code execution. The upstream fix (commit 87d29af25e by Tatu Saloranta) adds org.slf4j.ext.EventData and related classes to a blocklist that prevents their deserialization. This fix was already present in the upstream 2.18.0 release that TuxCare onboarded, so the vulnerable pattern does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T16:03:43.787457+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 does not affect jackson-databind 2.18.0. The vulnerability involves polymorphic deserialization of dangerous classes from BlazeDS (flex.messaging.*), slf4j, and other libraries. The upstream vendor (FasterXML) fixed this in commit 87d29af by adding these classes to a blocklist in SubTypeValidator. This fix was already present in the upstream 2.18.0 release that TuxCare onboarded, so the target has never been vulnerable to this specific CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 does not affect jackson-databind 2.18.0. The vulnerability involves polymorphic deserialization of dangerous classes from BlazeDS (flex.messaging.*), slf4j, and other libraries. The upstream vendor (FasterXML) fixed this in commit 87d29af by adding these classes to a blocklist in SubTypeValidator. This fix was already present in the upstream 2.18.0 release that TuxCare onboarded, so the target has never been vulnerable to this specific CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T14:10:01.555768+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.18.0-tuxcare.3. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that enable XXE attacks via polymorphic deserialization are already blacklisted in SubTypeValidator.java lines 74-78. This fix was included in the upstream 2.18.0 release via commit 87d29af25e82a249ea15858e2d4ecbf64091db44 authored by upstream maintainer Tatu Saloranta, before TuxCare's onboarding of version 2.18.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.18.0-tuxcare.3. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that enable XXE attacks via polymorphic deserialization are already blacklisted in SubTypeValidator.java lines 74-78. This fix was included in the upstream 2.18.0 release via commit 87d29af25e82a249ea15858e2d4ecbf64091db44 authored by upstream maintainer Tatu Saloranta, before TuxCare's onboarding of version 2.18.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T14:40:54.716958+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is not present in jackson-databind 2.18.0. The fix (blocklist entry for org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e (2018-08-16) and shipped in the upstream 2.18.0 release. The blocklist entry exists in SubTypeValidator.java:78 and is enforced during polymorphic deserialization via BeanDeserializerFactory:141, throwing \"Illegal type to deserialize: prevented for security reasons\" if the blocked class is encountered. Architecture evolved between 2.6.7.2 (when the patch was created) and 2.18.0 - the blocklist moved from BeanDeserializerFactory to SubTypeValidator class, but the defense logic is semantically equivalent and functional.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 is not present in jackson-databind 2.18.0. The fix (blocklist entry for org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e (2018-08-16) and shipped in the upstream 2.18.0 release. The blocklist entry exists in SubTypeValidator.java:78 and is enforced during polymorphic deserialization via BeanDeserializerFactory:141, throwing \"Illegal type to deserialize: prevented for security reasons\" if the blocked class is encountered. Architecture evolved between 2.6.7.2 (when the patch was created) and 2.18.0 - the blocklist moved from BeanDeserializerFactory to SubTypeValidator class, but the defense logic is semantically equivalent and functional.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T12:55:53.618169+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. The target version (2.18.0-tuxcare.3) is not affected because the upstream vendor (FasterXML) fixed this vulnerability in commit 72cd4025a2 (2018-11-19), which was already present in version 2.18.0 when TuxCare onboarded it (2026-09-21). The blocklist entry exists at SubTypeValidator.java:85, preventing deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. The target version (2.18.0-tuxcare.3) is not affected because the upstream vendor (FasterXML) fixed this vulnerability in commit 72cd4025a2 (2018-11-19), which was already present in version 2.18.0 when TuxCare onboarded it (2026-09-21). The blocklist entry exists at SubTypeValidator.java:85, preventing deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T17:00:37.380050+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is a polymorphic deserialization vulnerability in jackson-databind affecting versions before 2.9.8. The vulnerability allows attackers to achieve unspecified impact by leveraging failure to block openjpa classes from polymorphic deserialization. The fix adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED because this fix was already present in the upstream release (version 2.18.0) that TuxCare onboarded. The vulnerable code pattern has never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 is a polymorphic deserialization vulnerability in jackson-databind affecting versions before 2.9.8. The vulnerability allows attackers to achieve unspecified impact by leveraging failure to block openjpa classes from polymorphic deserialization. The fix adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED because this fix was already present in the upstream release (version 2.18.0) that TuxCare onboarded. The vulnerable code pattern has never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T15:27:45.237635+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind versions before 2.9.8 by allowing polymorphic deserialization of org.jboss.util.propertyeditor.DocumentEditor, a dangerous gadget class from jboss-common-core. The target version 2.18.0 is NOT vulnerable because the fix was already present in the upstream release that TuxCare onboarded. The upstream vendor (FasterXML) added DocumentEditor and three other classes to the deserialization blocklist in commit 72cd4025a2 (Fix #2186), which was included in jackson-databind 2.10.0 and all subsequent releases. The blocklist check at SubTypeValidator.java lines 81-85 prevents instantiation of these classes during polymorphic deserialization, blocking the attack chain before the Goal (arbitrary code execution via malicious gadget) can be reached.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 affects jackson-databind versions before 2.9.8 by allowing polymorphic deserialization of org.jboss.util.propertyeditor.DocumentEditor, a dangerous gadget class from jboss-common-core. The target version 2.18.0 is NOT vulnerable because the fix was already present in the upstream release that TuxCare onboarded. The upstream vendor (FasterXML) added DocumentEditor and three other classes to the deserialization blocklist in commit 72cd4025a2 (Fix #2186), which was included in jackson-databind 2.10.0 and all subsequent releases. The blocklist check at SubTypeValidator.java lines 81-85 prevents instantiation of these classes during polymorphic deserialization, blocking the attack chain before the Goal (arbitrary code execution via malicious gadget) can be reached.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through version 2.9.3, exploiting two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) for remote code execution via deserialization. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.18.0 when TuxCare onboarded it. The fix adds both gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 62-63), preventing their deserialization. The fix was authored by Tatu Saloranta (FasterXML upstream maintainer) in commit 038b471e2e and shipped in the upstream 2.18.0 release, predating TuxCare's onboarding commit (18ffcba6408).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 affects jackson-databind through version 2.9.3, exploiting two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) for remote code execution via deserialization. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.18.0 when TuxCare onboarded it. The fix adds both gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 62-63), preventing their deserialization. The fix was authored by Tatu Saloranta (FasterXML upstream maintainer) in commit 038b471e2e and shipped in the upstream 2.18.0 release, predating TuxCare's onboarding commit (18ffcba6408).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T13:59:38.365541+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.0 is not affected by CVE-2018-7489. The c3p0 deserialization blocking logic from the upstream fix (commit 6799f8f10c, February 2018) is present in SubTypeValidator.java. This fix was already included in the upstream 2.18.0 release before TuxCare onboarding. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "Target jackson-databind 2.18.0 is not affected by CVE-2018-7489. The c3p0 deserialization blocking logic from the upstream fix (commit 6799f8f10c, February 2018) is present in SubTypeValidator.java. This fix was already included in the upstream 2.18.0 release before TuxCare onboarding. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T16:36:34.248507+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is not present in jackson-databind 2.18.0. The vulnerability required the absence of validation for com.mysql.cj.jdbc.admin.MiniAdmin during polymorphic deserialization. The target already contains the upstream fix (commit dda513bd7251b4f32b7b60b1c13740e3b5a43024) which adds MiniAdmin to the blacklist in SubTypeValidator.java at line 88. This fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and shipped in the upstream 2.18.0 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 is not present in jackson-databind 2.18.0. The vulnerability required the absence of validation for com.mysql.cj.jdbc.admin.MiniAdmin during polymorphic deserialization. The target already contains the upstream fix (commit dda513bd7251b4f32b7b60b1c13740e3b5a43024) which adds MiniAdmin to the blacklist in SubTypeValidator.java at line 88. This fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and shipped in the upstream 2.18.0 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T18:45:01.824935+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to missing blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource in polymorphic deserialization. The target version 2.18.0-tuxcare.3 already contains the upstream fix at SubTypeValidator.java:91. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.18.0 release that TuxCare...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to missing blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource in polymorphic deserialization. The target version 2.18.0-tuxcare.3 already contains the upstream fix at SubTypeValidator.java:91. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.18.0 release that TuxCare..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-02T07:25:00.155484+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.18.0-tuxcare.3. The vulnerability affects jackson-databind 2.x through 2.9.9, allowing arbitrary file reads via JDOM XSLTransformer deserialization. The upstream fix (commit 5f7c69bba0) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to SubTypeValidator's blocklist, preventing their deserialization. This fix is p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.18.0-tuxcare.3. The vulnerability affects jackson-databind 2.x through 2.9.9, allowing arbitrary file reads via JDOM XSLTransformer deserialization. The upstream fix (commit 5f7c69bba0) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to SubTypeValidator's blocklist, preventing their deserialization. This fix is p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T12:16:16.415526+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is not present in jackson-databind 2.18.0. The vulnerability required the absence of `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` in the SubTypeValidator blacklist, allowing unsafe deserialization. The fix (commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b) was applied by upstream author Tatu Saloranta on 2019-07-25 and shipped in the upstream 2.18.0 release that TuxCare onboarded. The dangerous class is blacklisted at SubTypeValidator.java lines 97-98, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is not present in jackson-databind 2.18.0. The vulnerability required the absence of `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` in the SubTypeValidator blacklist, allowing unsafe deserialization. The fix (commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b) was applied by upstream author Tatu Saloranta on 2019-07-25 and shipped in the upstream 2.18.0 release that TuxCare onboarded. The dangerous class is blacklisted at SubTypeValidator.java lines 97-98, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T13:40:32.377029+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2. The target version 2.18.0-tuxcare.3 is not affected because the fix was already present in the upstream 2.18.0 release. The vulnerability involved polymorphic typing deserialization of the dangerous class `ch.qos.logback.core.db.JNDIConnectionSource` which could enable JNDI injection attacks. The upstream fix added this class to the deny-list in SubTypeValidator. Analysis confirms the deny-list entry is present at line 102 of SubTypeValidator.java and is enforced by the validateSubType method. The fix commit (ad418eeb974) by upstream maintainer Tatu Saloranta from July 2019 is an ancestor of TuxCare's onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2. The target version 2.18.0-tuxcare.3 is not affected because the fix was already present in the upstream 2.18.0 release. The vulnerability involved polymorphic typing deserialization of the dangerous class `ch.qos.logback.core.db.JNDIConnectionSource` which could enable JNDI injection attacks. The upstream fix added this class to the deny-list in SubTypeValidator. Analysis confirms the deny-list entry is present at line 102 of SubTypeValidator.java and is enforced by the validateSubType method. The fix commit (ad418eeb974) by upstream maintainer Tatu Saloranta from July 2019 is an ancestor of TuxCare's onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T16:50:26.784780+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is a polymorphic typing vulnerability in jackson-databind related to com.zaxxer.hikari.HikariConfig and HikariDataSource. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.18.0 when TuxCare onboarded it. The fix adds both HikariConfig and HikariDataSource to the deserialization blocklist in SubTypeValidator.java (lines 105, 107), preventing the exploit. The fix was authored by upstream maintainer Tatu Saloranta in commits d4983c740fec and 73c1c2cc76e6, which predated TuxCare's onboarding commit 18ffcba6408a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 is a polymorphic typing vulnerability in jackson-databind related to com.zaxxer.hikari.HikariConfig and HikariDataSource. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.18.0 when TuxCare onboarded it. The fix adds both HikariConfig and HikariDataSource to the deserialization blocklist in SubTypeValidator.java (lines 105, 107), preventing the exploit. The fix was authored by upstream maintainer Tatu Saloranta in commits d4983c740fec and 73c1c2cc76e6, which predated TuxCare's onboarding commit 18ffcba6408a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T15:58:58.868131+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to polymorphic deserialization of malicious objects using commons-configuration JNDI classes. The target version 2.18.0 contains the upstream fix (commit 41b7f9b9) that adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.0 release that TuxCare onboarded, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to polymorphic deserialization of malicious objects using commons-configuration JNDI classes. The target version 2.18.0 contains the upstream fix (commit 41b7f9b9) that adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.0 release that TuxCare onboarded, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0, allowing polymorphic deserialization of the xalan JNDI gadget class org.apache.xalan.lib.sql.JNDIConnectionPool to achieve RCE. The target version 2.18.0 already contains the upstream fix (commit 998efd7082) that adds this class to the SubTypeValidator blocklist. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the 2.18.0 upstream release before TuxCare's onboarding. The blocklist check is enforced during bean deserializer creation (BeanDeserializerFactory.java:141), blocking instantiation of the gadget class and preventing the attack chain from Input (JSON type metadata) to Goal (JNDI gadget instantiation enabling RCE).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0, allowing polymorphic deserialization of the xalan JNDI gadget class org.apache.xalan.lib.sql.JNDIConnectionPool to achieve RCE. The target version 2.18.0 already contains the upstream fix (commit 998efd7082) that adds this class to the SubTypeValidator blocklist. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the 2.18.0 upstream release before TuxCare's onboarding. The blocklist check is enforced during bean deserializer creation (BeanDeserializerFactory.java:141), blocking instantiation of the gadget class and preventing the attack chain from Input (JSON type metadata) to Goal (JNDI gadget instantiation enabling RCE).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T17:08:31.778572+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is not present in jackson-databind 2.18.0-tuxcare.3. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, but this class is already blocklisted in SubTypeValidator.java (line 107). The fix was added by upstream commit 73c1c2cc76 (authored by Tatu Saloranta) and was already present in the upstream 2.18.0 release before TuxCare onboarding. The blocklist prevents HikariDataSource from being instantiated during polymorphic type resolution, blocking the attack chain from malicious JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 is not present in jackson-databind 2.18.0-tuxcare.3. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, but this class is already blocklisted in SubTypeValidator.java (line 107). The fix was added by upstream commit 73c1c2cc76 (authored by Tatu Saloranta) and was already present in the upstream 2.18.0 release before TuxCare onboarding. The blocklist prevents HikariDataSource from being instantiated during polymorphic type resolution, blocking the attack chain from malicious JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T15:09:27.722120+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.18.0. The vulnerable classes org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource are blocklisted in SubTypeValidator.java (lines 124-125). This fix shipped with upstream release 2.18.0, predating TuxCare's onboarding of this version. The target version (2.18.0) is newer than the CVE's affected range (2.0.0-2.9.10).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.18.0. The vulnerable classes org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource are blocklisted in SubTypeValidator.java (lines 124-125). This fix shipped with upstream release 2.18.0, predating TuxCare's onboarding of this version. The target version (2.18.0) is newer than the CVE's affected range (2.0.0-2.9.10).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T17:18:37.716688+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.0-tuxcare.3 is NOT affected by CVE-2019-16943. The vulnerability involves unsafe deserialization of com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes when polymorphic typing is enabled. The upstream fix (commit 9593e16cf5, issue #2478) adds these dangerous gadget classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in upstream version 2.18.0 when TuxCare onboarded it, making the target safe from this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "The target jackson-databind 2.18.0-tuxcare.3 is NOT affected by CVE-2019-16943. The vulnerability involves unsafe deserialization of com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes when polymorphic typing is enabled. The upstream fix (commit 9593e16cf5, issue #2478) adds these dangerous gadget classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in upstream version 2.18.0 when TuxCare onboarded it, making the target safe from this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T15:30:53.892571+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to polymorphic deserialization of net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT affected because the fix was already present in the upstream 2.18.0 release that TuxCare onboarded. The dangerous class is blacklisted in SubTypeValidator.java line 99, preventing its instantiation during polymorphic deserialization. Fix commit 191a4cdf87 was authored by upstream maintainer Tatu Saloranta and predates TuxCare's onboarding commit 18ffcba640.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to polymorphic deserialization of net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT affected because the fix was already present in the upstream 2.18.0 release that TuxCare onboarded. The dangerous class is blacklisted in SubTypeValidator.java line 99, preventing its instantiation during polymorphic deserialization. Fix commit 191a4cdf87 was authored by upstream maintainer Tatu Saloranta and predates TuxCare's onboarding commit 18ffcba640.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T14:50:17.320852+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3 when Default Typing is enabled and apache-log4j-extra (1.2.x) is in the classpath. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT vulnerable because the upstream fix is present. The vendor patch adds two log4j-extras classes (DriverManagerConnectionSource and JNDIConnectionSource) to a deserialization blocklist in SubTypeValidator.java. This fix was authored by Tatu Saloranta (upstream Jackson maintainer) in commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 and shipped in the upstream 2.18.0 release that TuxCare onboarded. The blocklist is enforced in the validateSubType method, which throws an error when attempting to deserialize blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3 when Default Typing is enabled and apache-log4j-extra (1.2.x) is in the classpath. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT vulnerable because the upstream fix is present. The vendor patch adds two log4j-extras classes (DriverManagerConnectionSource and JNDIConnectionSource) to a deserialization blocklist in SubTypeValidator.java. This fix was authored by Tatu Saloranta (upstream Jackson maintainer) in commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 and shipped in the upstream 2.18.0 release that TuxCare onboarded. The blocklist is enforced in the validateSubType method, which throws an error when attempting to deserialize blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is not present in jackson-databind 2.18.0-tuxcare.3. The vulnerability concerns missing blocklist entries for net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector classes that could enable JNDI injection attacks via polymorphic deserialization. The fix was already present in the upstream jackson-databind 2.18.0 release when TuxCare onboarded it. The two ehcache classes are properly blocked in SubTypeValidator.java lines 133-135, added by upstream commit fc4214a883dc087070f25da738ef0d49c2f3387e by Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 is not present in jackson-databind 2.18.0-tuxcare.3. The vulnerability concerns missing blocklist entries for net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector classes that could enable JNDI injection attacks via polymorphic deserialization. The fix was already present in the upstream jackson-databind 2.18.0 release when TuxCare onboarded it. The two ehcache classes are properly blocked in SubTypeValidator.java lines 133-135, added by upstream commit fc4214a883dc087070f25da738ef0d49c2f3387e by Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T17:07:24.314148+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind versions before 2.9.10.4. The target version 2.18.0 already contains the upstream fix that was applied in March 2020 (commit a424c038ba). The fix adds three JNDI-related gadget classes to the deserialization blacklist in SubTypeValidator.java (lines 157-160): org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This fix was already included in the upstream 2.18.0 release (September 2024) when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 affects jackson-databind versions before 2.9.10.4. The target version 2.18.0 already contains the upstream fix that was applied in March 2020 (commit a424c038ba). The fix adds three JNDI-related gadget classes to the deserialization blacklist in SubTypeValidator.java (lines 157-160): org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This fix was already included in the upstream 2.18.0 release (September 2024) when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.0-tuxcare.3 is not affected by CVE-2020-10672. The vulnerability involved deserialization gadgets in org.apache.aries.transaction.jms classes that could enable remote code execution through Jackson's polymorphic type handling. The fix, which adds these classes to a blocklist in SubTypeValidator.java, was already present in the upstream jackson-databind 2.18.0 release (authored by upstream maintainer Tatu Saloranta, tatu.saloranta@iki.fi in commit 592872f423). This upstream release was then onboarded by TuxCare. The blocklist entries on lines 163-164 of SubTypeValidator.java prevent deserialization of the dangerous classes, and the validation is actively enforced via BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "The target jackson-databind version 2.18.0-tuxcare.3 is not affected by CVE-2020-10672. The vulnerability involved deserialization gadgets in org.apache.aries.transaction.jms classes that could enable remote code execution through Jackson's polymorphic type handling. The fix, which adds these classes to a blocklist in SubTypeValidator.java, was already present in the upstream jackson-databind 2.18.0 release (authored by upstream maintainer Tatu Saloranta, tatu.saloranta@iki.fi in commit 592872f423). This upstream release was then onboarded by TuxCare. The blocklist entries on lines 163-164 of SubTypeValidator.java prevent deserialization of the dangerous classes, and the validation is actively enforced via BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T16:31:30.745035+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.18.0. The vulnerability involves deserialization of the malicious gadget class com.caucho.config.types.ResourceRef. The upstream fix (commit 1645efbd39, authored by Tatu Saloranta on 2020-03-17) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream jackson-databind 2.18.0 when TuxCare onboarded it (commit 18ffcba640 by amoniatovskiy@cloudlinux.com). The defense code exists at line 167 of SubTypeValidator.java and is actively enforced by BeanDeserializerFactory during polymorphic deserialization. The vulnerable code pattern is not present because the upstream vendor's fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.18.0. The vulnerability involves deserialization of the malicious gadget class com.caucho.config.types.ResourceRef. The upstream fix (commit 1645efbd39, authored by Tatu Saloranta on 2020-03-17) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream jackson-databind 2.18.0 when TuxCare onboarded it (commit 18ffcba640 by amoniatovskiy@cloudlinux.com). The defense code exists at line 167 of SubTypeValidator.java and is actively enforced by BeanDeserializerFactory during polymorphic deserialization. The vulnerable code pattern is not present because the upstream vendor's fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 concerns a deserialization gadget vulnerability in jackson-databind related to org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED because the fix was already included in the upstream jackson-databind 2.18.0 release that TuxCare onboarded. The vulnerable pattern (missing blocklist entry) is not present. The fix commit (05d7e0e1) authored by upstream maintainer Tatu Saloranta predates TuxCare's onboarding commit (18ffcba6) and added both org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider to the SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 concerns a deserialization gadget vulnerability in jackson-databind related to org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED because the fix was already included in the upstream jackson-databind 2.18.0 release that TuxCare onboarded. The vulnerable pattern (missing blocklist entry) is not present. The fix commit (05d7e0e1) authored by upstream maintainer Tatu Saloranta predates TuxCare's onboarding commit (18ffcba6) and added both org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider to the SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.18.0 is not affected by CVE-2020-10969. The vulnerability involves deserialization of javax.swing.JEditorPane as a gadget for arbitrary code execution. The fix (adding JEditorPane to the SubTypeValidator blocklist) was already present in upstream jackson-databind version 2.9.10.4 (released March 2020) and is included in version 2.18.0. The fix commit (4d038c9de0a by upstream maintainer Tatu Saloranta) predates TuxCare's onboarding of version 2.18.0, confirming this is an upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "Target version 2.18.0 is not affected by CVE-2020-10969. The vulnerability involves deserialization of javax.swing.JEditorPane as a gadget for arbitrary code execution. The fix (adding JEditorPane to the SubTypeValidator blocklist) was already present in upstream jackson-databind version 2.9.10.4 (released March 2020) and is included in version 2.18.0. The fix commit (4d038c9de0a by upstream maintainer Tatu Saloranta) predates TuxCare's onboarding of version 2.18.0, confirming this is an upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.activemq.* classes. The target repository (version 2.18.0) is NOT AFFECTED because the upstream fix was already present in the base release before TuxCare onboarded it. The fix adds org.apache.activemq.* class names to the SubTypeValidator blocklist, preventing their deserialization during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.activemq.* classes. The target repository (version 2.18.0) is NOT AFFECTED because the upstream fix was already present in the base release before TuxCare onboarded it. The fix adds org.apache.activemq.* class names to the SubTypeValidator blocklist, preventing their deserialization during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.0-tuxcare.3 is NOT AFFECTED by CVE-2020-11112. The vulnerability pattern (ability to deserialize the org.apache.commons.proxy.provider.remoting.RmiProvider gadget class) is not present because an upstream fix was already included in the release. The blacklist entry blocking this gadget class is present at line 186 of SubTypeValidator.java. The fix was authored by Tatu Saloranta (jackson-databind maintainer) in March 2020 and shipped with the upstream release before TuxCare onboarded version 2.18.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "The target jackson-databind version 2.18.0-tuxcare.3 is NOT AFFECTED by CVE-2020-11112. The vulnerability pattern (ability to deserialize the org.apache.commons.proxy.provider.remoting.RmiProvider gadget class) is not present because an upstream fix was already included in the release. The blacklist entry blocking this gadget class is present at line 186 of SubTypeValidator.java. The fix was authored by Tatu Saloranta (jackson-databind maintainer) in March 2020 and shipped with the upstream release before TuxCare onboarded version 2.18.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.openjpa.ee.WASRegistryManagedRuntime. The target version 2.18.0-tuxcare.3 is NOT affected because the upstream fix (adding WASRegistryManagedRuntime to the deserialization blacklist) was already included in the upstream release when TuxCare onboarded version 2.18.0. The fix was authored by Tatu Saloranta (upstream Jackson maintainer) in commit e2ba12d5d60 on March 28, 2020, as part of jackson-databind 2.9.10.4. The blacklist entry is present at SubTypeValidator.java:84 and properly enforced by the validateSubType method, which throws JsonMappingException for blacklisted classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.openjpa.ee.WASRegistryManagedRuntime. The target version 2.18.0-tuxcare.3 is NOT affected because the upstream fix (adding WASRegistryManagedRuntime to the deserialization blacklist) was already included in the upstream release when TuxCare onboarded version 2.18.0. The fix was authored by Tatu Saloranta (upstream Jackson maintainer) in commit e2ba12d5d60 on March 28, 2020, as part of jackson-databind 2.9.10.4. The blacklist entry is present at SubTypeValidator.java:84 and properly enforced by the validateSubType method, which throws JsonMappingException for blacklisted classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is NOT present in jackson-databind 2.18.0. The fix that blocks deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean was already present in the upstream release 2.18.0 that TuxCare onboarded. The blocklist entries exist in SubTypeValidator.java at lines 53-54, preventing exploitation of these serialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 is NOT present in jackson-databind 2.18.0. The fix that blocks deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean was already present in the upstream release 2.18.0 that TuxCare onboarded. The blocklist entries exist in SubTypeValidator.java at lines 53-54, preventing exploitation of these serialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is NOT present in jackson-databind 2.18.0. The vulnerability concerns deserialization of the gadget class org.apache.commons.jelly.impl.Embedded. The fix (adding this class to SubTypeValidator's blacklist) was included in upstream release 2.9.10.4 and is present in version 2.18.0 at line 189 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.18.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 is NOT present in jackson-databind 2.18.0. The vulnerability concerns deserialization of the gadget class org.apache.commons.jelly.impl.Embedded. The fix (adding this class to SubTypeValidator's blacklist) was included in upstream release 2.9.10.4 and is present in version 2.18.0 at line 189 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.18.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5. The target is version 2.18.0, which already contains the upstream fix that blacklists the vulnerable class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The fix was added by upstream maintainer Tatu Saloranta in commit d1c67a0396e (April 2020) and was present in the 2.18.0 release that TuxCare onboarded. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5. The target is version 2.18.0, which already contains the upstream fix that blacklists the vulnerable class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The fix was added by upstream maintainer Tatu Saloranta in commit d1c67a0396e (April 2020) and was present in the 2.18.0 release that TuxCare onboarded. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.0 is NOT AFFECTED by CVE-2020-14061. The vulnerability involves deserialization gadgets using five Oracle JMS classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The upstream fix added these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 5c8642aeae and shipped in the upstream release before TuxCare onboarded version 2.18.0. All five classes are present in the blocklist at lines 200-204 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "Target jackson-databind 2.18.0 is NOT AFFECTED by CVE-2020-14061. The vulnerability involves deserialization gadgets using five Oracle JMS classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The upstream fix added these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 5c8642aeae and shipped in the upstream release before TuxCare onboarded version 2.18.0. All five classes are present in the blocklist at lines 200-204 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.0-tuxcare.3 is NOT affected by CVE-2020-14062. The vulnerability relates to deserialization of com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool, which could lead to arbitrary code execution. The fix (blacklisting this class in SubTypeValidator.java line 119) was already present in the upstream 2.18.0 release when TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 840eae2ca81c597a0010b2126f32dce17d384b70 on May 1, 2020, which is an ancestor of the TuxCare onboarding commit. Since the CVE affects \"jackson-databind 2.x before 2.9.10.5\" and version 2.18.0 is much newer, the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "The target jackson-databind 2.18.0-tuxcare.3 is NOT affected by CVE-2020-14062. The vulnerability relates to deserialization of com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool, which could lead to arbitrary code execution. The fix (blacklisting this class in SubTypeValidator.java line 119) was already present in the upstream 2.18.0 release when TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 840eae2ca81c597a0010b2126f32dce17d384b70 on May 1, 2020, which is an ancestor of the TuxCare onboarding commit. Since the CVE affects \"jackson-databind 2.x before 2.9.10.5\" and version 2.18.0 is much newer, the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget (org.jsecurity.realm.jndi.JndiRealmFactory) that enables JNDI injection attacks. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.18.0 before TuxCare onboarded it. The fix adds org.jsecurity.realm.jndi.JndiRealmFactory to the SubTypeValidator blocklist, preventing deserialization of this gadget class. Fix commit f6d9c664f6d by upstream maintainer Tatu Saloranta was already in the upstream release that TuxCare onboarded (commit 18ffcba6408ac903129deff3d09bbc762b56a063).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget (org.jsecurity.realm.jndi.JndiRealmFactory) that enables JNDI injection attacks. The target repository (jackson-databind 2.18.0-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.18.0 before TuxCare onboarded it. The fix adds org.jsecurity.realm.jndi.JndiRealmFactory to the SubTypeValidator blocklist, preventing deserialization of this gadget class. Fix commit f6d9c664f6d by upstream maintainer Tatu Saloranta was already in the upstream release that TuxCare onboarded (commit 18ffcba6408ac903129deff3d09bbc762b56a063).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T14:21:46.608783+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6. The target is version 2.18.0, which already contains the upstream fix that adds br.com.anteros.dbcp.AnterosDBCPDataSource to the deserialization blocklist in SubTypeValidator.java (line 147). The fix was authored by upstream maintainer Tatu Saloranta (commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7) and was already present in the upstream 2.18.0 release before TuxCare onboarded it. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6. The target is version 2.18.0, which already contains the upstream fix that adds br.com.anteros.dbcp.AnterosDBCPDataSource to the deserialization blocklist in SubTypeValidator.java (line 147). The fix was authored by upstream maintainer Tatu Saloranta (commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7) and was already present in the upstream 2.18.0 release before TuxCare onboarded it. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T15:16:55.064774+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is NOT present in jackson-databind 2.18.0-tuxcare.3. The vulnerability concerns missing blocklist protection for the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration in Jackson's polymorphic deserialization. The fix (adding this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was already present in the upstream jackson-databind 2.18.0 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java lines 209-210, preventing exploitation. Fix commit 08fbfacf89 was authored by upstream contributor 49526356@qq.com and shipped before TuxCare's involvement (first TuxCare commit: onboarding by amoniatovskiy@cloudlinux.com at 18ffcba6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 is NOT present in jackson-databind 2.18.0-tuxcare.3. The vulnerability concerns missing blocklist protection for the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration in Jackson's polymorphic deserialization. The fix (adding this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was already present in the upstream jackson-databind 2.18.0 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java lines 209-210, preventing exploitation. Fix commit 08fbfacf89 was authored by upstream contributor 49526356@qq.com and shipped before TuxCare's involvement (first TuxCare commit: onboarding by amoniatovskiy@cloudlinux.com at 18ffcba6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in Jackson Databind DOMDeserializer) is NOT present in jackson-databind 2.18.0-tuxcare.3. The upstream fix (commit 3d932709ab) was already included in the upstream 2.18.0 release before TuxCare onboarded it. The fix adds two critical XML parser security features to prevent XXE attacks: (1) disallow-doctype-decl=true to reject DOCTYPE declarations, and (2) load-external-dtd=false to prevent loading external DTD files. These defenses are configured in the static initializer of DOMDeserializer.java and apply to all DOM parsing operations. No bypass paths exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE vulnerability in Jackson Databind DOMDeserializer) is NOT present in jackson-databind 2.18.0-tuxcare.3. The upstream fix (commit 3d932709ab) was already included in the upstream 2.18.0 release before TuxCare onboarded it. The fix adds two critical XML parser security features to prevent XXE attacks: (1) disallow-doctype-decl=true to reject DOCTYPE declarations, and (2) load-external-dtd=false to prevent loading external DTD files. These defenses are configured in the static initializer of DOMDeserializer.java and apply to all DOM parsing operations. No bypass paths exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T14:22:15.181090+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 is NOT present in jackson-databind 2.18.0. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 41b8bdb5ccc by Tatu Saloranta on 2020-12-15) added these classes to the SubTypeValidator blocklist, preventing their polymorphic deserialization. This fix was already present in upstream version 2.18.0 when TuxCare onboarded it (commit 18ffcba6 on 2024+). The target code at SubTypeValidator.java:217-218 contains the defense, blocking both dangerous classes from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "CVE-2020-35490 is NOT present in jackson-databind 2.18.0. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 41b8bdb5ccc by Tatu Saloranta on 2020-12-15) added these classes to the SubTypeValidator blocklist, preventing their polymorphic deserialization. This fix was already present in upstream version 2.18.0 when TuxCare onboarded it (commit 18ffcba6 on 2024+). The target code at SubTypeValidator.java:217-218 contains the defense, blocking both dangerous classes from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T12:47:30.687322+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target version jackson-databind 2.18.0-tuxcare.3 is not affected by CVE-2020-35491. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta) that adds org.apache.commons.dbcp2.datasources.SharedPoolDataSource and org.apache.commons.dbcp2.datasources.PerUserPoolDataSource to the deserialization blocklist was already present in the upstream 2.18.0 release before TuxCare onboarded it. The vulnerable code pattern (ability to deserialize these dangerous gadget classes) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "The target version jackson-databind 2.18.0-tuxcare.3 is not affected by CVE-2020-35491. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta) that adds org.apache.commons.dbcp2.datasources.SharedPoolDataSource and org.apache.commons.dbcp2.datasources.PerUserPoolDataSource to the deserialization blocklist was already present in the upstream 2.18.0 release before TuxCare onboarded it. The vulnerable code pattern (ability to deserialize these dangerous gadget classes) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T14:55:19.903675+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.18.0 is NOT AFFECTED by CVE-2020-35728. The vulnerability (deserialization gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) is blocked by a fix that was already present in the upstream jackson-databind 2.18.0 release. The CVE affects versions before 2.9.10.8, and the target version 2.18.0 is well beyond this threshold. The blocklist entry exists at SubTypeValidator.java:240, preventing the malicious class from being deserialized. This is an upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "Target version 2.18.0 is NOT AFFECTED by CVE-2020-35728. The vulnerability (deserialization gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) is blocked by a fix that was already present in the upstream jackson-databind 2.18.0 release. The CVE affects versions before 2.9.10.8, and the target version 2.18.0 is well beyond this threshold. The blocklist entry exists at SubTypeValidator.java:240, preventing the malicious class from being deserialized. This is an upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T13:24:51.671524+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is NOT present in jackson-databind 2.18.0-tuxcare.3. The fix was already included in upstream release 2.18.0 before TuxCare onboarding. All five DriverAdapterCPDS blocklist entries from the upstream patch (commit 3ded28aece) are present in SubTypeValidator.java, blocking deserialization of the gadget classes related to commons-dbcp, apache-drill, and tomcat-dbcp variants.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "CVE-2020-36179 is NOT present in jackson-databind 2.18.0-tuxcare.3. The fix was already included in upstream release 2.18.0 before TuxCare onboarding. All five DriverAdapterCPDS blocklist entries from the upstream patch (commit 3ded28aece) are present in SubTypeValidator.java, blocking deserialization of the gadget classes related to commons-dbcp, apache-drill, and tomcat-dbcp variants.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T15:38:16.833370+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for DriverAdapterCPDS gadget classes. The target version 2.18.0-tuxcare.3 contains the complete upstream fix (commit 3ded28aece) that adds all five DriverAdapterCPDS class variants to SubTypeValidator's deserialization blocklist. This fix was authored by upstream maintainer Tatu Saloranta and was already present in version 2.18.0 when TuxCare onboarded it. The vulnerable pattern (absence of DriverAdapterCPDS in the blocklist) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "CVE-2020-36180 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for DriverAdapterCPDS gadget classes. The target version 2.18.0-tuxcare.3 contains the complete upstream fix (commit 3ded28aece) that adds all five DriverAdapterCPDS class variants to SubTypeValidator's deserialization blocklist. This fix was authored by upstream maintainer Tatu Saloranta and was already present in version 2.18.0 when TuxCare onboarded it. The vulnerable pattern (absence of DriverAdapterCPDS in the blocklist) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T16:42:56.211039+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.0 is NOT AFFECTED by CVE-2020-36181. The vulnerability involves missing blocklist entries for DriverAdapterCPDS deserialization gadgets. All five DriverAdapterCPDS variants added by the upstream patch are already present in the target's SubTypeValidator.java blocklist (lines 123, 193, 219, 228, 234). The fix commit (3ded28aece, Dec 2020) was part of upstream release 2.18.0, which TuxCare onboarded in commit 18ffcba640. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "Target jackson-databind 2.18.0 is NOT AFFECTED by CVE-2020-36181. The vulnerability involves missing blocklist entries for DriverAdapterCPDS deserialization gadgets. All five DriverAdapterCPDS variants added by the upstream patch are already present in the target's SubTypeValidator.java blocklist (lines 123, 193, 219, 228, 234). The fix commit (3ded28aece, Dec 2020) was part of upstream release 2.18.0, which TuxCare onboarded in commit 18ffcba640. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T14:13:29.562378+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is NOT present in jackson-databind 2.18.0. The vulnerability concerns deserialization gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, which could enable JNDI injection and RCE via polymorphic type handling. The fix (adding this class to the deserialization blocklist) was already present in the upstream 2.18.0 release onboarded by TuxCare. The blocklist entry exists at SubTypeValidator.java:234 and prevents Jackson from deserializing this gadget class, blocking the attack chain before the malicious class can be instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "CVE-2020-36182 is NOT present in jackson-databind 2.18.0. The vulnerability concerns deserialization gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, which could enable JNDI injection and RCE via polymorphic type handling. The fix (adding this class to the deserialization blocklist) was already present in the upstream 2.18.0 release onboarded by TuxCare. The blocklist entry exists at SubTypeValidator.java:234 and prevents Jackson from deserializing this gadget class, blocking the attack chain before the malicious class can be instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T15:21:42.964789+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not present in jackson-databind 2.18.0. The vulnerability involves JNDI injection via the org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class. The fix (denylisting this class in SubTypeValidator) was already included in the upstream 2.18.0 release by Tatu Saloranta on Dec 31, 2020 (commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29), before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "CVE-2020-36183 is not present in jackson-databind 2.18.0. The vulnerability involves JNDI injection via the org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class. The fix (denylisting this class in SubTypeValidator) was already included in the upstream 2.18.0 release by Tatu Saloranta on Dec 31, 2020 (commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29), before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T12:29:43.002778+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blacklist entry for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. The target version 2.18.0 already contains the upstream fix (commit 567194c53a by tatu.saloranta@iki.fi) that was shipped in the upstream release before TuxCare onboarded it. The vulnerable pattern (missing blacklist validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blacklist entry for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. The target version 2.18.0 already contains the upstream fix (commit 567194c53a by tatu.saloranta@iki.fi) that was shipped in the upstream release before TuxCare onboarded it. The vulnerable pattern (missing blacklist validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T16:07:58.117916+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is NOT affecting jackson-databind 2.18.0. The vulnerability involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. The upstream fix (commit 567194c53a by Tatu Saloranta, December 2020) added blocklist entries to SubTypeValidator.java preventing these dangerous classes from being deserialized. This fix was already part of the upstream jackson-databind 2.18.0 release before TuxCare onboarded it (onboarding commit 18ffcba6408 by amoniatovskiy@cloudlinux.com). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 is NOT affecting jackson-databind 2.18.0. The vulnerability involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. The upstream fix (commit 567194c53a by Tatu Saloranta, December 2020) added blocklist entries to SubTypeValidator.java preventing these dangerous classes from being deserialized. This fix was already part of the upstream jackson-databind 2.18.0 release before TuxCare onboarded it (onboarding commit 18ffcba6408 by amoniatovskiy@cloudlinux.com). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T14:35:16.615188+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is not present in jackson-databind 2.18.0. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. The upstream fix (commit 3e8fa3beea) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in the upstream jackson-databind 2.18.0 release that TuxCare onboarded, so the vulnerable pattern is absent from the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "CVE-2020-36186 is not present in jackson-databind 2.18.0. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. The upstream fix (commit 3e8fa3beea) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in the upstream jackson-databind 2.18.0 release that TuxCare onboarded, so the vulnerable pattern is absent from the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T14:47:28.358565+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to unprotected deserialization of tomcat-dbcp DataSource gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource). The target repository (jackson-databind 2.18.0-tuxcare.3 at SHA 5e0aeed976) contains the upstream fix (commit 3e8fa3beea) that blocks both classes in SubTypeValidator's denylist. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.18.0 before TuxCare onboarded it. The vulnerable pattern (deserializing these gadget classes without blocking) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to unprotected deserialization of tomcat-dbcp DataSource gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource). The target repository (jackson-databind 2.18.0-tuxcare.3 at SHA 5e0aeed976) contains the upstream fix (commit 3e8fa3beea) that blocks both classes in SubTypeValidator's denylist. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.18.0 before TuxCare onboarded it. The vulnerable pattern (deserializing these gadget classes without blocking) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T15:53:25.637541+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and concerns a deserialization gadget (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource) that allows arbitrary code execution via polymorphic type handling. The target repository (jackson-databind 2.18.0-tuxcare.3) is not affected because the fix was already present in the upstream 2.18.0 release. The blocklist entries preventing deserialization of the gadget classes are present in SubTypeValidator.java (lines 223-224), added by upstream commit 33d96c13fe authored by tatu.saloranta@iki.fi on 2020-12-26. This fix predates the TuxCare onboarding of version 2.18.0 by over 1800 commits, confirming it was shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and concerns a deserialization gadget (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource) that allows arbitrary code execution via polymorphic type handling. The target repository (jackson-databind 2.18.0-tuxcare.3) is not affected because the fix was already present in the upstream 2.18.0 release. The blocklist entries preventing deserialization of the gadget classes are present in SubTypeValidator.java (lines 223-224), added by upstream commit 33d96c13fe authored by tatu.saloranta@iki.fi on 2020-12-26. This fix predates the TuxCare onboarding of version 2.18.0 by over 1800 commits, confirming it was shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T13:04:07.366670+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is not present in jackson-databind 2.18.0. The fix that blocks the two vulnerable deserialization gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource) was committed by upstream maintainer Tatu Saloranta on 2020-12-26 and was already included in the upstream jackson-databind 2.18.0 release that TuxCare onboarded in 2026-09-21. The blocklist entries are present in SubTypeValidator.java lines 223-224.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 is not present in jackson-databind 2.18.0. The fix that blocks the two vulnerable deserialization gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource) was committed by upstream maintainer Tatu Saloranta on 2020-12-26 and was already included in the upstream jackson-databind 2.18.0 release that TuxCare onboarded in 2026-09-21. The blocklist entries are present in SubTypeValidator.java lines 223-224.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T14:16:13.721778+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.18.0-tuxcare.3. The vulnerability (stack overflow via deeply nested JSON) was fixed by the upstream vendor through a non-recursive deserializer implementation (UntypedObjectDeserializerNR) introduced in version 2.14. This fix was already present in the upstream 2.18.0 release before TuxCare onboarded it. The default deserialization path uses the non-recursive implementation which fundamentally cannot cause stack overflow regardless of JSON depth. The vulnerable recursive code pattern without depth limits is not active in production use.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.18.0-tuxcare.3. The vulnerability (stack overflow via deeply nested JSON) was fixed by the upstream vendor through a non-recursive deserializer implementation (UntypedObjectDeserializerNR) introduced in version 2.14. This fix was already present in the upstream 2.18.0 release before TuxCare onboarded it. The default deserialization path uses the non-recursive implementation which fundamentally cannot cause stack overflow regardless of JSON depth. The vulnerable recursive code pattern without depth limits is not active in production use.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T16:13:14.329691+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.0-tuxcare.3 is NOT vulnerable to CVE-2020-8840. The fix that blocks deserialization of org.apache.xbean.propertyeditor.JndiConverter was already present in the upstream jackson-databind 2.18.0 release before TuxCare onboarded it. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "The target jackson-databind 2.18.0-tuxcare.3 is NOT vulnerable to CVE-2020-8840. The fix that blocks deserialization of org.apache.xbean.propertyeditor.JndiConverter was already present in the upstream jackson-databind 2.18.0 release before TuxCare onboarded it. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, which allows deserialization gadget attacks. The target version 2.18.0 is NOT affected because the fix (adding HikariConfig to the blocklist) was already present in the upstream release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:141 and was authored by the upstream maintainer (tatu.saloranta@iki.fi) in commit 9f4e97019f on 2020-02-29, well before TuxCare onboarded version 2.18.0 on 2026-09-21.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, which allows deserialization gadget attacks. The target version 2.18.0 is NOT affected because the fix (adding HikariConfig to the blocklist) was already present in the upstream release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:141 and was authored by the upstream maintainer (tatu.saloranta@iki.fi) in commit 9f4e97019f on 2020-02-29, well before TuxCare onboarded version 2.18.0 on 2026-09-21.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T15:44:21.734688+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547: Target is NOT AFFECTED. The vulnerability involves deserialization of the malicious gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` via Jackson's polymorphic typing feature. The fix (adding this class to SubTypeValidator's blocklist at line 144) is already present in the target. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 9f4e97019fb and was already included in upstream release 2.18.0 before TuxCare onboarded it (first TuxCare commit: 18ffcba6408ac903129deff3d09bbc762b56a063). The target version 2.18.0-tuxcare.3 is significantly newer than the CVE's affected versions (before 2.9.10.4/2.8.11.6/2.7.9.7), and the vulnerable pattern is not present because the upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547: Target is NOT AFFECTED. The vulnerability involves deserialization of the malicious gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` via Jackson's polymorphic typing feature. The fix (adding this class to SubTypeValidator's blocklist at line 144) is already present in the target. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 9f4e97019fb and was already included in upstream release 2.18.0 before TuxCare onboarded it (first TuxCare commit: 18ffcba6408ac903129deff3d09bbc762b56a063). The target version 2.18.0-tuxcare.3 is significantly newer than the CVE's affected versions (before 2.9.10.4/2.8.11.6/2.7.9.7), and the vulnerable pattern is not present because the upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T16:18:43.675482+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for br.com.anteros.dbcp.AnterosDBCPConfig deserialization gadget. The target version 2.18.0 already contains the upstream fix that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 145). The fix was authored by Tatu Saloranta and shipped in upstream jackson-databind 2.18.0 before TuxCare onboarded this version, so the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for br.com.anteros.dbcp.AnterosDBCPConfig deserialization gadget. The target version 2.18.0 already contains the upstream fix that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 145). The fix was authored by Tatu Saloranta and shipped in upstream jackson-databind 2.18.0 before TuxCare onboarded this version, so the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T15:16:30.596459+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.18.0-tuxcare.3 is NOT AFFECTED by CVE-2021-20190. The vulnerability (Java deserialization gadget attacks via polymorphic typing) is not present because the upstream vendor (FasterXML) shipped the complete fix in release 2.18.0. The fix adds specific dangerous class names (javax.swing.JTextPane, org.apache.shiro.jndi.JndiObjectFactory, etc.) to SubTypeValidator's deny list, blocking their deserialization. This upstream fix was authored by tatu.saloranta@iki.fi in commit 7dbf51bf78 and was already present when TuxCare onboarded the 2.18.0 release. TuxCare only needed to backport CVE-2021-20190 to older versions (2.7.x-2.9.x) that lacked the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "Target version 2.18.0-tuxcare.3 is NOT AFFECTED by CVE-2021-20190. The vulnerability (Java deserialization gadget attacks via polymorphic typing) is not present because the upstream vendor (FasterXML) shipped the complete fix in release 2.18.0. The fix adds specific dangerous class names (javax.swing.JTextPane, org.apache.shiro.jndi.JndiObjectFactory, etc.) to SubTypeValidator's deny list, blocking their deserialization. This upstream fix was authored by tatu.saloranta@iki.fi in commit 7dbf51bf78 and was already present when TuxCare onboarded the 2.18.0 release. TuxCare only needed to backport CVE-2021-20190 to older versions (2.7.x-2.9.x) that lacked the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.18.0 is NOT AFFECTED by CVE-2021-46877. The vulnerability involved uncontrolled heap allocation during JDK deserialization of JsonNode objects, where an attacker could cause a 2GB memory allocation by providing a malicious serialized object with a large declared length value. The upstream fix (commit 3ccde7d938 by Tatu Saloranta) introduced a 100KB allocation threshold with segmented reading for larger payloads, preventing the DoS. This fix was released in upstream versions 2.12.6 and 2.13.1 (December 2021). Version 2.18.0 was released years later and naturally includes this fix from the upstream release. TuxCare onboarded version 2.18.0 on commit 18ffcba6408 with the fix already present. The vulnerable code pattern (blind byte[] allocation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "The target repository jackson-databind version 2.18.0 is NOT AFFECTED by CVE-2021-46877. The vulnerability involved uncontrolled heap allocation during JDK deserialization of JsonNode objects, where an attacker could cause a 2GB memory allocation by providing a malicious serialized object with a large declared length value. The upstream fix (commit 3ccde7d938 by Tatu Saloranta) introduced a 100KB allocation threshold with segmented reading for larger payloads, preventing the DoS. This fix was released in upstream versions 2.12.6 and 2.13.1 (December 2021). Version 2.18.0 was released years later and naturally includes this fix from the upstream release. TuxCare onboarded version 2.18.0 on commit 18ffcba6408 with the fix already present. The vulnerable code pattern (blind byte[] allocation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T16:46:51.408476+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 is NOT present in jackson-databind 2.18.0. The vulnerability affects primitive value deserializers lacking checks to prevent deep wrapper array nesting when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, causing resource exhaustion. The upstream vendor (FasterXML) fixed this in commit cd090979b7 which shipped in the 2.18.0 release. The fix adds checks in StdDeserializer and BeanDeserializer that detect and reject second-level START_ARRAY tokens during single-value unwrapping, preventing unbounded recursion. TuxCare onboarded version 2.18.0 which already contained this fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "CVE-2022-42003 is NOT present in jackson-databind 2.18.0. The vulnerability affects primitive value deserializers lacking checks to prevent deep wrapper array nesting when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, causing resource exhaustion. The upstream vendor (FasterXML) fixed this in commit cd090979b7 which shipped in the 2.18.0 release. The fix adds checks in StdDeserializer and BeanDeserializer that detect and reject second-level START_ARRAY tokens during single-value unwrapping, preventing unbounded recursion. TuxCare onboarded version 2.18.0 which already contained this fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-06T18:07:00.029185+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 2.18.0 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-rgv9-q543-rqg4 (affected up to 2.13.4), NVD (affected up to 2.13.4), Snyk (affected up to 2.13.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 2.18.0 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-rgv9-q543-rqg4 (affected up to 2.13.4), NVD (affected up to 2.13.4), Snyk (affected up to 2.13.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:35:32.997384+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-05T11:04:54.034967+00:00", "status_notes": "Vulnerability CVE-2026-19032 affects version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-19032" }, "action_statement": "Vulnerability CVE-2026-19032 affects version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.0-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-02T20:19:49.154981+00:00", "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind version 2.18.0-tuxcare.3 is not affected by CVE-2026-50193. The fix for this vulnerability (commit a1fa4ae4ec) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.18.0 release before TuxCare onboarded the version. The InternalNodeMapper.java file contains the complete fix with IteratorStack class and non-recursive serializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50193" }, "impact_statement": "not_affected \u2014 The target jackson-databind version 2.18.0-tuxcare.3 is not affected by CVE-2026-50193. The fix for this vulnerability (commit a1fa4ae4ec) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.18.0 release before TuxCare onboarded the version. The InternalNodeMapper.java file contains the complete fix with IteratorStack class and non-recursive serializatio..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:36:00.169235+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:36:00.169235+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:35:32.997384+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:36:00.169235+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:35:32.997384+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-03T02:41:00.167232+00:00", "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 jackson-databind 2.18.0 is NOT affected by CVE-2026-54517. While the vulnerable code pattern (missing view check in property-buffering path at BeanDeserializer.java:477-498) exists in the source, the attack chain cannot complete successfully in this version. The vulnerability requires setterless properties to be buffered AND successfully applied without view checks, but in 2.18.0, applying buff...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54517" }, "impact_statement": "not_affected \u2014 jackson-databind 2.18.0 is NOT affected by CVE-2026-54517. While the vulnerable code pattern (missing view check in property-buffering path at BeanDeserializer.java:477-498) exists in the source, the attack chain cannot complete successfully in this version. The vulnerability requires setterless properties to be buffered AND successfully applied without view checks, but in 2.18.0, applying buff..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-10T04:17:00.447062+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it rejects unwrapped constructor parameters before they can receive input. Unnamed parameters trigger an unsupported-definition error at src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:533, and named parameters are rejected at src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:1020. The error throws InvalidDefinitionException at src/main/java/com/fasterxml/jackson/databind/DeserializationContext.java:1887, preventing the vulnerable replay.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it rejects unwrapped constructor parameters before they can receive input. Unnamed parameters trigger an unsupported-definition error at src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:533, and named parameters are rejected at src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:1020. The error throws InvalidDefinitionException at src/main/java/com/fasterxml/jackson/databind/DeserializationContext.java:1887, preventing the vulnerable replay." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:35:32.997384+00:00", "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59888" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:36:00.169235+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:37:00.156723+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:35:32.997384+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:35:32.997384+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:37:00.156723+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:37:00.156723+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:36:00.169235+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.18.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-tuxcare.3" } } ], "timestamp": "2026-11-01T09:35:32.997384+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.18.0-tuxcare.3.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }