{
  "@id": "urn:uuid:ec106710-db2a-4e8c-9329-f9f7ec6925d5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 28,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:52:00.040792+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:14:44.515379+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is NOT present in jackson-databind 2.9.10.1-tuxcare.2. The vulnerability affects versions < 2.8.11 and < 2.9.4 and involves unsafe deserialization of dangerous classes. The target version 2.9.10.1 ships with SubTypeValidator.java containing comprehensive blacklists for all classes mentioned in CVE-2017-15095 patches (#1737: FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, and C3P0 classes). The fix was introduced by upstream commit 2235894210 (author: tatu.saloranta@iki.fi) and shipped in the upstream 2.9.10.1 release before TuxCare onboarding (first TuxCare commit: e80b8103075cccb044060d4d6edd0b070968b83b). The vulnerable pattern is absent from HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is NOT present in jackson-databind 2.9.10.1-tuxcare.2. The vulnerability affects versions < 2.8.11 and < 2.9.4 and involves unsafe deserialization of dangerous classes. The target version 2.9.10.1 ships with SubTypeValidator.java containing comprehensive blacklists for all classes mentioned in CVE-2017-15095 patches (#1737: FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, and C3P0 classes). The fix was introduced by upstream commit 2235894210 (author: tatu.saloranta@iki.fi) and shipped in the upstream 2.9.10.1 release before TuxCare onboarding (first TuxCare commit: e80b8103075cccb044060d4d6edd0b070968b83b). The vulnerable pattern is absent from HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:47:47.688279+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.9.3. Target version 2.9.10.1 contains upstream fixes that were shipped in the 2.9.10.1 release before TuxCare onboarding. All required blacklist entries (FileHandler, UnicastRemoteObject, Spring classes, C3P0 DataSources, BCEL ClassLoader, Tomcat BasicDataSource) are present in SubTypeValidator.java. The vulnerable pattern (incomplete blacklist) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.9.3. Target version 2.9.10.1 contains upstream fixes that were shipped in the 2.9.10.1 release before TuxCare onboarding. All required blacklist entries (FileHandler, UnicastRemoteObject, Spring classes, C3P0 DataSources, BCEL ClassLoader, Tomcat BasicDataSource) are present in SubTypeValidator.java. The vulnerable pattern (incomplete blacklist) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:34:04.441947+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target version 2.9.10.1 already contains the upstream fix. The defense (SubTypeValidator with blocklist of dangerous classes) was present in the upstream 2.9.10.1 release before TuxCare onboarded it. The fix prevents deserialization of dangerous classes like InvokerTransformer, TemplatesImpl, MethodClosure, etc., blocking the attack chain from INPUT (class name in JSON) to GOAL (code execution via dangerous class instantiation).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target version 2.9.10.1 already contains the upstream fix. The defense (SubTypeValidator with blocklist of dangerous classes) was present in the upstream 2.9.10.1 release before TuxCare onboarded it. The fix prevents deserialization of dangerous classes like InvokerTransformer, TemplatesImpl, MethodClosure, etc., blocking the attack chain from INPUT (class name in JSON) to GOAL (code execution via dangerous class instantiation).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:23:58.768798+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.9.10.1-tuxcare.2. The vulnerability was fixed in upstream version 2.9.6, and the target version 2.9.10.1 already includes the fix. The malicious iBatis gadget class (org.apache.ibatis.parsing.XPathParser) is blacklisted in SubTypeValidator.java (line 62), preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.9.10.1-tuxcare.2. The vulnerability was fixed in upstream version 2.9.6, and the target version 2.9.10.1 already includes the fix. The malicious iBatis gadget class (org.apache.ibatis.parsing.XPathParser) is blacklisted in SubTypeValidator.java (line 62), preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is NOT present in jackson-databind 2.9.10.1-tuxcare.3. The vulnerability affects versions prior to 2.9.6, but the target is version 2.9.10.1, which already includes the upstream fix. The fix commits (28badf7ef6 and 7487cf7eb1) by Tatu Saloranta (upstream maintainer) are present in HEAD and were included in the upstream release before TuxCare onboarding. The SubTypeValidator blacklist includes the Jodd-db gadget class (jodd.db.connection.DataSourceConnectionProvider) that enables LDAP-based deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 is NOT present in jackson-databind 2.9.10.1-tuxcare.3. The vulnerability affects versions prior to 2.9.6, but the target is version 2.9.10.1, which already includes the upstream fix. The fix commits (28badf7ef6 and 7487cf7eb1) by Tatu Saloranta (upstream maintainer) are present in HEAD and were included in the upstream release before TuxCare onboarding. The SubTypeValidator blacklist includes the Jodd-db gadget class (jodd.db.connection.DataSourceConnectionProvider) that enables LDAP-based deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:24:56.766712+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.9.10.1-tuxcare.2 is NOT affected by CVE-2018-12023. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.9.10.1 is after the fixed version 2.9.6 and already contains the upstream fix that blacklists Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and was included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "The target jackson-databind version 2.9.10.1-tuxcare.2 is NOT affected by CVE-2018-12023. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.9.10.1 is after the fixed version 2.9.6 and already contains the upstream fix that blacklists Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and was included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:43.517878+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.9.10.1-tuxcare.2. The vulnerability involves polymorphic deserialization of dangerous classes (org.slf4j.ext.EventData and others) that can lead to arbitrary code execution. The upstream fix adds these classes to a blocklist in SubTypeValidator.java (lines 71-75), preventing their instantiation during deserialization. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 87d29af25e and shipped in upstream release 2.9.10.1 before TuxCare onboarded it. The target version inherits this protection from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.9.10.1-tuxcare.2. The vulnerability involves polymorphic deserialization of dangerous classes (org.slf4j.ext.EventData and others) that can lead to arbitrary code execution. The upstream fix adds these classes to a blocklist in SubTypeValidator.java (lines 71-75), preventing their instantiation during deserialization. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 87d29af25e and shipped in upstream release 2.9.10.1 before TuxCare onboarded it. The target version inherits this protection from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:04:33.761797+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is not present in jackson-databind 2.9.10.1. The fix that blocks blaze-ds gadget classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) from polymorphic deserialization was already included in the upstream 2.9.10.1 release. The fix originated in upstream commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by Tatu Saloranta (August 2018), was merged into version 2.9.7, and was present before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 is not present in jackson-databind 2.9.10.1. The fix that blocks blaze-ds gadget classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) from polymorphic deserialization was already included in the upstream 2.9.10.1 release. The fix originated in upstream commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by Tatu Saloranta (August 2018), was merged into version 2.9.7, and was present before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:10:29.791973+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.1-tuxcare.2) is not affected by CVE-2018-14720. The vulnerability was fixed in upstream version 2.9.7, and the target version 2.9.10.1 already contains the fix. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in the deserialization blacklist at SubTypeValidator.java:72-75 and actively enforced during polymorphic deserialization. This fix was authored by upstream (Tatu Saloranta) and shipped in the upstream release 2.9.10.1 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "The target repository (jackson-databind 2.9.10.1-tuxcare.2) is not affected by CVE-2018-14720. The vulnerability was fixed in upstream version 2.9.7, and the target version 2.9.10.1 already contains the fix. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in the deserialization blacklist at SubTypeValidator.java:72-75 and actively enforced during polymorphic deserialization. This fix was authored by upstream (Tatu Saloranta) and shipped in the upstream release 2.9.10.1 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:41:24.721852+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.9.10.1-tuxcare.2. The vulnerability affects versions before 2.9.7, and the target version 2.9.10.1 already contains the upstream fix. The dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl is blocked in SubTypeValidator.java (line 75), preventing polymorphic deserialization attacks. This fix was included in the upstream 2.9.7 release (commit 87d29af25e, August 2018) and was present when TuxCare onboarded version 2.9.10.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.9.10.1-tuxcare.2. The vulnerability affects versions before 2.9.7, and the target version 2.9.10.1 already contains the upstream fix. The dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl is blocked in SubTypeValidator.java (line 75), preventing polymorphic deserialization attacks. This fix was included in the upstream 2.9.7 release (commit 87d29af25e, August 2018) and was present when TuxCare onboarded version 2.9.10.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:58:17.463230+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.1 is not affected by CVE-2018-19360. The vulnerability was fixed by upstream FasterXML in version 2.9.8 (released December 15, 2018) by adding org.apache.axis2.transport.jms.JMSOutTransportInfo to the deserialization blacklist. This fix is present in the target at SubTypeValidator.java:81 and was already included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "Target version 2.9.10.1 is not affected by CVE-2018-19360. The vulnerability was fixed by upstream FasterXML in version 2.9.8 (released December 15, 2018) by adding org.apache.axis2.transport.jms.JMSOutTransportInfo to the deserialization blacklist. This fix is present in the target at SubTypeValidator.java:81 and was already included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:01:58.863426+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is not present in jackson-databind 2.9.10.1. The vulnerability involves polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that can be exploited as deserialization gadgets. The fix adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 79-80), preventing their instantiation during deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.9.8, which predates the target version 2.9.10.1. The blocklist is enforced during bean deserialization via SubTypeValidator.instance().validateSubType() called from BeanDeserializerFactory._validateSubType() (line 919).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 is not present in jackson-databind 2.9.10.1. The vulnerability involves polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that can be exploited as deserialization gadgets. The fix adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 79-80), preventing their instantiation during deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.9.8, which predates the target version 2.9.10.1. The blocklist is enforced during bean deserialization via SubTypeValidator.instance().validateSubType() called from BeanDeserializerFactory._validateSubType() (line 919).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:28:17.034118+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 concerns the jboss-common-core class (org.jboss.util.propertyeditor.DocumentEditor) being exploitable via polymorphic deserialization. The upstream fix adds this class to SubTypeValidator's blocklist. Analysis confirms the fix is present in the target at SubTypeValidator.java:78. The fix commit 72cd4025a2 (authored by upstream maintainer Tatu Saloranta, Nov 19 2018) is an ancestor of HEAD and predates the first TuxCare onboarding commit e80b8103 (2.9.10.1). The vulnerable code pattern is not present because the fix was already included in the upstream release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 concerns the jboss-common-core class (org.jboss.util.propertyeditor.DocumentEditor) being exploitable via polymorphic deserialization. The upstream fix adds this class to SubTypeValidator's blocklist. Analysis confirms the fix is present in the target at SubTypeValidator.java:78. The fix commit 72cd4025a2 (authored by upstream maintainer Tatu Saloranta, Nov 19 2018) is an ancestor of HEAD and predates the first TuxCare onboarding commit e80b8103 (2.9.10.1). The vulnerable code pattern is not present because the fix was already included in the upstream release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.9.10.1-tuxcare.3. The vulnerability required two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to be absent from the deserialization blacklist. Both classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 59-60), preventing exploitation. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 038b471e2e on January 21, 2018, and was already included in the upstream 2.9.10.1 release (September 2019) that TuxCare onboarded. Since the target version 2.9.10.1 is newer than the affected versions (through 2.9.3), and the fix predates the TuxCare onboarding, the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.9.10.1-tuxcare.3. The vulnerability required two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to be absent from the deserialization blacklist. Both classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 59-60), preventing exploitation. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 038b471e2e on January 21, 2018, and was already included in the upstream 2.9.10.1 release (September 2019) that TuxCare onboarded. Since the target version 2.9.10.1 is newer than the affected versions (through 2.9.3), and the fix predates the TuxCare onboarding, the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:13.058306+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.9.10.1-tuxcare.2. The fix for this vulnerability (blocking c3p0 DataSource classes during polymorphic deserialization) was already included in the upstream release 2.9.10.1, which TuxCare onboarded without modification. The fix commit 6799f8f10c by upstream maintainer Tatu Saloranta is an ancestor of the onboarding commit, confirming the vulnerable pattern was never present in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.9.10.1-tuxcare.2. The fix for this vulnerability (blocking c3p0 DataSource classes during polymorphic deserialization) was already included in the upstream release 2.9.10.1, which TuxCare onboarded without modification. The fix commit 6799f8f10c by upstream maintainer Tatu Saloranta is an ancestor of the onboarding commit, confirming the vulnerable pattern was never present in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:37:30.400386+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind 2.9.10.1. The fix (blocking com.mysql.cj.jdbc.admin.MiniAdmin from polymorphic deserialization) was already included in the upstream release 2.9.9 that TuxCare onboarded. The blocklist entry is present at SubTypeValidator.java:84 and is enforced during bean deserializer creation. This is an upstream fix by Tatu Saloranta (tatu.saloranta@iki.fi), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind 2.9.10.1. The fix (blocking com.mysql.cj.jdbc.admin.MiniAdmin from polymorphic deserialization) was already included in the upstream release 2.9.9 that TuxCare onboarded. The blocklist entry is present at SubTypeValidator.java:84 and is enforced during bean deserializer creation. This is an upstream fix by Tatu Saloranta (tatu.saloranta@iki.fi), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.9.10.1 is NOT affected by CVE-2019-12384. The upstream vendor (FasterXML) fixed this vulnerability in version 2.9.9.1 by adding \"ch.qos.logback.core.db.DriverManagerConnectionSource\" to the deserialization blocklist in SubTypeValidator.java (line 87). TuxCare onboarded version 2.9.10.1 on 2026-10-31, which already contained this upstream fix. The fix was authored by Tatu Salora...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 Target version 2.9.10.1 is NOT affected by CVE-2019-12384. The upstream vendor (FasterXML) fixed this vulnerability in version 2.9.9.1 by adding \"ch.qos.logback.core.db.DriverManagerConnectionSource\" to the deserialization blocklist in SubTypeValidator.java (line 87). TuxCare onboarded version 2.9.10.1 on 2026-10-31, which already contained this upstream fix. The fix was authored by Tatu Salora..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind version 2.9.10.1-tuxcare.2 is NOT AFFECTED by CVE-2019-12814. The vulnerability affects jackson-databind 2.x through 2.9.9, allowing arbitrary file reads via JDOM XSLTransformer gadget classes when polymorphic typing is enabled. The fix, which blocks org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer from deserialization, was introduced in upstr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind version 2.9.10.1-tuxcare.2 is NOT AFFECTED by CVE-2019-12814. The vulnerability affects jackson-databind 2.x through 2.9.9, allowing arbitrary file reads via JDOM XSLTransformer gadget classes when polymorphic typing is enabled. The fix, which blocks org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer from deserialization, was introduced in upstr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is not present in jackson-databind 2.9.10.1. The fix (adding net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization deny list) was already included in the upstream 2.9.10.1 release before TuxCare maintenance began. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is not present in jackson-databind 2.9.10.1. The fix (adding net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization deny list) was already included in the upstream 2.9.10.1 release before TuxCare maintenance began. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:44:47.079180+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in jackson-databind 2.9.10.1-tuxcare.2. The upstream fix (blocklist entry for ch.qos.logback.core.db.JNDIConnectionSource) was already included in version 2.9.10.1 when TuxCare onboarded it. Fix commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b by upstream author tatu.saloranta@iki.fi (dated 2019-07-25) is an ancestor of the first TuxCare onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is NOT present in jackson-databind 2.9.10.1-tuxcare.2. The upstream fix (blocklist entry for ch.qos.logback.core.db.JNDIConnectionSource) was already included in version 2.9.10.1 when TuxCare onboarded it. Fix commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b by upstream author tatu.saloranta@iki.fi (dated 2019-07-25) is an ancestor of the first TuxCare onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 fixed upstream before 2.9.10.1: CVE-2019-14540 fix d4983c740fec by tatu.saloranta@iki.fi (2019-08-09) is an ancestor of tuxcare-current/2.9.10.1 (inside upstream tag jackson-databind-2.9.10.1); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "not_affected \u2014 fixed upstream before 2.9.10.1: CVE-2019-14540 fix d4983c740fec by tatu.saloranta@iki.fi (2019-08-09) is an ancestor of tuxcare-current/2.9.10.1 (inside upstream tag jackson-databind-2.9.10.1); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 fixed upstream before 2.9.10.1: CVE-2019-14892 fix 41b7f9b90149 by tatu.saloranta@iki.fi (2019-09-19) is an ancestor of tuxcare-current/2.9.10.1 (inside upstream tag jackson-databind-2.9.10.1); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "not_affected \u2014 fixed upstream before 2.9.10.1: CVE-2019-14892 fix 41b7f9b90149 by tatu.saloranta@iki.fi (2019-09-19) is an ancestor of tuxcare-current/2.9.10.1 (inside upstream tag jackson-databind-2.9.10.1); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 fixed upstream before 2.9.10.1: CVE-2019-14893 fix 998efd708284 by tatu.saloranta@iki.fi (2019-09-19) is an ancestor of tuxcare-current/2.9.10.1 (inside upstream tag jackson-databind-2.9.10.1); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "not_affected \u2014 fixed upstream before 2.9.10.1: CVE-2019-14893 fix 998efd708284 by tatu.saloranta@iki.fi (2019-09-19) is an ancestor of tuxcare-current/2.9.10.1 (inside upstream tag jackson-databind-2.9.10.1); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 fixed upstream before 2.9.10.1: CVE-2019-16335 fix 73c1c2cc76e6 by tatu.saloranta@iki.fi (2019-09-12) is an ancestor of tuxcare-current/2.9.10.1 (inside upstream tag jackson-databind-2.9.10.1); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "not_affected \u2014 fixed upstream before 2.9.10.1: CVE-2019-16335 fix 73c1c2cc76e6 by tatu.saloranta@iki.fi (2019-09-12) is an ancestor of tuxcare-current/2.9.10.1 (inside upstream tag jackson-databind-2.9.10.1); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:10:53.898872+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.9.10.1. The vulnerability, which allowed polymorphic typing abuse via commons-dbcp datasource classes, was fixed by the upstream vendor in release 2.9.10.1. The target repository contains the upstream fix (commits 9593e16cf5, 328a0f833d, bc67eb11a7) that adds blocklist entries for org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource to SubTypeValidator. These commits were authored by upstream maintainer Tatu Saloranta and shipped in the 2.9.10.1 release that TuxCare onboarded (commit e80b8103075cccb044060d4d6edd0b070968b83b).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.9.10.1. The vulnerability, which allowed polymorphic typing abuse via commons-dbcp datasource classes, was fixed by the upstream vendor in release 2.9.10.1. The target repository contains the upstream fix (commits 9593e16cf5, 328a0f833d, bc67eb11a7) that adds blocklist entries for org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource to SubTypeValidator. These commits were authored by upstream maintainer Tatu Saloranta and shipped in the 2.9.10.1 release that TuxCare onboarded (commit e80b8103075cccb044060d4d6edd0b070968b83b).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:20:10.514084+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target version 2.9.10.1-tuxcare.3 is NOT AFFECTED by CVE-2019-16943. The vulnerability involves polymorphic deserialization of dangerous classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp datasources) that can lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in version 2.9.10.1 by adding these classes to the SubTypeValidator blocklist. This fix was already present in the upstream 2.9.10.1 release that TuxCare onboarded, as confirmed by commit bc67eb11a7 authored by Tatu Saloranta. The blocklist entries are present in SubTypeValidator.java at lines 120-123, preventing deserialization of the vulnerable classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "The target version 2.9.10.1-tuxcare.3 is NOT AFFECTED by CVE-2019-16943. The vulnerability involves polymorphic deserialization of dangerous classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp datasources) that can lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in version 2.9.10.1 by adding these classes to the SubTypeValidator blocklist. This fix was already present in the upstream 2.9.10.1 release that TuxCare onboarded, as confirmed by commit bc67eb11a7 authored by Tatu Saloranta. The blocklist entries are present in SubTypeValidator.java at lines 120-123, preventing deserialization of the vulnerable classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 fixed upstream before 2.9.10.1: CVE-2019-17267 fix 191a4cdf87b5 by tatu.saloranta@iki.fi (2019-09-19) is an ancestor of tuxcare-current/2.9.10.1 (inside upstream tag jackson-databind-2.9.10.1); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "not_affected \u2014 fixed upstream before 2.9.10.1: CVE-2019-17267 fix 191a4cdf87b5 by tatu.saloranta@iki.fi (2019-09-19) is an ancestor of tuxcare-current/2.9.10.1 (inside upstream tag jackson-databind-2.9.10.1); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:51:16.476690+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.1-tuxcare.2) is NOT affected by CVE-2019-17531. The vulnerability was fixed in upstream release 2.9.10.1 by commit b5a304a98590b6bb766134f9261e6566dcbbb6d0, which added blocklist entries for two log4j-extras gadget classes to prevent their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream release before TuxCare's onboarding commit. The fix is present at SubTypeValidator.java:149-150, blocking org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource from polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "The target repository (jackson-databind 2.9.10.1-tuxcare.2) is NOT affected by CVE-2019-17531. The vulnerability was fixed in upstream release 2.9.10.1 by commit b5a304a98590b6bb766134f9261e6566dcbbb6d0, which added blocklist entries for two log4j-extras gadget classes to prevent their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream release before TuxCare's onboarding commit. The fix is present at SubTypeValidator.java:149-150, blocking org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource from polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:35:00.383865+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-20330"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "action_statement": "Vulnerability CVE-2020-10650 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "action_statement": "Vulnerability CVE-2020-10672 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "action_statement": "Vulnerability CVE-2020-10673 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "action_statement": "Vulnerability CVE-2020-10969 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "action_statement": "Vulnerability CVE-2020-11111 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "action_statement": "Vulnerability CVE-2020-11112 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "action_statement": "Vulnerability CVE-2020-11113 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "action_statement": "Vulnerability CVE-2020-11619 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "action_statement": "Vulnerability CVE-2020-11620 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-14060"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "action_statement": "Vulnerability CVE-2020-14061 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-14062"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "action_statement": "Vulnerability CVE-2020-14195 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-24616"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-24750"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-25649"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35491"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35728"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "action_statement": "Vulnerability CVE-2020-36181 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36182"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "action_statement": "Vulnerability CVE-2020-36183 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36185"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "action_statement": "Vulnerability CVE-2020-36187 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "action_statement": "Vulnerability CVE-2020-36189 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:35:10.996796+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-8840"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-9546"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "action_statement": "Vulnerability CVE-2020-9547 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-20190"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T18:52:00.040792+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2026-54512 concerns bypassing PolymorphicTypeValidator (PTV) allow-lists through generic type parameters. Version 2.9.10.1 does not have PolymorphicTypeValidator, which was introduced in version 2.10.0. This version uses SubTypeValidator with blocklists instead of PTV's allow-list mechanism. Since the vulnerable feature (PTV with allow-list functionality) does not exist in this version, the specific vulnerability cannot be exploited. The CVE explicitly states affected versions start \"From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4\", and 2.9.10.1 predates this architectural change.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "impact_statement": "CVE-2026-54512 concerns bypassing PolymorphicTypeValidator (PTV) allow-lists through generic type parameters. Version 2.9.10.1 does not have PolymorphicTypeValidator, which was introduced in version 2.10.0. This version uses SubTypeValidator with blocklists instead of PTV's allow-list mechanism. Since the vulnerable feature (PTV with allow-list functionality) does not exist in this version, the specific vulnerability cannot be exploited. The CVE explicitly states affected versions start \"From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4\", and 2.9.10.1 predates this architectural change."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      },
      "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T02:41:00.167232+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.10.1-tuxcare.3 is NOT AFFECTED by CVE-2026-54517. The vulnerability was introduced in versions >= 2.21.0 by issue #5237, which added infrastructure (`isMerging()` mechanism) to route setterless collection/map properties through the property-buffering path in property-based creators. This infrastructure does not exist in version 2.9.10.1. While the buffering code at BeanDeserializer....",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Version 2.9.10.1-tuxcare.3 is NOT AFFECTED by CVE-2026-54517. The vulnerability was introduced in versions >= 2.21.0 by issue #5237, which added infrastructure (`isMerging()` mechanism) to route setterless collection/map properties through the property-buffering path in property-based creators. This infrastructure does not exist in version 2.9.10.1. While the buffering code at BeanDeserializer...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T02:12:08.466422+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.10.1 is NOT affected by CVE-2026-54518. The vulnerability requires @JsonUnwrapped on creator parameters, a feature that is explicitly blocked in this version (BeanDeserializerBase.java:838-842). The vulnerable method UnwrappedPropertyHandler.processUnwrappedCreatorProperties() does not exist. The feature was later implemented in commit 502fe888da (issue #1467), which is NOT in this ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.9.10.1 is NOT affected by CVE-2026-54518. The vulnerability requires @JsonUnwrapped on creator parameters, a feature that is explicitly blocked in this version (BeanDeserializerBase.java:838-842). The vulnerable method UnwrappedPropertyHandler.processUnwrappedCreatorProperties() does not exist. The feature was later implemented in commit 502fe888da (issue #1467), which is NOT in this ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T01:45:02.073242+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-59888 affects Java Record deserialization when @JsonIgnore is combined with PropertyNamingStrategy. The vulnerability allows bypassing @JsonIgnore annotations on Record components when a naming strategy renames the property, because the ignored property is recorded under its pre-rename name but not propagated to the renamed key. The target version 2.9.10.1 does not support Java Records...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-59888 affects Java Record deserialization when @JsonIgnore is combined with PropertyNamingStrategy. The vulnerability allows bypassing @JsonIgnore annotations on Record components when a naming strategy renames the property, because the ignored property is recorded under its pre-rename name but not propagated to the renamed key. The target version 2.9.10.1 does not support Java Records..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.10.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:34:46.267799+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.10.1-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}