{ "@id": "urn:uuid:2b58819c-ddbf-42da-a317-af090629a4bc", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T10:44:00.030348+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.3-tuxcare.4) contains the complete fixes for CVE-2017-15095. The vulnerability involved polymorphic deserialization of dangerous gadget classes (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, Spring/C3P0 classes) that could enable arbitrary code execution. The fixes were authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10.3 release that TuxCare onboarded. SubTypeValidator.java contains all required blacklist entries plus enhanced pattern-based checks that block the vulnerable classes during deserialization. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "The target repository (jackson-databind 2.9.10.3-tuxcare.4) contains the complete fixes for CVE-2017-15095. The vulnerability involved polymorphic deserialization of dangerous gadget classes (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, Spring/C3P0 classes) that could enable arbitrary code execution. The fixes were authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10.3 release that TuxCare onboarded. SubTypeValidator.java contains all required blacklist entries plus enhanced pattern-based checks that block the vulnerable classes during deserialization. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.9.10.3 is beyond the affected range. The vulnerability involved an incomplete blacklist for polymorphic deserialization gadgets, particularly Spring framework types. The fix (databind#1737, #1855) added blacklist entries and pattern-based validation in SubTypeValidator class. This fix was applied by upstream Jackson maintainer Tatu Saloranta in commit 2235894210, shipped in jackson-databind 2.9.4. The target version 2.9.10.3 already contains this fix as part of the upstream release onboarded by TuxCare. The SubTypeValidator with all required blacklist entries and Spring pattern matching is present and active on the deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.9.10.3 is beyond the affected range. The vulnerability involved an incomplete blacklist for polymorphic deserialization gadgets, particularly Spring framework types. The fix (databind#1737, #1855) added blacklist entries and pattern-based validation in SubTypeValidator class. This fix was applied by upstream Jackson maintainer Tatu Saloranta in commit 2235894210, shipped in jackson-databind 2.9.4. The target version 2.9.10.3 already contains this fix as part of the upstream release onboarded by TuxCare. The SubTypeValidator with all required blacklist entries and Spring pattern matching is present and active on the deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is not present in jackson-databind 2.9.10.3. The vulnerability was a deserialization flaw allowing code execution via malicious JSON with polymorphic type information. The upstream fix (commit 60d459c by tatu.saloranta@iki.fi) was already present in version 2.9.10.3 when TuxCare onboarded it. The target contains SubTypeValidator with a comprehensive blacklist of dangerous classes (InvokerTransformer, InstantiateTransformer, TemplatesImpl, etc.) and BeanDeserializerFactory._validateSubType() enforces the blacklist before deserializer creation, preventing instantiation of gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 is not present in jackson-databind 2.9.10.3. The vulnerability was a deserialization flaw allowing code execution via malicious JSON with polymorphic type information. The upstream fix (commit 60d459c by tatu.saloranta@iki.fi) was already present in version 2.9.10.3 when TuxCare onboarded it. The target contains SubTypeValidator with a comprehensive blacklist of dangerous classes (InvokerTransformer, InstantiateTransformer, TemplatesImpl, etc.) and BeanDeserializerFactory._validateSubType() enforces the blacklist before deserializer creation, preventing instantiation of gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind versions 2.0.0 through 2.9.5, enabling data exfiltration via the iBatis XPathParser gadget class when default typing is enabled. The vulnerability was fixed upstream in version 2.9.6 by adding \"org.apache.ibatis.parsing.XPathParser\" to the SubTypeValidator blacklist. The target version 2.9.10.3 already contains this upstream fix (commit 27b4defc27 by Tatu Saloranta), which was present in the release before TuxCare onboarded it. The blacklist entry at SubTypeValidator.java:62 prevents deserialization of the dangerous class, blocking the attack chain. Verdict: not_affected (vulnerable code pattern not present due to upstream vendor fix).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 affects jackson-databind versions 2.0.0 through 2.9.5, enabling data exfiltration via the iBatis XPathParser gadget class when default typing is enabled. The vulnerability was fixed upstream in version 2.9.6 by adding \"org.apache.ibatis.parsing.XPathParser\" to the SubTypeValidator blacklist. The target version 2.9.10.3 already contains this upstream fix (commit 27b4defc27 by Tatu Saloranta), which was present in the release before TuxCare onboarded it. The blacklist entry at SubTypeValidator.java:62 prevents deserialization of the dangerous class, blocking the attack chain. Verdict: not_affected (vulnerable code pattern not present due to upstream vendor fix).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10.3-tuxcare.5 is NOT AFFECTED by CVE-2018-12022. The vulnerability required the ability to deserialize three specific gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled. These classes are blacklisted in SubTypeValidator.java (lines 65, 68-69), preventing their deserialization. The fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream jackson-databind 2.9.10.3 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "The target jackson-databind 2.9.10.3-tuxcare.5 is NOT AFFECTED by CVE-2018-12022. The vulnerability required the ability to deserialize three specific gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled. These classes are blacklisted in SubTypeValidator.java (lines 65, 68-69), preventing their deserialization. The fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream jackson-databind 2.9.10.3 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.9.10.3. The fix (blocklisting oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator) was already included in the upstream 2.9.10.3 release. The vulnerable pattern is not present because the upstream fix shipped before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.9.10.3. The fix (blocklisting oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator) was already included in the upstream 2.9.10.3 release. The vulnerable pattern is not present because the upstream fix shipped before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.9.10.3-tuxcare.4. The vulnerability concerns polymorphic deserialization of the dangerous class org.slf4j.ext.EventData, which could lead to arbitrary code execution. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by Tatu Saloranta, dated 2018-08-16) added org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.9.10.3 when TuxCare onboarded it (2026-09-21), confirmed by the fix commit being 2063 commits before the first TuxCare commit. The blocklist is enforced via validateSubType() called in createBeanDeserializer() before any bean deserialization occurs. CVE-2018-14718 affects versions before 2.9.7; the target version 2.9.10.3 is well beyond that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.9.10.3-tuxcare.4. The vulnerability concerns polymorphic deserialization of the dangerous class org.slf4j.ext.EventData, which could lead to arbitrary code execution. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by Tatu Saloranta, dated 2018-08-16) added org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.9.10.3 when TuxCare onboarded it (2026-09-21), confirmed by the fix commit being 2063 commits before the first TuxCare commit. The blocklist is enforced via validateSubType() called in createBeanDeserializer() before any bean deserialization occurs. CVE-2018-14718 affects versions before 2.9.7; the target version 2.9.10.3 is well beyond that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 addresses unsafe polymorphic deserialization of blaze-ds-opt/blaze-ds-core classes (and related gadgets). The upstream vendor fix adds four classes to a deserialization blocklist: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. The target repository version 2.9.10.3 already contains this fix in SubTypeValidator.java lines 72-75, introduced by upstream commit 0899726ec34 authored by Tatu Saloranta. This fix was already present in the upstream jackson-databind 2.9.10.3 release before TuxCare onboarding (commit db0c5ab03e). The vulnerable pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 addresses unsafe polymorphic deserialization of blaze-ds-opt/blaze-ds-core classes (and related gadgets). The upstream vendor fix adds four classes to a deserialization blocklist: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. The target repository version 2.9.10.3 already contains this fix in SubTypeValidator.java lines 72-75, introduced by upstream commit 0899726ec34 authored by Tatu Saloranta. This fix was already present in the upstream jackson-databind 2.9.10.3 release before TuxCare onboarding (commit db0c5ab03e). The vulnerable pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.3 is not affected by CVE-2018-14720. The upstream fix (commit 87d29af25e) that blocks four dangerous classes from polymorphic deserialization was already present in the upstream release that TuxCare onboarded. The classes org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl are in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (SubTypeValidator.java:72-75), and validation is enforced during bean deserialization (BeanDeserializerFactory.java:135,919).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "Target version 2.9.10.3 is not affected by CVE-2018-14720. The upstream fix (commit 87d29af25e) that blocks four dangerous classes from polymorphic deserialization was already present in the upstream release that TuxCare onboarded. The classes org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl are in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (SubTypeValidator.java:72-75), and validation is enforced during bean deserialization (BeanDeserializerFactory.java:135,919).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.9.10.3-tuxcare.4. The dangerous class 'org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl' is blocked from polymorphic deserialization via the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 75). This fix was part of the upstream release 2.9.10.3 (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by upstream author Tatu Saloranta) before TuxCare onboarding, removing the vulnerable code pattern. The CVE affects versions before 2.9.7, and this target is 2.9.10.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.9.10.3-tuxcare.4. The dangerous class 'org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl' is blocked from polymorphic deserialization via the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 75). This fix was part of the upstream release 2.9.10.3 (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by upstream author Tatu Saloranta) before TuxCare onboarding, removing the vulnerable code pattern. The CVE affects versions before 2.9.7, and this target is 2.9.10.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10.3-tuxcare.4 is not affected by CVE-2018-19360. The vulnerability concerns the failure to block org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization, which could allow attackers to exploit deserialization gadget chains. The fix was introduced by upstream maintainer Tatu Saloranta in commit 72cd4025 and shipped in jackson-databind 2.9.8 (November 2018). Since the target version 2.9.10.3 is based on an upstream release that already contains this fix, the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "The target jackson-databind 2.9.10.3-tuxcare.4 is not affected by CVE-2018-19360. The vulnerability concerns the failure to block org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization, which could allow attackers to exploit deserialization gadget chains. The fix was introduced by upstream maintainer Tatu Saloranta in commit 72cd4025 and shipped in jackson-databind 2.9.8 (November 2018). Since the target version 2.9.10.3 is based on an upstream release that already contains this fix, the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.3-tuxcare.5) is NOT AFFECTED by CVE-2018-19361. The vulnerability pattern (allowing polymorphic deserialization of openjpa classes) does not exist because the fix was already present in the upstream release 2.9.10.3 that TuxCare onboarded. SubTypeValidator.java contains the blocklist entries for org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime (lines 79-80), which were added by upstream commit 72cd4025a2 authored by Tatu Saloranta. This fix shipped with the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "The target repository (jackson-databind 2.9.10.3-tuxcare.5) is NOT AFFECTED by CVE-2018-19361. The vulnerability pattern (allowing polymorphic deserialization of openjpa classes) does not exist because the fix was already present in the upstream release 2.9.10.3 that TuxCare onboarded. SubTypeValidator.java contains the blocklist entries for org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime (lines 79-80), which were added by upstream commit 72cd4025a2 authored by Tatu Saloranta. This fix shipped with the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.3-tuxcare.4) is NOT vulnerable to CVE-2018-19362. The fix for this vulnerability was already present in the upstream release 2.9.10.3 when TuxCare onboarded it. The vulnerable code pattern (allowing polymorphic deserialization of org.jboss.util.propertyeditor.DocumentEditor) has been removed by the upstream vendor fix in commit 72cd4025a2, which added the dangerous jboss-common-core class to the blocklist in SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "The target repository (jackson-databind 2.9.10.3-tuxcare.4) is NOT vulnerable to CVE-2018-19362. The fix for this vulnerability was already present in the upstream release 2.9.10.3 when TuxCare onboarded it. The vulnerable code pattern (allowing polymorphic deserialization of org.jboss.util.propertyeditor.DocumentEditor) has been removed by the upstream vendor fix in commit 72cd4025a2, which added the dangerous jboss-common-core class to the blocklist in SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.9.10.3-tuxcare.5 is NOT AFFECTED by CVE-2018-5968. The vulnerability involves two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that can bypass a blacklist for remote code execution. The upstream fix, which adds these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, was already present in the upstream release 2.9.10.3 that TuxCare onboarded. The fix commit (038b471e2efde2e8f96b4e0be958d3e5a1ff1d05) was authored by upstream maintainer Tatu Saloranta on 2018-01-21 and was included in upstream version 2.8.11.1, which later merged into the 2.9.x branch. The target version 2.9.10.3 is also beyond the CVE's affected version range (through 2.9.3).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "The target repository jackson-databind version 2.9.10.3-tuxcare.5 is NOT AFFECTED by CVE-2018-5968. The vulnerability involves two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that can bypass a blacklist for remote code execution. The upstream fix, which adds these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, was already present in the upstream release 2.9.10.3 that TuxCare onboarded. The fix commit (038b471e2efde2e8f96b4e0be958d3e5a1ff1d05) was authored by upstream maintainer Tatu Saloranta on 2018-01-21 and was included in upstream version 2.8.11.1, which later merged into the 2.9.x branch. The target version 2.9.10.3 is also beyond the CVE's affected version range (through 2.9.3).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 (jackson-databind c3p0 deserialization RCE) is not present in this target. The vulnerability required c3p0 DataSource classes to bypass the blacklist during default-typing deserialization. The fix (pattern-based blocking: reject classes matching \"com.mchange.v2.c3p0.*DataSource\") was authored by upstream maintainer Tatu Saloranta in commit 6799f8f10c (Feb 2018, for version 2.7.9.3). This fix was already present in the upstream 2.9.10.3 release that TuxCare onboarded (commit db0c5ab03e, March 2020). The vulnerable code pattern was never present in the TuxCare-maintained version. Defense confirmed at SubTypeValidator.java:243-252, reachable via BeanDeserializerFactory._validateSubType during all default-typing deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 (jackson-databind c3p0 deserialization RCE) is not present in this target. The vulnerability required c3p0 DataSource classes to bypass the blacklist during default-typing deserialization. The fix (pattern-based blocking: reject classes matching \"com.mchange.v2.c3p0.*DataSource\") was authored by upstream maintainer Tatu Saloranta in commit 6799f8f10c (Feb 2018, for version 2.7.9.3). This fix was already present in the upstream 2.9.10.3 release that TuxCare onboarded (commit db0c5ab03e, March 2020). The vulnerable code pattern was never present in the TuxCare-maintained version. Defense confirmed at SubTypeValidator.java:243-252, reachable via BeanDeserializerFactory._validateSubType during all default-typing deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is not present in jackson-databind 2.9.10.3-tuxcare.5. The vulnerability allowed polymorphic deserialization of com.mysql.cj.jdbc.admin.MiniAdmin class to read arbitrary files when Default Typing was enabled. The fix was included in upstream version 2.9.9 (released May 2019) by adding MiniAdmin to the deserialization blocklist in SubTypeValidator.java. The target version 2.9.10.3 onboarded by TuxCare already contains this upstream fix at line 85 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta, not by TuxCare/CloudLinux.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 is not present in jackson-databind 2.9.10.3-tuxcare.5. The vulnerability allowed polymorphic deserialization of com.mysql.cj.jdbc.admin.MiniAdmin class to read arbitrary files when Default Typing was enabled. The fix was included in upstream version 2.9.9 (released May 2019) by adding MiniAdmin to the deserialization blocklist in SubTypeValidator.java. The target version 2.9.10.3 onboarded by TuxCare already contains this upstream fix at line 85 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta, not by TuxCare/CloudLinux.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is not present in jackson-databind 2.9.10.3-tuxcare.4. The vulnerability requires the absence of a blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource in the SubTypeValidator class. The target contains this blocklist entry at line 87 of SubTypeValidator.java, which prevents polymorphic deserialization of the dangerous logback-core class. This fix was authored...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 is not present in jackson-databind 2.9.10.3-tuxcare.4. The vulnerability requires the absence of a blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource in the SubTypeValidator class. The target contains this blocklist entry at line 87 of SubTypeValidator.java, which prevents polymorphic deserialization of the dangerous logback-core class. This fix was authored..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.9.10.3. The vulnerability affects versions 2.x through 2.9.9, allowing arbitrary file reads via JDOM XSLTransformer classes when Default Typing is enabled. The target version 2.9.10.3 contains the upstream fix (commit 5f7c69bba07) that adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.9.10.3. The vulnerability affects versions 2.x through 2.9.9, allowing arbitrary file reads via JDOM XSLTransformer classes when Default Typing is enabled. The target version 2.9.10.3 contains the upstream fix (commit 5f7c69bba07) that adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.9.10.3-tuxcare.4. The vulnerability concerns unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled. The upstream vendor fix (commit ad418eeb97 by Tatu Saloranta) added this class to the SubTypeValidator blacklist, and this fix was already included in the upstream 2.9.10.3 release that TuxCare onboarded. The target repository contains the complete fix at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java lines 93-95, blocking deserialization of the dangerous ehcache class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.9.10.3-tuxcare.4. The vulnerability concerns unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled. The upstream vendor fix (commit ad418eeb97 by Tatu Saloranta) added this class to the SubTypeValidator blacklist, and this fix was already included in the upstream 2.9.10.3 release that TuxCare onboarded. The target repository contains the complete fix at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java lines 93-95, blocking deserialization of the dangerous ehcache class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 when Default Typing is enabled and logback is in the classpath. The target repository is version 2.9.10.3-tuxcare.4, which already contains the upstream fix. The vulnerable classes (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) are blacklisted in SubTypeValidator.java at lines 94 and 98. The fix commit (ad418eeb97) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.9.10.3 release that TuxCare onboarded. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 when Default Typing is enabled and logback is in the classpath. The target repository is version 2.9.10.3-tuxcare.4, which already contains the upstream fix. The vulnerable classes (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) are blacklisted in SubTypeValidator.java at lines 94 and 98. The fix commit (ad418eeb97) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.9.10.3 release that TuxCare onboarded. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.3-tuxcare.2) is NOT AFFECTED by CVE-2019-14540. The vulnerability, which involved polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes, has been fixed by the upstream vendor (FasterXML). The fix was already present in the upstream release 2.9.10.3 that TuxCare onboarded, as evidenced by commits d4983c740 and 73c1c2cc7 being ancestors of the first TuxCare onboarding commit (db0c5ab03). The SubTypeValidator.java file contains the required blocklist entries at lines 101 and 103, preventing deserialization of these dangerous classes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "The target repository (jackson-databind 2.9.10.3-tuxcare.2) is NOT AFFECTED by CVE-2019-14540. The vulnerability, which involved polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes, has been fixed by the upstream vendor (FasterXML). The fix was already present in the upstream release 2.9.10.3 that TuxCare onboarded, as evidenced by commits d4983c740 and 73c1c2cc7 being ancestors of the first TuxCare onboarding commit (db0c5ab03). The SubTypeValidator.java file contains the required blocklist entries at lines 101 and 103, preventing deserialization of these dangerous classes." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.9.10.3-tuxcare.2 is not affected by CVE-2019-14892. The fix that blocks polymorphic deserialization of commons-configuration JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) is present in SubTypeValidator.java at lines 108-110. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 41b7f9b90 and shipped in upstream release 2.9.10.3, before TuxCare's first onboarding commit. The CVE affects versions before 2.9.10, and this target is version 2.9.10.3 with the upstream fix already applied.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "The target jackson-databind version 2.9.10.3-tuxcare.2 is not affected by CVE-2019-14892. The fix that blocks polymorphic deserialization of commons-configuration JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) is present in SubTypeValidator.java at lines 108-110. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 41b7f9b90 and shipped in upstream release 2.9.10.3, before TuxCare's first onboarding commit. The CVE affects versions before 2.9.10, and this target is version 2.9.10.3 with the upstream fix already applied." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.3-tuxcare.2) is NOT AFFECTED by CVE-2019-14893. The vulnerability, which allowed arbitrary code execution via polymorphic deserialization of the xalan JNDI gadget class `org.apache.xalan.lib.sql.JNDIConnectionPool`, has been mitigated by the upstream vendor. The fix (adding the dangerous class to the deserialization blacklist in SubTypeValidator.java) was already present in the upstream release 2.9.10.3 that TuxCare onboarded. The fix commit (998efd708, \"Fix #2469\") was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and is an ancestor of the current HEAD. The blacklist entry at line 113 and validation logic at lines 168-203 successfully block deserialization of the malicious class, preventing the attack chain from input to arbitrary code execution.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "The target repository (jackson-databind 2.9.10.3-tuxcare.2) is NOT AFFECTED by CVE-2019-14893. The vulnerability, which allowed arbitrary code execution via polymorphic deserialization of the xalan JNDI gadget class `org.apache.xalan.lib.sql.JNDIConnectionPool`, has been mitigated by the upstream vendor. The fix (adding the dangerous class to the deserialization blacklist in SubTypeValidator.java) was already present in the upstream release 2.9.10.3 that TuxCare onboarded. The fix commit (998efd708, \"Fix #2469\") was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and is an ancestor of the current HEAD. The blacklist entry at line 113 and validation logic at lines 168-203 successfully block deserialization of the malicious class, preventing the attack chain from input to arbitrary code execution." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 concerns a polymorphic deserialization vulnerability in Jackson-databind where specifying \"com.zaxxer.hikari.HikariDataSource\" in JSON type metadata would enable gadget-chain attacks for RCE/information disclosure. The target repository (jackson-databind 2.9.10.3-tuxcare.2) already contains the upstream fix. The blocklist entry for HikariDataSource is present at SubTypeValidator.java:102-103, preventing instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.10.3 before TuxCare onboarded that version. The vulnerable pattern does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 concerns a polymorphic deserialization vulnerability in Jackson-databind where specifying \"com.zaxxer.hikari.HikariDataSource\" in JSON type metadata would enable gadget-chain attacks for RCE/information disclosure. The target repository (jackson-databind 2.9.10.3-tuxcare.2) already contains the upstream fix. The blocklist entry for HikariDataSource is present at SubTypeValidator.java:102-103, preventing instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.10.3 before TuxCare onboarded that version. The vulnerable pattern does not exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is NOT present in jackson-databind 2.9.10.3-tuxcare.4. The upstream fix (adding PerUserPoolDataSource and SharedPoolDataSource to the SubTypeValidator blocklist) was already included in the upstream 2.9.10.1 release, which predates the 2.9.10.3 version that TuxCare onboarded. The target repository contains the complete fix at SubTypeValidator.java lines 120-121, preventing deserialization of the dangerous commons-dbcp classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 is NOT present in jackson-databind 2.9.10.3-tuxcare.4. The upstream fix (adding PerUserPoolDataSource and SharedPoolDataSource to the SubTypeValidator blocklist) was already included in the upstream 2.9.10.1 release, which predates the 2.9.10.3 version that TuxCare onboarded. The target repository contains the complete fix at SubTypeValidator.java lines 120-121, preventing deserialization of the dangerous commons-dbcp classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.9.10.3-tuxcare.5 is NOT AFFECTED by CVE-2019-16943. The vulnerability was fixed in upstream version 2.9.10.1, and the target is based on upstream version 2.9.10.3 which already contains the fix. The fix (commit 9593e16cf5) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded via commit db0c5ab03e. The SubTypeValidator.java blocklist contains all three dangerous classes: com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, and org.apache.commons.dbcp.datasources.SharedPoolDataSource.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "The target jackson-databind version 2.9.10.3-tuxcare.5 is NOT AFFECTED by CVE-2019-16943. The vulnerability was fixed in upstream version 2.9.10.1, and the target is based on upstream version 2.9.10.3 which already contains the fix. The fix (commit 9593e16cf5) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded via commit db0c5ab03e. The SubTypeValidator.java blocklist contains all three dangerous classes: com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, and org.apache.commons.dbcp.datasources.SharedPoolDataSource.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is NOT AFFECTED in jackson-databind 2.9.10.3-tuxcare.2. The vulnerability involves polymorphic deserialization of the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf8, September 19, 2019) added this class to the blocklist in SubTypeValidator.java (line 95), preventing its instantiation during polymorphic deserialization. This fix was already present in the upstream version 2.9.10.3 when TuxCare onboarded it on September 21, 2026 (commit db0c5ab0). The fix is tagged in jackson-databind-2.9.10, 2.9.10.1, 2.9.10.2, and 2.9.10.3. The target repository inherits this protection from the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 is NOT AFFECTED in jackson-databind 2.9.10.3-tuxcare.2. The vulnerability involves polymorphic deserialization of the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf8, September 19, 2019) added this class to the blocklist in SubTypeValidator.java (line 95), preventing its instantiation during polymorphic deserialization. This fix was already present in the upstream version 2.9.10.3 when TuxCare onboarded it on September 21, 2026 (commit db0c5ab0). The fix is tagged in jackson-databind-2.9.10, 2.9.10.1, 2.9.10.2, and 2.9.10.3. The target repository inherits this protection from the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1. The target repository is version 2.9.10.3-tuxcare.4, which includes the upstream fix that was released in version 2.9.10.1 on October 19, 2019. The fix adds blocklist entries for org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to prevent their deserialization. These entries are confirmed present in SubTypeValidator.java at lines 147-148. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.9.10.3 in September 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1. The target repository is version 2.9.10.3-tuxcare.4, which includes the upstream fix that was released in version 2.9.10.1 on October 19, 2019. The fix adds blocklist entries for org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to prevent their deserialization. These entries are confirmed present in SubTypeValidator.java at lines 147-148. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.9.10.3 in September 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.3 already contains the fix for CVE-2019-20330. The fix was shipped in the upstream jackson-databind 2.9.10.3 release by Tatu Saloranta (commit fc4214a883dc087070f25da738ef0d49c2f3387e) before TuxCare onboarded this version. The vulnerable code pattern is not present - the SubTypeValidator blocklist includes both net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and net.sf.ehcache.transaction.manager.selector.GlassfishSelector, preventing deserialization-based exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "Target version 2.9.10.3 already contains the fix for CVE-2019-20330. The fix was shipped in the upstream jackson-databind 2.9.10.3 release by Tatu Saloranta (commit fc4214a883dc087070f25da738ef0d49c2f3387e) before TuxCare onboarded this version. The vulnerable code pattern is not present - the SubTypeValidator blocklist includes both net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and net.sf.ehcache.transaction.manager.selector.GlassfishSelector, preventing deserialization-based exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-10650 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10650" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:44:00.030348+00:00", "status_notes": "Vulnerability CVE-2020-10672 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10672" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:44:00.030348+00:00", "status_notes": "Vulnerability CVE-2020-10673 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10673" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-10969 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10969" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-11111 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11111" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-11112 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11112" }, "action_statement": "Vulnerability CVE-2020-11112 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-11113 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11113" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-11619 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11619" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:44:00.030348+00:00", "status_notes": "Vulnerability CVE-2020-11620 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11620" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-14061 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-14062 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:44:00.030348+00:00", "status_notes": "Vulnerability CVE-2020-14195 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14195" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is NOT present in the target repository. The vulnerability affects jackson-databind versions lacking JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The fix (commit 914e7c9) that adds this class to the deserialization blocklist was already included in the upstream 2.9.10.3 release, which this TuxCare repository is based on. The blocking code is present at SubTypeValidator.java:156 and is actively enforced during polymorphic deserialization via an unmodifiable blocklist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 is NOT present in the target repository. The vulnerability affects jackson-databind versions lacking JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The fix (commit 914e7c9) that adds this class to the deserialization blocklist was already included in the upstream 2.9.10.3 release, which this TuxCare repository is based on. The blocking code is present at SubTypeValidator.java:156 and is actively enforced during polymorphic deserialization via an unmodifiable blocklist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-9546 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9546" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-9547 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9547" }, "action_statement": "Vulnerability CVE-2020-9547 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2021-20190 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:44:00.030348+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.10.3 is not affected by CVE-2026-54512. The vulnerability requires PolymorphicTypeValidator (PTV) with configurable allow-lists, introduced in version 2.10.0. Version 2.9.10.3 predates PTV and uses SubTypeValidator with a hardcoded deny-list instead. The vulnerable method DatabindContext._resolveAndValidateGeneric() does not exist in this version. CVE-2026-54512 describes bypassing PTV's allow-list validation by hiding denied classes as generic type parameters - a mechanism that cannot occur when PTV doesn't exist. Git history confirms PTV introduction in commit 61ffa3aaa (April 2019) for version 2.10.0. No backport of CVE-2026-54512 to 2.9.10.3 exists, while backports to 2.14.1, 2.14.2, 2.17.2, and 2.17.3 confirm TuxCare assessed 2.9.x as unaffected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.9.10.3 is not affected by CVE-2026-54512. The vulnerability requires PolymorphicTypeValidator (PTV) with configurable allow-lists, introduced in version 2.10.0. Version 2.9.10.3 predates PTV and uses SubTypeValidator with a hardcoded deny-list instead. The vulnerable method DatabindContext._resolveAndValidateGeneric() does not exist in this version. CVE-2026-54512 describes bypassing PTV's allow-list validation by hiding denied classes as generic type parameters - a mechanism that cannot occur when PTV doesn't exist. Git history confirms PTV introduction in commit 61ffa3aaa (April 2019) for version 2.10.0. No backport of CVE-2026-54512 to 2.9.10.3 exists, while backports to 2.14.1, 2.14.2, 2.17.2, and 2.17.3 confirm TuxCare assessed 2.9.x as unaffected." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54518 targets unwrapped creator parameters (@JsonUnwrapped on constructor parameters), a feature introduced after version 2.9.10.3. The target version explicitly rejects unwrapped creator parameters with InvalidDefinitionException (test: UnwrappedCreatorParam265Test.java). The vulnerable method UnwrappedPropertyHandler.processUnwrappedCreatorProperties() does not exist in 2.9.10.3. The...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 CVE-2026-54518 targets unwrapped creator parameters (@JsonUnwrapped on constructor parameters), a feature introduced after version 2.9.10.3. The target version explicitly rejects unwrapped creator parameters with InvalidDefinitionException (test: UnwrappedCreatorParam265Test.java). The vulnerable method UnwrappedPropertyHandler.processUnwrappedCreatorProperties() does not exist in 2.9.10.3. The..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-59888 affects Java Records deserialization with @JsonIgnore and PropertyNamingStrategy. The target version 2.9.10.3 predates Java Records (introduced in Java 14/16) and lacks Jackson Records support (added in 2.12+). The target compiles to Java 7 and contains no Records-handling code (no RecordComponent, isRecordType APIs). The vulnerability is Record-specific; the patch test confirms ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 CVE-2026-59888 affects Java Records deserialization with @JsonIgnore and PropertyNamingStrategy. The target version 2.9.10.3 predates Java Records (introduced in Java 14/16) and lacks Jackson Records support (added in 2.12+). The target compiles to Java 7 and contains no Records-handling code (no RecordComponent, isRecordType APIs). The vulnerability is Record-specific; the patch test confirms ..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:44:00.030348+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.10.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.8" } } ], "timestamp": "2026-11-10T10:43:02.819546+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.10.3-tuxcare.8.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }