{ "@id": "urn:uuid:265f903b-87f5-4a52-a855-de3f929d02df", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-09T14:18:45.877647+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.9.10.5 contains the upstream fix that introduced SubTypeValidator.java with a comprehensive blacklist of dangerous classes, including all classes from issue #1737 (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring framework classes, and c3p0 DataSource classes). The fix was introduced by upstream commit 2235894210 and was already present in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.9.10.5 contains the upstream fix that introduced SubTypeValidator.java with a comprehensive blacklist of dangerous classes, including all classes from issue #1737 (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring framework classes, and c3p0 DataSource classes). The fix was introduced by upstream commit 2235894210 and was already present in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is NOT present in jackson-databind 2.9.10.5-tuxcare.1. The upstream vendor (FasterXML) shipped comprehensive fixes for this CVE in release 2.9.10.5, which TuxCare later onboarded. The target contains SubTypeValidator.java with complete blacklist validation blocking all CVE-2017-17485 gadget classes (Spring framework types via pattern matching for AbstractPointcutAdvisor/AbstractApplicationContext, C3P0 DataSource classes, Tomcat DBCP, BCEL ClassLoader, JDK FileHandler/UnicastRemoteObject, and others). BeanDeserializerFactory properly integrates this validation at line 135, preventing polymorphic deserialization of dangerous types. All five fix commits (e865a7a446, f031f27a31, 2235894210, 978798382c, bb45fb1670) authored by upstream contributors are ancestors of TuxCare's onboarding commit d3e245d364, confirming these fixes shipped in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 is NOT present in jackson-databind 2.9.10.5-tuxcare.1. The upstream vendor (FasterXML) shipped comprehensive fixes for this CVE in release 2.9.10.5, which TuxCare later onboarded. The target contains SubTypeValidator.java with complete blacklist validation blocking all CVE-2017-17485 gadget classes (Spring framework types via pattern matching for AbstractPointcutAdvisor/AbstractApplicationContext, C3P0 DataSource classes, Tomcat DBCP, BCEL ClassLoader, JDK FileHandler/UnicastRemoteObject, and others). BeanDeserializerFactory properly integrates this validation at line 135, preventing polymorphic deserialization of dangerous types. All five fix commits (e865a7a446, f031f27a31, 2235894210, 978798382c, bb45fb1670) authored by upstream contributors are ancestors of TuxCare's onboarding commit d3e245d364, confirming these fixes shipped in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 targets unsafe deserialization of malicious JSON that instantiates dangerous gadget classes (TemplatesImpl, InvokerTransformer, etc.) via polymorphic type handling. The target jackson-databind 2.9.10.5 is NOT AFFECTED because the upstream vendor fix is already present. The fix is implemented in SubTypeValidator.java (lines 30-303), which maintains a blacklist of dangerous classes (DEFAULT_NO_DESER_CLASS_NAMES) and blocks their deserialization in validateSubType(). This defense is invoked from BeanDeserializerFactory.createBeanDeserializer() at line 135 via _validateSubType(). The fix was introduced by upstream maintainer Tatu Saloranta in commits 6ce32ffd18 (April 2017, #1599) and later refactored into SubTypeValidator in commit 2235894210 (December 2017, #1855). All fix commits shipped in the upstream 2.9.x release before TuxCare onboarding (first TuxCare commit: a7a5ae30).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 targets unsafe deserialization of malicious JSON that instantiates dangerous gadget classes (TemplatesImpl, InvokerTransformer, etc.) via polymorphic type handling. The target jackson-databind 2.9.10.5 is NOT AFFECTED because the upstream vendor fix is already present. The fix is implemented in SubTypeValidator.java (lines 30-303), which maintains a blacklist of dangerous classes (DEFAULT_NO_DESER_CLASS_NAMES) and blocks their deserialization in validateSubType(). This defense is invoked from BeanDeserializerFactory.createBeanDeserializer() at line 135 via _validateSubType(). The fix was introduced by upstream maintainer Tatu Saloranta in commits 6ce32ffd18 (April 2017, #1599) and later refactored into SubTypeValidator in commit 2235894210 (December 2017, #1855). All fix commits shipped in the upstream 2.9.x release before TuxCare onboarding (first TuxCare commit: a7a5ae30).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind versions 2.0.0 through 2.9.5, exploiting polymorphic deserialization with the iBatis XPathParser gadget class to achieve data exfiltration via XML External Entity (XXE) processing. The target version 2.9.10.5 is NOT affected because the upstream fix (adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist in SubTypeValidator.java) was already present in the upstream 2.9.10.5 release before TuxCare onboarded it. The fix commit (27b4defc270454dea6842bd9279f17387eceb737) by upstream maintainer Tatu Saloranta is an ancestor of TuxCare's first commit (d3e245d364 \"setup 2.9.10.5\"), confirming this is an upstream fix that shipped with the original release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 affects jackson-databind versions 2.0.0 through 2.9.5, exploiting polymorphic deserialization with the iBatis XPathParser gadget class to achieve data exfiltration via XML External Entity (XXE) processing. The target version 2.9.10.5 is NOT affected because the upstream fix (adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist in SubTypeValidator.java) was already present in the upstream 2.9.10.5 release before TuxCare onboarded it. The fix commit (27b4defc270454dea6842bd9279f17387eceb737) by upstream maintainer Tatu Saloranta is an ancestor of TuxCare's first commit (d3e245d364 \"setup 2.9.10.5\"), confirming this is an upstream fix that shipped with the original release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is NOT present in jackson-databind 2.9.10.5. The vulnerability involves polymorphic deserialization of Jodd-db classes that enable LDAP-based attacks when Default Typing is enabled. The upstream vendor fix (adding `jodd.db.connection.DataSourceConnectionProvider` and related Oracle JDBC classes to the SubTypeValidator blocklist) was already present in the upstream 2.9.10.5 release before TuxCare onboarded it. The blocklist at SubTypeValidator.java:67-72 prevents deserialization of these dangerous classes, blocking the attack path from malicious JSON input to remote service connection exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 is NOT present in jackson-databind 2.9.10.5. The vulnerability involves polymorphic deserialization of Jodd-db classes that enable LDAP-based attacks when Default Typing is enabled. The upstream vendor fix (adding `jodd.db.connection.DataSourceConnectionProvider` and related Oracle JDBC classes to the SubTypeValidator blocklist) was already present in the upstream 2.9.10.5 release before TuxCare onboarded it. The blocklist at SubTypeValidator.java:67-72 prevents deserialization of these dangerous classes, blocking the attack path from malicious JSON input to remote service connection exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is not present in jackson-databind 2.9.10.5. The vulnerability requires Default Typing to be enabled and allows arbitrary code execution via Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that trigger LDAP connections during deserialization. The upstream vendor (FasterXML) fixed this in commit 28badf7ef6 by adding these Oracle JDBC class names to the SubTypeValidator blacklist. This fix was already present in the upstream 2.9.10.5 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (d3e245d364 \"setup 2.9.10.5\"). The defensive code is present at lines 71-72 of SubTypeValidator.java and is on the execution path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is not present in jackson-databind 2.9.10.5. The vulnerability requires Default Typing to be enabled and allows arbitrary code execution via Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that trigger LDAP connections during deserialization. The upstream vendor (FasterXML) fixed this in commit 28badf7ef6 by adding these Oracle JDBC class names to the SubTypeValidator blacklist. This fix was already present in the upstream 2.9.10.5 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (d3e245d364 \"setup 2.9.10.5\"). The defensive code is present at lines 71-72 of SubTypeValidator.java and is on the execution path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 affects jackson-databind versions before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 by allowing arbitrary code execution via polymorphic deserialization of the org.slf4j.ext.EventData gadget class. The target repository (jackson-databind version 2.9.10.5) is NOT AFFECTED because the fix was already present in the upstream release. The fix adds org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 75), which is actively checked during polymorphic deserialization (BeanDeserializerFactory.java line 135 calls SubTypeValidator.validateSubType at line 919). This fix was introduced in upstream version 2.9.7 by commit 87d29af25e authored by Tatu Saloranta (tatu.saloranta@iki.fi), and was already included in the upstream release 2.9.10.5 that TuxCare onboarded (the fix commit is an ancestor of the first TuxCare commit d3e245d364 \"setup 2.9.10.5\"). The vulnerable pattern (absence of the blocklist entry) no longer exists in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 affects jackson-databind versions before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 by allowing arbitrary code execution via polymorphic deserialization of the org.slf4j.ext.EventData gadget class. The target repository (jackson-databind version 2.9.10.5) is NOT AFFECTED because the fix was already present in the upstream release. The fix adds org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 75), which is actively checked during polymorphic deserialization (BeanDeserializerFactory.java line 135 calls SubTypeValidator.validateSubType at line 919). This fix was introduced in upstream version 2.9.7 by commit 87d29af25e authored by Tatu Saloranta (tatu.saloranta@iki.fi), and was already included in the upstream release 2.9.10.5 that TuxCare onboarded (the fix commit is an ancestor of the first TuxCare commit d3e245d364 \"setup 2.9.10.5\"). The vulnerable pattern (absence of the blocklist entry) no longer exists in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7 by failing to block BlazeDS classes (flex.messaging.*) from polymorphic deserialization. The target repository is at version 2.9.10.5-tuxcare.1, which already contains the upstream vendor's fix. The blocklist entry for \"flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor\" was added by upstream commit 87d29af25e82a249ea15858e2d4ecbf64091db44 (authored by tatu.saloranta@iki.fi) and was included in the upstream 2.9.10.5 release before TuxCare onboarded it. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7 by failing to block BlazeDS classes (flex.messaging.*) from polymorphic deserialization. The target repository is at version 2.9.10.5-tuxcare.1, which already contains the upstream vendor's fix. The blocklist entry for \"flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor\" was added by upstream commit 87d29af25e82a249ea15858e2d4ecbf64091db44 (authored by tatu.saloranta@iki.fi) and was included in the upstream 2.9.10.5 release before TuxCare onboarded it. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 concerns polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks. The upstream vendor (FasterXML) fix commit 87d29af25e blocks these classes in SubTypeValidator.java lines 75-78, and this fix was already present in the upstream release 2.9.10.5 that TuxCare onboarded. The vulnerable pattern is not present in the target because the defense was shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 concerns polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks. The upstream vendor (FasterXML) fix commit 87d29af25e blocks these classes in SubTypeValidator.java lines 75-78, and this fix was already present in the upstream release 2.9.10.5 that TuxCare onboarded. The vulnerable pattern is not present in the target because the defense was shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT affecting this target. The vulnerable pattern (polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl allowing SSRF) is not present because the upstream vendor (FasterXML) already included the fix in version 2.9.10.5. The class is blocked in SubTypeValidator.java:78 within the DEFAULT_NO_DESER_CLASS_NAMES blocklist. The fix commit (87d29af25e) authored by Tatu Saloranta was already in the upstream release when TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 is NOT affecting this target. The vulnerable pattern (polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl allowing SSRF) is not present because the upstream vendor (FasterXML) already included the fix in version 2.9.10.5. The class is blocked in SubTypeValidator.java:78 within the DEFAULT_NO_DESER_CLASS_NAMES blocklist. The fix commit (87d29af25e) authored by Tatu Saloranta was already in the upstream release when TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 does not affect this target. The vulnerability involved missing blocklist entries for four gadget classes (org.jboss.util.propertyeditor.DocumentEditor, org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime, org.apache.axis2.transport.jms.JMSOutTransportInfo) that could enable arbitrary code execution via polymorphic deserialization. The upstream fix (commit 72cd4025a2) adding these blocklist entries was already present in the upstream release 2.9.10.5 that TuxCare onboarded. The target's SubTypeValidator.java (lines 81-85) contains all four blocklist entries, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 does not affect this target. The vulnerability involved missing blocklist entries for four gadget classes (org.jboss.util.propertyeditor.DocumentEditor, org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime, org.apache.axis2.transport.jms.JMSOutTransportInfo) that could enable arbitrary code execution via polymorphic deserialization. The upstream fix (commit 72cd4025a2) adding these blocklist entries was already present in the upstream release 2.9.10.5 that TuxCare onboarded. The target's SubTypeValidator.java (lines 81-85) contains all four blocklist entries, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.9.10.5 is NOT affected by CVE-2018-19361. The vulnerability concerns polymorphic deserialization of OpenJPA classes that could lead to arbitrary code execution. The fix (blocking OpenJPA classes org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime from deserialization) was applied by the upstream vendor (Tatu Saloranta) in commit 42912cac47 and shipped in jackson-databind 2.7.9.5/2.9.8. This fix was already present in the upstream release when TuxCare onboarded version 2.9.10.5, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "The target repository jackson-databind version 2.9.10.5 is NOT affected by CVE-2018-19361. The vulnerability concerns polymorphic deserialization of OpenJPA classes that could lead to arbitrary code execution. The fix (blocking OpenJPA classes org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime from deserialization) was applied by the upstream vendor (Tatu Saloranta) in commit 42912cac47 and shipped in jackson-databind 2.7.9.5/2.9.8. This fix was already present in the upstream release when TuxCare onboarded version 2.9.10.5, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is not present in jackson-databind 2.9.10.5. The vulnerability involves polymorphic deserialization of org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core, which could enable arbitrary code execution via gadget chains. The fix (adding DocumentEditor to the deserialization blocklist in SubTypeValidator.java) was already present in the upstream release 2.9.10.5 that TuxCare onboarded. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commit 72cd4025a2 on 2018-11-19, which predates the first TuxCare commit d3e245d364 (setup 2.9.10.5). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 is not present in jackson-databind 2.9.10.5. The vulnerability involves polymorphic deserialization of org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core, which could enable arbitrary code execution via gadget chains. The fix (adding DocumentEditor to the deserialization blocklist in SubTypeValidator.java) was already present in the upstream release 2.9.10.5 that TuxCare onboarded. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commit 72cd4025a2 on 2018-11-19, which predates the first TuxCare commit d3e245d364 (setup 2.9.10.5). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.5 is not affected by CVE-2018-5968. The upstream vendor (FasterXML) fixed this vulnerability in version 2.8.11.1/2.9.4 by adding two class names (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to the deserialization blacklist in SubTypeValidator.java. This fix (commit 038b471e2e by Tatu Saloranta) was included in the upstream jackson-databind 2.9.10 release, which TuxCare onboarded as the base for version 2.9.10.5. The vulnerable pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "Target version 2.9.10.5 is not affected by CVE-2018-5968. The upstream vendor (FasterXML) fixed this vulnerability in version 2.8.11.1/2.9.4 by adding two class names (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to the deserialization blacklist in SubTypeValidator.java. This fix (commit 038b471e2e by Tatu Saloranta) was included in the upstream jackson-databind 2.9.10 release, which TuxCare onboarded as the base for version 2.9.10.5. The vulnerable pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.9.10.5-tuxcare.1. The vulnerability affects versions before 2.9.5, and the upstream fix was introduced in version 2.9.5 by commit 6799f8f10c (authored by tatu.saloranta@iki.fi). The target version 2.9.10.5 inherits this fix from the upstream release. The SubTypeValidator.java file contains the complete c3p0 blocking logic that prevents deserialization of dangerous c3p0 DataSource classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.9.10.5-tuxcare.1. The vulnerability affects versions before 2.9.5, and the upstream fix was introduced in version 2.9.5 by commit 6799f8f10c (authored by tatu.saloranta@iki.fi). The target version 2.9.10.5 inherits this fix from the upstream release. The SubTypeValidator.java file contains the complete c3p0 blocking logic that prevents deserialization of dangerous c3p0 DataSource classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 describes a polymorphic deserialization vulnerability in jackson-databind versions before 2.9.9, where an attacker could exploit the mysql-connector-java MiniAdmin gadget to read arbitrary files. The target repository (jackson-databind 2.9.10.5) is NOT AFFECTED because the upstream vendor fix is already present. Line 88 of SubTypeValidator.java contains the fix: s.add(\"com.mysql.cj.jdbc.admin.MiniAdmin\"), which blocks this gadget class from deserialization. This fix was introduced in version 2.9.9 (commit dda513bd7251b4f32b7b60b1c13740e3b5a43024 by Tatu Saloranta) and shipped in the upstream 2.9.10.5 release that TuxCare onboarded. The vulnerable code pattern (missing MiniAdmin validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 describes a polymorphic deserialization vulnerability in jackson-databind versions before 2.9.9, where an attacker could exploit the mysql-connector-java MiniAdmin gadget to read arbitrary files. The target repository (jackson-databind 2.9.10.5) is NOT AFFECTED because the upstream vendor fix is already present. Line 88 of SubTypeValidator.java contains the fix: s.add(\"com.mysql.cj.jdbc.admin.MiniAdmin\"), which blocks this gadget class from deserialization. This fix was introduced in version 2.9.9 (commit dda513bd7251b4f32b7b60b1c13740e3b5a43024 by Tatu Saloranta) and shipped in the upstream 2.9.10.5 release that TuxCare onboarded. The vulnerable code pattern (missing MiniAdmin validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository (jackson-databind 2.9.10.5-tuxcare.1) is NOT affected by CVE-2019-12384. The vulnerability concerns unsafe polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource. The fix was added to the upstream codebase in version 2.9.9.1 (commit c9ef4a10d6f by Tatu Saloranta on 2019-06-12) and is present in the target version. The blo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 The target repository (jackson-databind 2.9.10.5-tuxcare.1) is NOT affected by CVE-2019-12384. The vulnerability concerns unsafe polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource. The fix was added to the upstream codebase in version 2.9.9.1 (commit c9ef4a10d6f by Tatu Saloranta on 2019-06-12) and is present in the target version. The blo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.9.10.5 is NOT affected by CVE-2019-12814. The upstream fix (commit 5f7c69bba07a7155adde130d9dee2e54a54f1fa5) that blocks deserialization of org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer was already present in the upstream 2.9.10.5 release before TuxCare onboarded it. The vulnerable pattern is absent because the fix shipped with the upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 Target version 2.9.10.5 is NOT affected by CVE-2019-12814. The upstream fix (commit 5f7c69bba07a7155adde130d9dee2e54a54f1fa5) that blocks deserialization of org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer was already present in the upstream 2.9.10.5 release before TuxCare onboarded it. The vulnerable pattern is absent because the fix shipped with the upstream version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.9.10.5. The upstream fix (commit ad418eeb by Tatu Saloranta, July 2019) that adds net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource to SubTypeValidator's denylist was already included in the upstream release 2.7.9.6+ that TuxCare onboarded. The target version 2.9.10.5 (released after 2.9.9.2) includes this upstream fix. The dangerous classes are blocked from deserialization at lines 98-102 of SubTypeValidator.java, and the validator is properly integrated into BeanDeserializerFactory's deserialization flow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.9.10.5. The upstream fix (commit ad418eeb by Tatu Saloranta, July 2019) that adds net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource to SubTypeValidator's denylist was already included in the upstream release 2.7.9.6+ that TuxCare onboarded. The target version 2.9.10.5 (released after 2.9.9.2) includes this upstream fix. The dangerous classes are blocked from deserialization at lines 98-102 of SubTypeValidator.java, and the validator is properly integrated into BeanDeserializerFactory's deserialization flow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target is NOT AFFECTED. CVE-2019-14439 (Polymorphic Typing issue allowing arbitrary code execution via JNDI injection when Default Typing is enabled with logback in classpath) has been mitigated by upstream fix ad418eeb97 authored by Tatu Saloranta. The fix adds two class names to SubTypeValidator's blacklist: ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup. This upstream fix was already present in release 2.9.10.5 before TuxCare onboarded the repository (first TuxCare commit d3e245d364 \"setup 2.9.10.5\"). The defense is actively enforced via BeanDeserializerFactory._validateSubType (line 135) which calls SubTypeValidator.validateSubType (line 919), blocking deserialization of blacklisted dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "Target is NOT AFFECTED. CVE-2019-14439 (Polymorphic Typing issue allowing arbitrary code execution via JNDI injection when Default Typing is enabled with logback in classpath) has been mitigated by upstream fix ad418eeb97 authored by Tatu Saloranta. The fix adds two class names to SubTypeValidator's blacklist: ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup. This upstream fix was already present in release 2.9.10.5 before TuxCare onboarded the repository (first TuxCare commit d3e245d364 \"setup 2.9.10.5\"). The defense is actively enforced via BeanDeserializerFactory._validateSubType (line 135) which calls SubTypeValidator.validateSubType (line 919), blocking deserialization of blacklisted dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. already_fixed \u2014 CVE-2019-14540 is already fixed in the target repository. The blocklist entries for com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource are present in SubTypeValidator.java, matching the upstream patches exactly.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "already_fixed \u2014 CVE-2019-14540 is already fixed in the target repository. The blocklist entries for com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource are present in SubTypeValidator.java, matching the upstream patches exactly." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. already_fixed \u2014 CVE-2019-14892 is NOT present in the target repository. The fix for this vulnerability was already applied via upstream commits 41b7f9b90 and 819cdbcab, which are ancestors of the target SHA 38f9af6f3. The SubTypeValidator class contains the blocklist entries for both org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration at lines 112-114, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "already_fixed \u2014 CVE-2019-14892 is NOT present in the target repository. The fix for this vulnerability was already applied via upstream commits 41b7f9b90 and 819cdbcab, which are ancestors of the target SHA 38f9af6f3. The SubTypeValidator class contains the blocklist entries for both org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration at lines 112-114, pre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. already_fixed \u2014 The target repository already contains the fix for CVE-2019-14893. The xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) has been added to the deserialization blacklist in SubTypeValidator.java, preventing polymorphic deserialization attacks using this gadget.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "already_fixed \u2014 The target repository already contains the fix for CVE-2019-14893. The xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) has been added to the deserialization blacklist in SubTypeValidator.java, preventing polymorphic deserialization attacks using this gadget." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. already_fixed \u2014 CVE-2019-16335: The target repository already contains the fix. Commit 73c1c2cc7 (upstream Fix #2449) is present in the current branch, adding 'com.zaxxer.hikari.HikariDataSource' to the deserialization blocklist in SubTypeValidator.java at line 107. The defense is active and prevents polymorphic deserialization of this gadget class.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "already_fixed \u2014 CVE-2019-16335: The target repository already contains the fix. Commit 73c1c2cc7 (upstream Fix #2449) is present in the current branch, adding 'com.zaxxer.hikari.HikariDataSource' to the deserialization blocklist in SubTypeValidator.java at line 107. The defense is active and prevents polymorphic deserialization of this gadget class." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind's polymorphic deserialization when Default Typing is enabled, allowing RCE via commons-dbcp gadget classes. The target (jackson-databind 2.9.10.5-tuxcare.1) is NOT AFFECTED because the upstream vendor fix was already present in release 2.9.10.5 before TuxCare onboarding. The vulnerable pattern (missing blacklist entries for org.apache.commons.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) does not exist - both classes are blacklisted in SubTypeValidator.java lines 127-128. Fix commit 9593e16cf5 by tatu.saloranta@iki.fi (upstream) predates first TuxCare commit d3e245d364.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 affects jackson-databind's polymorphic deserialization when Default Typing is enabled, allowing RCE via commons-dbcp gadget classes. The target (jackson-databind 2.9.10.5-tuxcare.1) is NOT AFFECTED because the upstream vendor fix was already present in release 2.9.10.5 before TuxCare onboarding. The vulnerable pattern (missing blacklist entries for org.apache.commons.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) does not exist - both classes are blacklisted in SubTypeValidator.java lines 127-128. Fix commit 9593e16cf5 by tatu.saloranta@iki.fi (upstream) predates first TuxCare commit d3e245d364.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.9.10.5. The vulnerability involved polymorphic deserialization of dangerous classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp datasources) when Default Typing is enabled. The fix was applied by upstream FasterXML in commit 9593e16cf5a (September 2019) which added these classes to the deserialization blacklist in SubTypeValidator.java. This fix was included in upstream release 2.9.10.1 (and therefore in 2.9.10.5) before TuxCare onboarded the codebase. The target version 2.9.10.5 contains the complete fix on lines 127-130 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.9.10.5. The vulnerability involved polymorphic deserialization of dangerous classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp datasources) when Default Typing is enabled. The fix was applied by upstream FasterXML in commit 9593e16cf5a (September 2019) which added these classes to the deserialization blacklist in SubTypeValidator.java. This fix was included in upstream release 2.9.10.1 (and therefore in 2.9.10.5) before TuxCare onboarded the codebase. The target version 2.9.10.5 contains the complete fix on lines 127-130 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. already_fixed \u2014 CVE-2019-17267 fix is already present in the target repository. The dangerous class 'net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup' is blocked from polymorphic deserialization by an entry in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 99, which is the exact fix from upstream commit 191a4cdf87b56d2ddddb77edd895ee756b7f75eb.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "already_fixed \u2014 CVE-2019-17267 fix is already present in the target repository. The dangerous class 'net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup' is blocked from polymorphic deserialization by an entry in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 99, which is the exact fix from upstream commit 191a4cdf87b56d2ddddb77edd895ee756b7f75eb." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1. The target version is 2.9.10.5-tuxcare.1, which includes the upstream fix from commit b5a304a98590b6bb766134f9261e6566dcbbb6d0. The fix adds two log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) to the SubTypeValidator blocklist, preventing their deserialization when Default Typing is enabled. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10.1+ releases, which TuxCare onboarded without modification. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1. The target version is 2.9.10.5-tuxcare.1, which includes the upstream fix from commit b5a304a98590b6bb766134f9261e6566dcbbb6d0. The fix adds two log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) to the SubTypeValidator blocklist, preventing their deserialization when Default Typing is enabled. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10.1+ releases, which TuxCare onboarded without modification. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is not present in jackson-databind 2.9.10.5. The vulnerability affects versions before 2.9.10.2, and the target version 2.9.10.5 already contains the upstream fix. The fix (commit fc4214a883d by Tatu Saloranta on 2019-11-01) adds net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector to the SubTypeValidator blocklist, preventing deserialization of these dangerous classes. This fix was shipped in the upstream release 2.9.10.2 and was already present when TuxCare onboarded version 2.9.10.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 is not present in jackson-databind 2.9.10.5. The vulnerability affects versions before 2.9.10.2, and the target version 2.9.10.5 already contains the upstream fix. The fix (commit fc4214a883d by Tatu Saloranta on 2019-11-01) adds net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector to the SubTypeValidator blocklist, preventing deserialization of these dangerous classes. This fix was shipped in the upstream release 2.9.10.2 and was already present when TuxCare onboarded version 2.9.10.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is not present in jackson-databind 2.9.10.5-tuxcare.1. The fix for this unsafe deserialization vulnerability was included in upstream version 2.9.10.4 (released 11-Apr-2020), which added ignite-jta classes to the deserialization blacklist. The target version 2.9.10.5 inherits this fix from upstream, as confirmed by the presence of the three blocked class names in SubTypeValidator.java lines 165-168.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 is not present in jackson-databind 2.9.10.5-tuxcare.1. The fix for this unsafe deserialization vulnerability was included in upstream version 2.9.10.4 (released 11-Apr-2020), which added ignite-jta classes to the deserialization blacklist. The target version 2.9.10.5 inherits this fix from upstream, as confirmed by the presence of the three blocked class names in SubTypeValidator.java lines 165-168.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is NOT present in jackson-databind 2.9.10.5. The vulnerability concerns a deserialization gadget (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory) that can lead to arbitrary code execution. The fix\u2014adding this class to the SubTypeValidator blacklist\u2014was authored by upstream maintainer Tatu Saloranta in commit 592872f4 (Fix #2659) and shipped with the original upstream release 2.9.10.5. This fix predates TuxCare's onboarding of the version (first TuxCare commit: d3e245d364 \"setup 2.9.10.5\" by askorik@cloudlinux.com). The dangerous class is blocked at SubTypeValidator.java lines 170-172, preventing deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "CVE-2020-10672 is NOT present in jackson-databind 2.9.10.5. The vulnerability concerns a deserialization gadget (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory) that can lead to arbitrary code execution. The fix\u2014adding this class to the SubTypeValidator blacklist\u2014was authored by upstream maintainer Tatu Saloranta in commit 592872f4 (Fix #2659) and shipped with the original upstream release 2.9.10.5. This fix predates TuxCare's onboarding of the version (first TuxCare commit: d3e245d364 \"setup 2.9.10.5\" by askorik@cloudlinux.com). The dangerous class is blocked at SubTypeValidator.java lines 170-172, preventing deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is not present in jackson-databind 2.9.10.5. The vulnerability involves deserialization of the dangerous class com.caucho.config.types.ResourceRef, which can lead to code execution. The target repository contains the upstream fix that blocks this class from deserialization via a blocklist entry in SubTypeValidator.java (line 175). This fix was authored by FasterXML upstream developer Tatu Saloranta and shipped with the upstream 2.9.10.5 release before TuxCare onboarding. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 is not present in jackson-databind 2.9.10.5. The vulnerability involves deserialization of the dangerous class com.caucho.config.types.ResourceRef, which can lead to code execution. The target repository contains the upstream fix that blocks this class from deserialization via a blocklist entry in SubTypeValidator.java (line 175). This fix was authored by FasterXML upstream developer Tatu Saloranta and shipped with the upstream 2.9.10.5 release before TuxCare onboarding. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.9.10.5 is NOT affected by CVE-2020-10968. The vulnerability concerns deserialization gadget exploitation via org.aoju.bus.proxy.provider.remoting.RmiProvider. The upstream vendor (FasterXML) fixed this in version 2.9.10.4 by adding RmiProvider classes to the deserialization blocklist in SubTypeValidator. This fix was already present in the upstream 2.9.10.5 release that TuxCare onboarded, as confirmed by commit 05d7e0e13f authored by Tatu Saloranta (upstream maintainer). The blocklist is actively enforced during bean deserialization via BeanDeserializerFactory line 919.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "Target jackson-databind 2.9.10.5 is NOT affected by CVE-2020-10968. The vulnerability concerns deserialization gadget exploitation via org.aoju.bus.proxy.provider.remoting.RmiProvider. The upstream vendor (FasterXML) fixed this in version 2.9.10.4 by adding RmiProvider classes to the deserialization blocklist in SubTypeValidator. This fix was already present in the upstream 2.9.10.5 release that TuxCare onboarded, as confirmed by commit 05d7e0e13f authored by Tatu Saloranta (upstream maintainer). The blocklist is actively enforced during bean deserialization via BeanDeserializerFactory line 919.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 is NOT present in the target. The vulnerability relates to deserialization of javax.swing.JEditorPane as a gadget type. The fix (adding javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was included in upstream release 2.9.10.4 by FasterXML maintainer Tatu Saloranta. The target version 2.9.10.5 already contains this upstream fix - the blocklist entry exists at line 158 of SubTypeValidator.java and is enforced through the validateSubType method during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "CVE-2020-10969 is NOT present in the target. The vulnerability relates to deserialization of javax.swing.JEditorPane as a gadget type. The fix (adding javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was included in upstream release 2.9.10.4 by FasterXML maintainer Tatu Saloranta. The target version 2.9.10.5 already contains this upstream fix - the blocklist entry exists at line 158 of SubTypeValidator.java and is enforced through the validateSubType method during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 affects jackson-databind versions before 2.9.10.4 due to deserialization gadgets in org.apache.activemq.* classes. The target is version 2.9.10.5-tuxcare.1, which includes the upstream fix authored by Tatu Saloranta. The fix adds all 9 org.apache.activemq.* connection factory classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 181-191). The fix commit c14c9f99ed was already present in the upstream 2.9.10.5 release that TuxCare onboarded (commit d3e245d364 \"setup 2.9.10.5\"). The blocklist is actively enforced during deserialization via BeanDeserializerFactory \u2192 SubTypeValidator.validateSubType(). Verdict: not_affected because the vulnerable code pattern was removed by an upstream vendor fix before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 affects jackson-databind versions before 2.9.10.4 due to deserialization gadgets in org.apache.activemq.* classes. The target is version 2.9.10.5-tuxcare.1, which includes the upstream fix authored by Tatu Saloranta. The fix adds all 9 org.apache.activemq.* connection factory classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 181-191). The fix commit c14c9f99ed was already present in the upstream 2.9.10.5 release that TuxCare onboarded (commit d3e245d364 \"setup 2.9.10.5\"). The blocklist is actively enforced during deserialization via BeanDeserializerFactory \u2192 SubTypeValidator.validateSubType(). Verdict: not_affected because the vulnerable code pattern was removed by an upstream vendor fix before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to a missing blocklist entry for the RmiProvider deserialization gadget. The target repository version 2.9.10.5 already contains the upstream fix (commit 05d7e0e13f by Tatu Saloranta) that was shipped in version 2.9.10.4. The blocklist entry \"org.apache.commons.proxy.provider.remoting.RmiProvider\" is present in SubTypeValidator.java:194, preventing deserialization of this dangerous class. This fix was already included in the upstream release before TuxCare onboarded version 2.9.10.5, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to a missing blocklist entry for the RmiProvider deserialization gadget. The target repository version 2.9.10.5 already contains the upstream fix (commit 05d7e0e13f by Tatu Saloranta) that was shipped in version 2.9.10.4. The blocklist entry \"org.apache.commons.proxy.provider.remoting.RmiProvider\" is present in SubTypeValidator.java:194, preventing deserialization of this dangerous class. This fix was already included in the upstream release before TuxCare onboarded version 2.9.10.5, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is NOT present in jackson-databind 2.9.10.5. The vulnerability involves deserialization gadgets that enable RCE via polymorphic type handling. The upstream vendor patch adds \"org.apache.openjpa.ee.WASRegistryManagedRuntime\" to the deserialization blocklist in SubTypeValidator.java. This fix is already present at line 84 of the target repository and was shipped in the upstream release 2.9.10.5 (commit e2ba12d5d6 by Tatu Saloranta). The defense mechanism correctly blocks instantiation of the gadget class during JSON deserialization, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 is NOT present in jackson-databind 2.9.10.5. The vulnerability involves deserialization gadgets that enable RCE via polymorphic type handling. The upstream vendor patch adds \"org.apache.openjpa.ee.WASRegistryManagedRuntime\" to the deserialization blocklist in SubTypeValidator.java. This fix is already present at line 84 of the target repository and was shipped in the upstream release 2.9.10.5 (commit e2ba12d5d6 by Tatu Saloranta). The defense mechanism correctly blocks instantiation of the gadget class during JSON deserialization, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 affects jackson-databind versions before 2.9.10.4. The target is version 2.9.10.5, which includes the upstream fix (commit 113e89fb08) that adds org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean to the deserialization blocklist in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and shipped in release 2.9.10.4. TuxCare's onboarding of version 2.9.10.5 inherited this fix from the upstream release. The vulnerable pattern (unrestricted deserialization of these Spring gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 affects jackson-databind versions before 2.9.10.4. The target is version 2.9.10.5, which includes the upstream fix (commit 113e89fb08) that adds org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean to the deserialization blocklist in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and shipped in release 2.9.10.4. TuxCare's onboarding of version 2.9.10.5 inherited this fix from the upstream release. The vulnerable pattern (unrestricted deserialization of these Spring gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4. The target version is 2.9.10.5, which includes the upstream fix that blocks deserialization of org.apache.commons.jelly.impl.Embedded. The fix (commit 77040d85e3) was authored by upstream maintainer Tatu Saloranta and shipped in release 2.9.10.4. TuxCare onboarded version 2.9.10.5 which already contained this fix, so no backport was needed. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4. The target version is 2.9.10.5, which includes the upstream fix that blocks deserialization of org.apache.commons.jelly.impl.Embedded. The fix (commit 77040d85e3) was authored by upstream maintainer Tatu Saloranta and shipped in release 2.9.10.4. TuxCare onboarded version 2.9.10.5 which already contained this fix, so no backport was needed. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not affecting this target. The vulnerability relates to unsafe deserialization of the gadget class \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\" which could lead to arbitrary code execution. The fix (adding this class to the SubTypeValidator blocklist) was already present in upstream release 2.9.10.5, which TuxCare onboarded. The dangerous class name is blocked at line 200 of SubTypeValidator.java, and this defense is invoked on all deserialization paths through BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 is not affecting this target. The vulnerability relates to unsafe deserialization of the gadget class \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\" which could lead to arbitrary code execution. The fix (adding this class to the SubTypeValidator blocklist) was already present in upstream release 2.9.10.5, which TuxCare onboarded. The dangerous class name is blocked at line 200 of SubTypeValidator.java, and this defense is invoked on all deserialization paths through BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.9.10.5 is not affected by CVE-2020-14061. The fix for this vulnerability was included in the upstream 2.9.10.5 release (released 21-Jun-2020) before TuxCare onboarded it. The oracle.jms gadget classes are already present in the SubTypeValidator blacklist at lines 206-210 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "The target jackson-databind version 2.9.10.5 is not affected by CVE-2020-14061. The fix for this vulnerability was included in the upstream 2.9.10.5 release (released 21-Jun-2020) before TuxCare onboarded it. The oracle.jms gadget classes are already present in the SubTypeValidator blacklist at lines 206-210 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.5 is NOT vulnerable to CVE-2020-14062. The CVE affects jackson-databind versions before 2.9.10.5, and version 2.9.10.5 is the first fixed upstream release. The fix (blocking com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool from deserialization) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10.5 release that TuxCare onboarded. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "Target version 2.9.10.5 is NOT vulnerable to CVE-2020-14062. The CVE affects jackson-databind versions before 2.9.10.5, and version 2.9.10.5 is the first fixed upstream release. The fix (blocking com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool from deserialization) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10.5 release that TuxCare onboarded. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is NOT present in jackson-databind 2.9.10.5. The fix (blacklisting org.jsecurity.realm.jndi.JndiRealmFactory) was included in the upstream 2.9.10.5 release. The target is exactly version 2.9.10.5, which is the first fixed version per the CVE scope \"before 2.9.10.5\". The blacklist entry is present at SubTypeValidator.java:213 and actively prevents deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 is NOT present in jackson-databind 2.9.10.5. The fix (blacklisting org.jsecurity.realm.jndi.JndiRealmFactory) was included in the upstream 2.9.10.5 release. The target is exactly version 2.9.10.5, which is the first fixed version per the CVE scope \"before 2.9.10.5\". The blacklist entry is present at SubTypeValidator.java:213 and actively prevents deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-36181 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-36188 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.10.5 is not affected by CVE-2020-36189: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "Version 2.9.10.5 is not affected by CVE-2020-36189: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is NOT present in jackson-databind 2.9.10.5-tuxcare.1. The vulnerability required deserialization of org.apache.xbean.propertyeditor.JndiConverter to trigger JNDI injection. The upstream vendor (Tatu Saloranta) fixed this in commit 914e7c9f by adding JndiConverter to the polymorphic deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.9.10.5 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (d3e245d3). The blocklist entry is present at line 146 of SubTypeValidator.java in the target HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 is NOT present in jackson-databind 2.9.10.5-tuxcare.1. The vulnerability required deserialization of org.apache.xbean.propertyeditor.JndiConverter to trigger JNDI injection. The upstream vendor (Tatu Saloranta) fixed this in commit 914e7c9f by adding JndiConverter to the polymorphic deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.9.10.5 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (d3e245d3). The blocklist entry is present at line 146 of SubTypeValidator.java in the target HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.9.10.5-tuxcare.1, which already contains the upstream fix from version 2.9.10.4. The fix (adding \"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig\" to the deserialization blacklist) was authored by Tatu Saloranta and shipped in the upstream 2.9.10.5 release that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.9.10.5-tuxcare.1, which already contains the upstream fix from version 2.9.10.4. The fix (adding \"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig\" to the deserialization blacklist) was authored by Tatu Saloranta and shipped in the upstream 2.9.10.5 release that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects Jackson-databind versions before 2.9.10.4 due to a deserialization gadget in com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target version 2.9.10.5-tuxcare.1 is not affected because the upstream fix (adding the gadget class to SubTypeValidator's blocklist) was already present in upstream release 2.9.10.5, which TuxCare onboarded. The vulnerability pattern was never present in what TuxCare shipped to customers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 affects Jackson-databind versions before 2.9.10.4 due to a deserialization gadget in com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target version 2.9.10.5-tuxcare.1 is not affected because the upstream fix (adding the gadget class to SubTypeValidator's blocklist) was already present in upstream release 2.9.10.5, which TuxCare onboarded. The vulnerability pattern was never present in what TuxCare shipped to customers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is NOT PRESENT in jackson-databind 2.9.10.5-tuxcare.1. The vulnerability involves deserialization gadget exploitation via br.com.anteros.dbcp.AnterosDBCPConfig. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java) was already included in the upstream jackson-databind 2.9.10.5 release that TuxCare onboarded. The blocklist entry at line 153 prevents instantiation of the gadget class during polymorphic deserialization, blocking the attack chain from INPUT (malicious JSON with type information) to GOAL (arbitrary code execution). Fix commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by upstream maintainer Tatu Saloranta was present before TuxCare's first commit d3e245d364fc56c3c71f9da118d2b52cb616f1bf.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 is NOT PRESENT in jackson-databind 2.9.10.5-tuxcare.1. The vulnerability involves deserialization gadget exploitation via br.com.anteros.dbcp.AnterosDBCPConfig. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java) was already included in the upstream jackson-databind 2.9.10.5 release that TuxCare onboarded. The blocklist entry at line 153 prevents instantiation of the gadget class during polymorphic deserialization, blocking the attack chain from INPUT (malicious JSON with type information) to GOAL (arbitrary code execution). Fix commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by upstream maintainer Tatu Saloranta was present before TuxCare's first commit d3e245d364fc56c3c71f9da118d2b52cb616f1bf.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2021-20190 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54512 specifically concerns bypassing PolymorphicTypeValidator (PTV) via generic type parameters. The target repository is jackson-databind version 2.9.10.5, which predates the introduction of PolymorphicTypeValidator (introduced in version 2.10.0). The CVE's affected version range explicitly starts at 2.10.0 and the vulnerability description focuses entirely on PTV bypass. Without PTV...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "not_affected \u2014 CVE-2026-54512 specifically concerns bypassing PolymorphicTypeValidator (PTV) via generic type parameters. The target repository is jackson-databind version 2.9.10.5, which predates the introduction of PolymorphicTypeValidator (introduced in version 2.10.0). The CVE's affected version range explicitly starts at 2.10.0 and the vulnerability description focuses entirely on PTV bypass. Without PTV..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:45.877647+00:00", "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.10.5 is not affected by CVE-2026-54517. The vulnerability requires SetterlessProperty.isMerging() returning true to route setterless properties through the property-based creator buffering path, exposing the missing @JsonView check. Version 2.9.10.5 lacks the isMerging() method entirely (introduced in later versions via commit #5237, dated Aug 2025, not on target HEAD). Even if sett...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54517" }, "impact_statement": "not_affected \u2014 Version 2.9.10.5 is not affected by CVE-2026-54517. The vulnerability requires SetterlessProperty.isMerging() returning true to route setterless properties through the property-based creator buffering path, exposing the missing @JsonView check. Version 2.9.10.5 lacks the isMerging() method entirely (introduced in later versions via commit #5237, dated Aug 2025, not on target HEAD). Even if sett..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target version 2.9.10.5 does not support the @JsonUnwrapped + @JsonCreator annotation combination that the vulnerability exploits. The code explicitly rejects this combination with error \"Cannot define Creator parameter as @JsonUnwrapped: combination not yet supported\". The vulnerable method processUnwrappedCreatorProperties() does not exist in this version, and the feature enabling unwrapp...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 The target version 2.9.10.5 does not support the @JsonUnwrapped + @JsonCreator annotation combination that the vulnerability exploits. The code explicitly rejects this combination with error \"Cannot define Creator parameter as @JsonUnwrapped: combination not yet supported\". The vulnerable method processUnwrappedCreatorProperties() does not exist in this version, and the feature enabling unwrapp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target version 2.9.10.5 is NOT AFFECTED by CVE-2026-59888. This vulnerability specifically affects Java Records with @JsonIgnore annotations when PropertyNamingStrategy is used. Version 2.9.10.5 targets Java 7 (javac.target.version=1.7 in pom.xml) and contains no Record-related code. Java Records were introduced in Java 16 (preview) and finalized in Java 17. The Record deserialization featu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 The target version 2.9.10.5 is NOT AFFECTED by CVE-2026-59888. This vulnerability specifically affects Java Records with @JsonIgnore annotations when PropertyNamingStrategy is used. Version 2.9.10.5 targets Java 7 (javac.target.version=1.7 in pom.xml) and contains no Record-related code. Java Records were introduced in Java 16 (preview) and finalized in Java 17. The Record deserialization featu..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.10.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.3" } } ], "timestamp": "2026-11-09T14:18:03.908748+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.10.5-tuxcare.3.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }