{ "@id": "urn:uuid:f0054ea2-737c-45d0-941b-90ff3096fe35", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-09T14:21:35.881861+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target repository is version 2.9.10.6-tuxcare.1, which is a later release that already contains the upstream vendor fixes. The vulnerable deserialization pattern is not present because the target includes SubTypeValidator.java (introduced in 2.8.11) with a comprehensive blacklist of dangerous classes including all those addressed by CVE-2017-15095: org.apache.xalan.xsltc.trax.TemplatesImpl, com.sun.rowset.JdbcRowSetImpl, java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring PropertyPathFactoryBean, and c3p0 DataSource classes. The fix was authored by Tatu Saloranta (upstream FasterXML maintainer) and shipped in the upstream jackson-databind-2.8.11 release, before TuxCare's first commit to this repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target repository is version 2.9.10.6-tuxcare.1, which is a later release that already contains the upstream vendor fixes. The vulnerable deserialization pattern is not present because the target includes SubTypeValidator.java (introduced in 2.8.11) with a comprehensive blacklist of dangerous classes including all those addressed by CVE-2017-15095: org.apache.xalan.xsltc.trax.TemplatesImpl, com.sun.rowset.JdbcRowSetImpl, java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring PropertyPathFactoryBean, and c3p0 DataSource classes. The fix was authored by Tatu Saloranta (upstream FasterXML maintainer) and shipped in the upstream jackson-databind-2.8.11 release, before TuxCare's first commit to this repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is not present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability required blacklist expansion to prevent deserialization of dangerous classes when Spring libraries are available. The complete fix (SubTypeValidator with all required blacklist entries and Spring/C3P0 pattern matching) was already present in the upstream jackson-databind 2.9.10.6 release that TuxCare onboarded. Fix commit 2235894210 by upstream author tatu.saloranta@iki.fi is an ancestor of the first TuxCare commit (a627dc2c02, Onboard version 2.9.10.6). The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 is not present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability required blacklist expansion to prevent deserialization of dangerous classes when Spring libraries are available. The complete fix (SubTypeValidator with all required blacklist entries and Spring/C3P0 pattern matching) was already present in the upstream jackson-databind 2.9.10.6 release that TuxCare onboarded. Fix commit 2235894210 by upstream author tatu.saloranta@iki.fi is an ancestor of the first TuxCare commit (a627dc2c02, Onboard version 2.9.10.6). The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.6-tuxcare.2 is not affected by CVE-2017-7525. The upstream vendor (Tatu Saloranta) fixed this deserialization vulnerability in April 2017 by adding validation that blocks dangerous classes before deserialization. The fix (commit 60d459cedcf079c6) was included in upstream release 2.9.10.6, which TuxCare later onboarded. The SubTypeValidator class contains a comprehensive blacklist including all CVE-2017-7525 gadget classes (InvokerTransformer, InstantiateTransformer, TemplatesImpl, ConvertedClosure, MethodClosure, ObjectFactory, etc.) and is invoked in BeanDeserializerFactory.createBeanDeserializer() before any bean deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "Target version 2.9.10.6-tuxcare.2 is not affected by CVE-2017-7525. The upstream vendor (Tatu Saloranta) fixed this deserialization vulnerability in April 2017 by adding validation that blocks dangerous classes before deserialization. The fix (commit 60d459cedcf079c6) was included in upstream release 2.9.10.6, which TuxCare later onboarded. The SubTypeValidator class contains a comprehensive blacklist including all CVE-2017-7525 gadget classes (InvokerTransformer, InstantiateTransformer, TemplatesImpl, ConvertedClosure, MethodClosure, ObjectFactory, etc.) and is invoked in BeanDeserializerFactory.createBeanDeserializer() before any bean deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.9.10.6. The vulnerability involves Jackson's default typing feature allowing deserialization of the dangerous class org.apache.ibatis.parsing.XPathParser, which enables data exfiltration via XML external entities. The fix (blacklisting this class in SubTypeValidator) was introduced in upstream version 2.9.6 by commit 27b4defc270454dea6842bd9279f17387eceb737, authored by upstream maintainer Tatu Saloranta. Since the target is version 2.9.10.6 (later than 2.9.6), the fix was already present in the upstream release that TuxCare onboarded. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.9.10.6. The vulnerability involves Jackson's default typing feature allowing deserialization of the dangerous class org.apache.ibatis.parsing.XPathParser, which enables data exfiltration via XML external entities. The fix (blacklisting this class in SubTypeValidator) was introduced in upstream version 2.9.6 by commit 27b4defc270454dea6842bd9279f17387eceb737, authored by upstream maintainer Tatu Saloranta. Since the target is version 2.9.10.6 (later than 2.9.6), the fix was already present in the upstream release that TuxCare onboarded. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.6-tuxcare.2) is NOT affected by CVE-2018-12022. This CVE affects versions prior to 2.9.6 and involves polymorphic deserialization gadgets (Jodd-db and Oracle JDBC classes) that enable JNDI/LDAP exploitation when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in version 2.9.6 (June 2018) by adding three gadget class names to the deserialization blacklist in SubTypeValidator.java. The target version 2.9.10.6 already contains this fix as part of the upstream release that TuxCare onboarded. The fix commit (28badf7ef6) was authored by upstream maintainer Tatu Saloranta and is an ancestor of HEAD, confirming the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "The target repository (jackson-databind 2.9.10.6-tuxcare.2) is NOT affected by CVE-2018-12022. This CVE affects versions prior to 2.9.6 and involves polymorphic deserialization gadgets (Jodd-db and Oracle JDBC classes) that enable JNDI/LDAP exploitation when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in version 2.9.6 (June 2018) by adding three gadget class names to the deserialization blacklist in SubTypeValidator.java. The target version 2.9.10.6 already contains this fix as part of the upstream release that TuxCare onboarded. The fix commit (28badf7ef6) was authored by upstream maintainer Tatu Saloranta and is an ancestor of HEAD, confirming the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability involves unsafe deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that can trigger LDAP/JNDI connections to attacker-controlled servers when Default Typing is enabled. The upstream fix added these classes to the SubTypeValidator blacklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing their deserialization. This fix was already present in upstream release 2.9.10.6, which TuxCare onboarded. The blacklist entries are confirmed present at lines 70-72 of SubTypeValidator.java and are actively enforced during deserialization through BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability involves unsafe deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that can trigger LDAP/JNDI connections to attacker-controlled servers when Default Typing is enabled. The upstream fix added these classes to the SubTypeValidator blacklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing their deserialization. This fix was already present in upstream release 2.9.10.6, which TuxCare onboarded. The blacklist entries are confirmed present at lines 70-72 of SubTypeValidator.java and are actively enforced during deserialization through BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.6-tuxcare.2 is NOT AFFECTED by CVE-2018-14718. The vulnerability concerns polymorphic deserialization of org.slf4j.ext.EventData and other dangerous classes that can lead to arbitrary code execution. The upstream fix (commit 87d29af25e) added these classes to a blacklist, preventing their deserialization. This fix was already present in upstream release 2.9.10.6 when TuxCare onboarded it. The blacklist entries are located in SubTypeValidator.java lines 75-78 (refactored from BeanDeserializerFactory in earlier versions) and are actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "Target version 2.9.10.6-tuxcare.2 is NOT AFFECTED by CVE-2018-14718. The vulnerability concerns polymorphic deserialization of org.slf4j.ext.EventData and other dangerous classes that can lead to arbitrary code execution. The upstream fix (commit 87d29af25e) added these classes to a blacklist, preventing their deserialization. This fix was already present in upstream release 2.9.10.6 when TuxCare onboarded it. The blacklist entries are located in SubTypeValidator.java lines 75-78 (refactored from BeanDeserializerFactory in earlier versions) and are actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.6-tuxcare.2) is not affected by CVE-2018-14719. The vulnerability, which allows arbitrary code execution through polymorphic deserialization of blaze-ds classes (specifically flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor), has been mitigated. The dangerous class is blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java:76. This fix was introduced by upstream commit 87d29af25e authored by Tatu Saloranta and was already included in upstream version 2.9.10.6 before TuxCare onboarded it. The CVE affects versions before 2.9.7, and the target is version 2.9.10.6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "The target repository (jackson-databind 2.9.10.6-tuxcare.2) is not affected by CVE-2018-14719. The vulnerability, which allows arbitrary code execution through polymorphic deserialization of blaze-ds classes (specifically flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor), has been mitigated. The dangerous class is blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java:76. This fix was introduced by upstream commit 87d29af25e authored by Tatu Saloranta and was already included in upstream version 2.9.10.6 before TuxCare onboarded it. The CVE affects versions before 2.9.7, and the target is version 2.9.10.6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.6-tuxcare.2 is not affected by CVE-2018-14720. The vulnerability requires the absence of blocklist entries for four specific classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that can be exploited via polymorphic deserialization. The upstream fix (commit 87d29af25e) adding these blocklist entries was already present in upstream release 2.9.10.6 before TuxCare onboarded the version. The blocklist is actively enforced through SubTypeValidator.validateSubType() called during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "Target version 2.9.10.6-tuxcare.2 is not affected by CVE-2018-14720. The vulnerability requires the absence of blocklist entries for four specific classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that can be exploited via polymorphic deserialization. The upstream fix (commit 87d29af25e) adding these blocklist entries was already present in upstream release 2.9.10.6 before TuxCare onboarded the version. The blocklist is actively enforced through SubTypeValidator.validateSubType() called during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is not present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability affects jackson-databind 2.x before 2.9.7, which allowed SSRF attacks via polymorphic deserialization of the axis2-jaxws class. The target version (2.9.10.6) already contains the upstream fix that blocks org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization. The fix was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 (August 2018) and shipped in the upstream 2.9.10.6 release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 is not present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability affects jackson-databind 2.x before 2.9.7, which allowed SSRF attacks via polymorphic deserialization of the axis2-jaxws class. The target version (2.9.10.6) already contains the upstream fix that blocks org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization. The fix was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 (August 2018) and shipped in the upstream 2.9.10.6 release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is not present in jackson-databind 2.9.10.6-tuxcare.1. The vulnerable class org.apache.axis2.transport.jms.JMSOutTransportInfo is already blocklisted in SubTypeValidator.java (line 85), preventing its use in polymorphic deserialization. This fix was added by upstream vendor commit 72cd4025a2 (Fix #2186) authored by Tatu Saloranta and was already present in the upstream release 2.9.10.6 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 is not present in jackson-databind 2.9.10.6-tuxcare.1. The vulnerable class org.apache.axis2.transport.jms.JMSOutTransportInfo is already blocklisted in SubTypeValidator.java (line 85), preventing its use in polymorphic deserialization. This fix was added by upstream vendor commit 72cd4025a2 (Fix #2186) authored by Tatu Saloranta and was already present in the upstream release 2.9.10.6 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is not a concern for this target. The vulnerability involves missing blocklist entries for openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) in jackson-databind's polymorphic deserialization defense mechanism. The fix (commit 72cd4025a2) was already present in the upstream release 2.9.10.6 that TuxCare onboarded. The target's SubTypeValidator.java contains the required openjpa blocklist entries at lines 82-83, preventing deserialization of these gadget classes. This is an upstream fix by Tatu Saloranta (tatu.saloranta@iki.fi), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 is not a concern for this target. The vulnerability involves missing blocklist entries for openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) in jackson-databind's polymorphic deserialization defense mechanism. The fix (commit 72cd4025a2) was already present in the upstream release 2.9.10.6 that TuxCare onboarded. The target's SubTypeValidator.java contains the required openjpa blocklist entries at lines 82-83, preventing deserialization of these gadget classes. This is an upstream fix by Tatu Saloranta (tatu.saloranta@iki.fi), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind 2.x before 2.9.8 due to missing blocklist entries for jboss-common-core and related gadget classes in polymorphic deserialization. The target (version 2.9.10.6-tuxcare.2) is NOT AFFECTED because the upstream vendor (FasterXML) fixed this issue in commits 72cd4025a2 and 42912cac47, which were included in the upstream 2.9.10.6 release that TuxCare onboarded. All four required blocklist entries are present in SubTypeValidator.java at lines 80-85.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 affects jackson-databind 2.x before 2.9.8 due to missing blocklist entries for jboss-common-core and related gadget classes in polymorphic deserialization. The target (version 2.9.10.6-tuxcare.2) is NOT AFFECTED because the upstream vendor (FasterXML) fixed this issue in commits 72cd4025a2 and 42912cac47, which were included in the upstream 2.9.10.6 release that TuxCare onboarded. All four required blocklist entries are present in SubTypeValidator.java at lines 80-85.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in target jackson-databind 2.9.10.6-tuxcare.2. The vulnerability affects versions through 2.9.3 via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist. The fix adding these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java is present at lines 62-63. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 038b471e2e and shipped in the upstream 2.9.10.6 release, which TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is NOT present in target jackson-databind 2.9.10.6-tuxcare.2. The vulnerability affects versions through 2.9.3 via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist. The fix adding these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java is present at lines 62-63. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 038b471e2e and shipped in the upstream 2.9.10.6 release, which TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 fix is already present in the target. The vulnerability allowed remote code execution via deserialization of malicious c3p0 DataSource classes when Jackson's default typing was enabled. The upstream fix (commit 6799f8f10c by Tatu Saloranta) adds validation in SubTypeValidator to block any class under \"com.mchange.v2.c3p0.*\" ending with \"DataSource\". This fix was already included in upstream release 2.9.10.6 that TuxCare onboarded, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 fix is already present in the target. The vulnerability allowed remote code execution via deserialization of malicious c3p0 DataSource classes when Jackson's default typing was enabled. The upstream fix (commit 6799f8f10c by Tatu Saloranta) adds validation in SubTypeValidator to block any class under \"com.mchange.v2.c3p0.*\" ending with \"DataSource\". This fix was already included in upstream release 2.9.10.6 that TuxCare onboarded, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind 2.x before 2.9.9 and relates to missing validation of com.mysql.cj.jdbc.admin.MiniAdmin during polymorphic deserialization. The target version 2.9.10.6 contains the upstream fix (commit dda513bd72) which adds MiniAdmin to the blocklist in SubTypeValidator.java at line 88. This fix was authored by upstream maintainer Tatu Saloranta and was first released in version 2.9.9, before the target version was onboarded by TuxCare. The defense is present and enforced on the standard bean deserialization path, blocking the vulnerable class from being instantiated when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 affects jackson-databind 2.x before 2.9.9 and relates to missing validation of com.mysql.cj.jdbc.admin.MiniAdmin during polymorphic deserialization. The target version 2.9.10.6 contains the upstream fix (commit dda513bd72) which adds MiniAdmin to the blocklist in SubTypeValidator.java at line 88. This fix was authored by upstream maintainer Tatu Saloranta and was first released in version 2.9.9, before the target version was onboarded by TuxCare. The defense is present and enforced on the standard bean deserialization path, blocking the vulnerable class from being instantiated when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to missing blocklist entry for logback-core's DriverManagerConnectionSource class in polymorphic deserialization. The target version 2.9.10.6 contains the upstream fix (commit c9ef4a10d6) that adds \"ch.qos.logback.core.db.DriverManagerConnectionSource\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to missing blocklist entry for logback-core's DriverManagerConnectionSource class in polymorphic deserialization. The target version 2.9.10.6 contains the upstream fix (commit c9ef4a10d6) that adds \"ch.qos.logback.core.db.DriverManagerConnectionSource\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability requires the ability to deserialize JDOM XSLTransformer classes during polymorphic typing, which could allow arbitrary file reading. The fix (blocklisting org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer) was already present in upstream release 2.9.10.6, which TuxCare subsequently onb...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability requires the ability to deserialize JDOM XSLTransformer classes during polymorphic typing, which could allow arbitrary file reading. The fix (blocklisting org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer) was already present in upstream release 2.9.10.6, which TuxCare subsequently onb..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.9.10.6. The upstream vendor (FasterXML) fixed this vulnerability in commit ad418eeb974 dated 2019-07-25, which added 'net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup' to the deserialization blacklist in SubTypeValidator.java. This fix was already included in the upstream 2.9.10.6 release that TuxCare onboarded (first TuxCare commit a627dc2c \"Onboard version 2.9.10.6\"). The vulnerable pattern is absent from HEAD because the upstream fix shipped before TuxCare's extended lifecycle support began for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.9.10.6. The upstream vendor (FasterXML) fixed this vulnerability in commit ad418eeb974 dated 2019-07-25, which added 'net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup' to the deserialization blacklist in SubTypeValidator.java. This fix was already included in the upstream 2.9.10.6 release that TuxCare onboarded (first TuxCare commit a627dc2c \"Onboard version 2.9.10.6\"). The vulnerable pattern is absent from HEAD because the upstream fix shipped before TuxCare's extended lifecycle support began for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2. The target version 2.9.10.6 already contains the upstream fix (commit ad418eeb97) that adds `ch.qos.logback.core.db.JNDIConnectionSource` and `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` to the deserialization blacklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.9.10.6 release when TuxCare onboarded it (commit a627dc2c02). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2. The target version 2.9.10.6 already contains the upstream fix (commit ad418eeb97) that adds `ch.qos.logback.core.db.JNDIConnectionSource` and `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` to the deserialization blacklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.9.10.6 release when TuxCare onboarded it (commit a627dc2c02). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10. The target is at version 2.9.10.6-tuxcare.1, which includes the upstream fix from version 2.9.10. The vulnerability involved polymorphic typing allowing deserialization of dangerous classes (com.zaxxer.hikari.HikariConfig and HikariDataSource). The fix blacklists these classes in SubTypeValidator.java (lines 104-107), preventing their deserialization. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit d4983c740fec7d5576b207a8c30a63d3ea7443de, which was included in the jackson-databind-2.9.10 release tag. TuxCare onboarded version 2.9.10.6 which already contained this fix from upstream.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10. The target is at version 2.9.10.6-tuxcare.1, which includes the upstream fix from version 2.9.10. The vulnerability involved polymorphic typing allowing deserialization of dangerous classes (com.zaxxer.hikari.HikariConfig and HikariDataSource). The fix blacklists these classes in SubTypeValidator.java (lines 104-107), preventing their deserialization. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit d4983c740fec7d5576b207a8c30a63d3ea7443de, which was included in the jackson-databind-2.9.10 release tag. TuxCare onboarded version 2.9.10.6 which already contained this fix from upstream." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.9.10.6. The vulnerability allows polymorphic deserialization of malicious objects using commons-configuration JNDI classes for arbitrary code execution. The fix (adding blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to SubTypeValidator.java) was already present in upstream jackson-databind 2.9.10, which TuxCare onboarded. The CVE affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target version 2.9.10.6 contains the upstream fix from commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af by Tatu Saloranta, which predates the first TuxCare commit (a627dc2c027b03196ab96914a6770080fbe0331b \"Onboard version 2.9.10.6\").", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.9.10.6. The vulnerability allows polymorphic deserialization of malicious objects using commons-configuration JNDI classes for arbitrary code execution. The fix (adding blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to SubTypeValidator.java) was already present in upstream jackson-databind 2.9.10, which TuxCare onboarded. The CVE affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target version 2.9.10.6 contains the upstream fix from commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af by Tatu Saloranta, which predates the first TuxCare commit (a627dc2c027b03196ab96914a6770080fbe0331b \"Onboard version 2.9.10.6\")." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is not present in jackson-databind 2.9.10.6. The vulnerability allowed polymorphic deserialization of malicious objects using the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool). The fix, which adds this class to the deserialization blacklist in SubTypeValidator.java, was already included in the upstream jackson-databind 2.9.10.6 release. Commit 998efd708 by Tatu Saloranta (upstream maintainer) added the protection before TuxCare's onboarding of this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893 is not present in jackson-databind 2.9.10.6. The vulnerability allowed polymorphic deserialization of malicious objects using the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool). The fix, which adds this class to the deserialization blacklist in SubTypeValidator.java, was already included in the upstream jackson-databind 2.9.10.6 release. Commit 998efd708 by Tatu Saloranta (upstream maintainer) added the protection before TuxCare's onboarding of this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 concerns a polymorphic deserialization vulnerability in jackson-databind related to com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind version 2.9.10.6-tuxcare.1) is not affected because the fix was already present in the upstream version 2.9.10.6 before TuxCare onboarded it. The blocklist entry for HikariDataSource exists at line 107 of SubTypeValidator.java, added by upstream commit 73c1c2cc7 authored by Tatu Saloranta (the upstream FasterXML maintainer).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 concerns a polymorphic deserialization vulnerability in jackson-databind related to com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind version 2.9.10.6-tuxcare.1) is not affected because the fix was already present in the upstream version 2.9.10.6 before TuxCare onboarded it. The blocklist entry for HikariDataSource exists at line 107 of SubTypeValidator.java, added by upstream commit 73c1c2cc7 authored by Tatu Saloranta (the upstream FasterXML maintainer)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is NOT present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability was fixed in upstream version 2.9.10.1 (October 2019) by adding org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java. The target version 2.9.10.6 (August 2020) already contains this fix as it was shipped in the upstream release that TuxCare onboarded, not as a separate TuxCare backport. The blocklist entries are present at lines 124-125 of SubTypeValidator.java, preventing the polymorphic typing attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 is NOT present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability was fixed in upstream version 2.9.10.1 (October 2019) by adding org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java. The target version 2.9.10.6 (August 2020) already contains this fix as it was shipped in the upstream release that TuxCare onboarded, not as a separate TuxCare backport. The blocklist entries are present at lines 124-125 of SubTypeValidator.java, preventing the polymorphic typing attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 describes a polymorphic typing vulnerability in jackson-databind when Default Typing is enabled, allowing arbitrary code execution via malicious P6DataSource gadget classes. The target version 2.9.10.6-tuxcare.2 already contains the upstream fix that blocks deserialization of com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, and org.apache.commons.dbcp.datasources.PerUserPoolDataSource. This fix was authored by upstream FasterXML maintainer Tatu Saloranta and shipped in upstream release 2.9.10.6 before TuxCare onboarding. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 describes a polymorphic typing vulnerability in jackson-databind when Default Typing is enabled, allowing arbitrary code execution via malicious P6DataSource gadget classes. The target version 2.9.10.6-tuxcare.2 already contains the upstream fix that blocks deserialization of com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, and org.apache.commons.dbcp.datasources.PerUserPoolDataSource. This fix was authored by upstream FasterXML maintainer Tatu Saloranta and shipped in upstream release 2.9.10.6 before TuxCare onboarding. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is not present in jackson-databind 2.9.10.6. The vulnerability affects versions before 2.9.10 and involves missing blocklist entry for net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup in polymorphic deserialization. The fix (commit 191a4cdf8) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10 release, which TuxCare later onboarded. The target version 2.9.10.6 includes this fix at SubTypeValidator.java line 99.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 is not present in jackson-databind 2.9.10.6. The vulnerability affects versions before 2.9.10 and involves missing blocklist entry for net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup in polymorphic deserialization. The fix (commit 191a4cdf8) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10 release, which TuxCare later onboarded. The target version 2.9.10.6 includes this fix at SubTypeValidator.java line 99." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is not affecting this target. The vulnerability was fixed in upstream jackson-databind by commit b5a304a985 (authored by Tatu Saloranta) which added org.apache.log4j.receivers.db.JNDIConnectionSource and org.apache.log4j.receivers.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.9.10.6 when TuxCare onboarded it (first TuxCare commit a627dc2c). The blocklist is enforced during bean deserialization via BeanDeserializerFactory._validateSubType(), preventing exploitation of the polymorphic typing vulnerability with log4j-extras classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is not affecting this target. The vulnerability was fixed in upstream jackson-databind by commit b5a304a985 (authored by Tatu Saloranta) which added org.apache.log4j.receivers.db.JNDIConnectionSource and org.apache.log4j.receivers.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.9.10.6 when TuxCare onboarded it (first TuxCare commit a627dc2c). The blocklist is enforced during bean deserialization via BeanDeserializerFactory._validateSubType(), preventing exploitation of the polymorphic typing vulnerability with log4j-extras classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.9.10.6. The vulnerability required blocking deserialization of two ehcache JNDI selector classes (GenericJndiSelector and GlassfishSelector) that enable arbitrary code execution via JNDI injection. The fix was already present in upstream release 2.9.10.6 when TuxCare onboarded it. The blocklist entries exist at SubTypeValidator.java:143-144 and are enforced during polymorphic deserialization through BeanDeserializerFactory, preventing instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.9.10.6. The vulnerability required blocking deserialization of two ehcache JNDI selector classes (GenericJndiSelector and GlassfishSelector) that enable arbitrary code execution via JNDI injection. The fix was already present in upstream release 2.9.10.6 when TuxCare onboarded it. The blocklist entries exist at SubTypeValidator.java:143-144 and are enforced during polymorphic deserialization through BeanDeserializerFactory, preventing instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is NOT present in jackson-databind 2.9.10.6. The vulnerability affects versions before 2.9.10.4, allowing unsafe deserialization of ignite-jta classes (CacheJndiTmLookup, CacheJndiTmFactory) and quartz-core (JNDIConnectionProvider) leading to JNDI injection attacks. The fix adds these three classes to SubTypeValidator's deny-list. Target version 2.9.10.6 already contains this fix from the upstream release (first introduced in 2.9.10.4). Fix commit a424c038ba by upstream maintainer Tatu Saloranta was present before TuxCare onboarded this version. The dangerous classes are blocked at SubTypeValidator.java:166-169.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 is NOT present in jackson-databind 2.9.10.6. The vulnerability affects versions before 2.9.10.4, allowing unsafe deserialization of ignite-jta classes (CacheJndiTmLookup, CacheJndiTmFactory) and quartz-core (JNDIConnectionProvider) leading to JNDI injection attacks. The fix adds these three classes to SubTypeValidator's deny-list. Target version 2.9.10.6 already contains this fix from the upstream release (first introduced in 2.9.10.4). Fix commit a424c038ba by upstream maintainer Tatu Saloranta was present before TuxCare onboarded this version. The dangerous classes are blocked at SubTypeValidator.java:166-169.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.9.10.6-tuxcare.2, which already contains the upstream fix that blocks deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and RecoverablePooledConnectionFactory. The fix was shipped in the upstream release 2.9.10.6 and authored by the upstream maintainer (tatu.saloranta@iki.fi), not by TuxCare. The vulnerable gadget classes are present in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at lines 171-173, preventing the exploitation path described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "CVE-2020-10672 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.9.10.6-tuxcare.2, which already contains the upstream fix that blocks deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and RecoverablePooledConnectionFactory. The fix was shipped in the upstream release 2.9.10.6 and authored by the upstream maintainer (tatu.saloranta@iki.fi), not by TuxCare. The vulnerable gadget classes are present in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at lines 171-173, preventing the exploitation path described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4. The target is running version 2.9.10.6, which includes the upstream fix (commit 1645efbd39) that adds com.caucho.config.types.ResourceRef to the deserialization blacklist in SubTypeValidator.java (line 176). This fix was authored by upstream developer Tatu Saloranta and shipped in upstream version 2.9.10.4. TuxCare onboarded version 2.9.10.6, which already contained this fix. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4. The target is running version 2.9.10.6, which includes the upstream fix (commit 1645efbd39) that adds com.caucho.config.types.ResourceRef to the deserialization blacklist in SubTypeValidator.java (line 176). This fix was authored by upstream developer Tatu Saloranta and shipped in upstream version 2.9.10.4. TuxCare onboarded version 2.9.10.6, which already contained this fix. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entries for org.aoju.bus.proxy.provider.remoting.RmiProvider and related classes. The target repository is jackson-databind version 2.9.10.6-tuxcare.2, which already contains the upstream fix that was released in version 2.9.10.4. The fix adds these class names to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 178-180), preventing their deserialization. This fix was authored by the upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entries for org.aoju.bus.proxy.provider.remoting.RmiProvider and related classes. The target repository is jackson-databind version 2.9.10.6-tuxcare.2, which already contains the upstream fix that was released in version 2.9.10.4. The fix adds these class names to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 178-180), preventing their deserialization. This fix was authored by the upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 affects jackson-databind versions before 2.9.10.4. The vulnerability involves javax.swing.JEditorPane being exploitable as a deserialization gadget through polymorphic typing. The target version 2.9.10.6-tuxcare.2 is NOT affected because the upstream vendor (FasterXML) already fixed this vulnerability in commit 4d038c9de0 by adding \"javax.swing.JEditorPane\" to the SubTypeValidator blocklist (line 159). This fix was shipped in the upstream 2.9.10.6 release before TuxCare onboarded it, confirmed by ancestry analysis showing the fix predates TuxCare's first commit (a627dc2c0).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "CVE-2020-10969 affects jackson-databind versions before 2.9.10.4. The vulnerability involves javax.swing.JEditorPane being exploitable as a deserialization gadget through polymorphic typing. The target version 2.9.10.6-tuxcare.2 is NOT affected because the upstream vendor (FasterXML) already fixed this vulnerability in commit 4d038c9de0 by adding \"javax.swing.JEditorPane\" to the SubTypeValidator blocklist (line 159). This fix was shipped in the upstream 2.9.10.6 release before TuxCare onboarded it, confirmed by ancestry analysis showing the fix predates TuxCare's first commit (a627dc2c0).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is not present in jackson-databind 2.9.10.6. The fix adding ActiveMQ class blacklist entries to SubTypeValidator.java was authored by upstream (Tatu Saloranta) in commit c14c9f99 and shipped in the upstream 2.9.10.6 release. All 9 dangerous ActiveMQ classes (ActiveMQConnectionFactory, ActiveMQXAConnectionFactory, spring variants, pool variants, and jms.pool variants) are blacklisted at lines 182-193, preventing their deserialization via polymorphic typing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 is not present in jackson-databind 2.9.10.6. The fix adding ActiveMQ class blacklist entries to SubTypeValidator.java was authored by upstream (Tatu Saloranta) in commit c14c9f99 and shipped in the upstream 2.9.10.6 release. All 9 dangerous ActiveMQ classes (ActiveMQConnectionFactory, ActiveMQXAConnectionFactory, spring variants, pool variants, and jms.pool variants) are blacklisted at lines 182-193, preventing their deserialization via polymorphic typing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability concerns deserialization of the gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The fix (blacklisting this class in SubTypeValidator) was already present in upstream version 2.9.10.4. The target is based on upstream version 2.9.10.6, which includes this fix. The vulnerable code pattern is not present because the fix was shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability concerns deserialization of the gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The fix (blacklisting this class in SubTypeValidator) was already present in upstream version 2.9.10.4. The target is based on upstream version 2.9.10.6, which includes this fix. The vulnerable code pattern is not present because the fix was shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.6-tuxcare.2) is NOT affected by CVE-2020-11113. The vulnerability pattern has been removed by an upstream fix that was already present in the release version TuxCare onboarded. The fix commit (e2ba12d5d60715d95105e3e790fc234cfb59893d) adds \"org.apache.openjpa.ee.WASRegistryManagedRuntime\" to the deserialization deny list in SubTypeValidator.java (line 84), preventing exploitation of this deserialization gadget. This fix was authored by the upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10.4 release, which predates the TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "The target repository (jackson-databind 2.9.10.6-tuxcare.2) is NOT affected by CVE-2020-11113. The vulnerability pattern has been removed by an upstream fix that was already present in the release version TuxCare onboarded. The fix commit (e2ba12d5d60715d95105e3e790fc234cfb59893d) adds \"org.apache.openjpa.ee.WASRegistryManagedRuntime\" to the deserialization deny list in SubTypeValidator.java (line 84), preventing exploitation of this deserialization gadget. This fix was authored by the upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10.4 release, which predates the TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 affects jackson-databind versions before 2.9.10.4. The target repository is jackson-databind version 2.9.10.6-tuxcare.2, which contains the upstream fix (commit 113e89fb08) that adds MethodLocatingFactoryBean and BeanReferenceFactoryBean to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.9.10.6 release when TuxCare onboarded it, authored by the upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 affects jackson-databind versions before 2.9.10.4. The target repository is jackson-databind version 2.9.10.6-tuxcare.2, which contains the upstream fix (commit 113e89fb08) that adds MethodLocatingFactoryBean and BeanReferenceFactoryBean to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.9.10.6 release when TuxCare onboarded it, authored by the upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.9.10.6-tuxcare.2 is NOT AFFECTED by CVE-2020-11620. The vulnerability concerns a deserialization gadget attack using org.apache.commons.jelly.impl.Embedded. The upstream vendor (FasterXML) fixed this vulnerability in commit 77040d85e3 by adding the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.9.10.6, which TuxCare subsequently onboarded. The fix is confirmed present at line 198 of SubTypeValidator.java in the current HEAD (5ea2c157a8), preventing deserialization of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "The target repository jackson-databind version 2.9.10.6-tuxcare.2 is NOT AFFECTED by CVE-2020-11620. The vulnerability concerns a deserialization gadget attack using org.apache.commons.jelly.impl.Embedded. The upstream vendor (FasterXML) fixed this vulnerability in commit 77040d85e3 by adding the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.9.10.6, which TuxCare subsequently onboarded. The fix is confirmed present at line 198 of SubTypeValidator.java in the current HEAD (5ea2c157a8), preventing deserialization of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10.6 is not affected by CVE-2020-14060. The vulnerability (missing blocklist for gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool) was fixed in upstream version 2.9.10.5, and this fix was already present in the upstream 2.9.10.6 release that TuxCare onboarded. The dangerous class is blocked in SubTypeValidator.java line 201. The fix commit (d1c67a0396e84c08d0558fbb843b5bd1f26e1921) was authored by upstream maintainer tatu.saloranta@iki.fi and is an ancestor of the TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "The target jackson-databind 2.9.10.6 is not affected by CVE-2020-14060. The vulnerability (missing blocklist for gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool) was fixed in upstream version 2.9.10.5, and this fix was already present in the upstream 2.9.10.6 release that TuxCare onboarded. The dangerous class is blocked in SubTypeValidator.java line 201. The fix commit (d1c67a0396e84c08d0558fbb843b5bd1f26e1921) was authored by upstream maintainer tatu.saloranta@iki.fi and is an ancestor of the TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target version 2.9.10.6 is NOT affected by CVE-2020-14061. The vulnerability involves using Oracle JMS connection factory classes (oracle.jms.AQjms*ConnectionFactory) as deserialization gadgets for remote code execution. The fix, which adds these classes to Jackson's deserialization blocklist, was authored by upstream maintainer Tatu Saloranta in commit 5c8642aeae and included in upstream release 2.9.10.5 (released June 21, 2020). The target version 2.9.10.6 (released August 24, 2020) inherits this fix from upstream. All five Oracle JMS classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java lines 207-211.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "The target version 2.9.10.6 is NOT affected by CVE-2020-14061. The vulnerability involves using Oracle JMS connection factory classes (oracle.jms.AQjms*ConnectionFactory) as deserialization gadgets for remote code execution. The fix, which adds these classes to Jackson's deserialization blocklist, was authored by upstream maintainer Tatu Saloranta in commit 5c8642aeae and included in upstream release 2.9.10.5 (released June 21, 2020). The target version 2.9.10.6 (released August 24, 2020) inherits this fix from upstream. All five Oracle JMS classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java lines 207-211.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version is 2.9.10.6-tuxcare.2, which was onboarded from upstream release 2.9.10.6. The fix (adding com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to the SubTypeValidator blacklist) was already present in the upstream release, authored by upstream maintainer Tatu Saloranta in commit 840eae2ca81 on 2020-05-01. The vulnerable deserialization gadget pattern is not present in the target because the upstream fix removed it before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version is 2.9.10.6-tuxcare.2, which was onboarded from upstream release 2.9.10.6. The fix (adding com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to the SubTypeValidator blacklist) was already present in the upstream release, authored by upstream maintainer Tatu Saloranta in commit 840eae2ca81 on 2020-05-01. The vulnerable deserialization gadget pattern is not present in the target because the upstream fix removed it before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.6-tuxcare.2) is NOT affected by CVE-2020-14195. The vulnerability affects versions before 2.9.10.5, but the target version 2.9.10.6 already includes the upstream fix. The fix (adding org.jsecurity.realm.jndi.JndiRealmFactory to the deserialization blocklist) was committed by upstream maintainer Tatu Saloranta (commit f6d9c664f6) and was included in the upstream release 2.9.10.6 that TuxCare onboarded. The blocklist entry is present in SubTypeValidator.java at line 214, preventing deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "The target repository (jackson-databind 2.9.10.6-tuxcare.2) is NOT affected by CVE-2020-14195. The vulnerability affects versions before 2.9.10.5, but the target version 2.9.10.6 already includes the upstream fix. The fix (adding org.jsecurity.realm.jndi.JndiRealmFactory to the deserialization blocklist) was committed by upstream maintainer Tatu Saloranta (commit f6d9c664f6) and was included in the upstream release 2.9.10.6 that TuxCare onboarded. The blocklist entry is present in SubTypeValidator.java at line 214, preventing deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is NOT present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability involves unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPDataSource gadget class. The upstream FasterXML project fixed this in the official 2.9.10.6 release (24-Aug-2020) by adding the class to the SubTypeValidator blocklist. This fix was already present in the upstream release that TuxCare onboarded, so the vulnerable pattern does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 is NOT present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability involves unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPDataSource gadget class. The upstream FasterXML project fixed this in the official 2.9.10.6 release (24-Aug-2020) by adding the class to the SubTypeValidator blocklist. This fix was already present in the upstream release that TuxCare onboarded, so the vulnerable pattern does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is not present in jackson-databind 2.9.10.6-tuxcare.2. The fix (blocklist entry for com.pastdev.httpcomponents.configuration.JndiConfiguration) was included in the upstream 2.9.10.6 release by FasterXML maintainer Tatu Saloranta before TuxCare onboarded this version. The SubTypeValidator defense mechanism is active and blocks deserialization of the gadget class at lines 216-217 of SubTypeValidator.java, preventing the exploitation path described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 is not present in jackson-databind 2.9.10.6-tuxcare.2. The fix (blocklist entry for com.pastdev.httpcomponents.configuration.JndiConfiguration) was included in the upstream 2.9.10.6 release by FasterXML maintainer Tatu Saloranta before TuxCare onboarded this version. The SubTypeValidator defense mechanism is active and blocks deserialization of the gadget class at lines 216-217 of SubTypeValidator.java, preventing the exploitation path described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-36181 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 affects jackson-databind versions before 2.9.10.2 due to missing blocklist entry for org.apache.xbean.propertyeditor.JndiConverter. The target version 2.9.10.6 contains the upstream fix that blocks this dangerous class from deserialization. The fix (commits 9bb52c7122 and 914e7c9f2c) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.9.10.6, which TuxCare then onboarded. The blocklist entry is present at SubTypeValidator.java:147, preventing the JNDI injection attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 affects jackson-databind versions before 2.9.10.2 due to missing blocklist entry for org.apache.xbean.propertyeditor.JndiConverter. The target version 2.9.10.6 contains the upstream fix that blocks this dangerous class from deserialization. The fix (commits 9bb52c7122 and 914e7c9f2c) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.9.10.6, which TuxCare then onboarded. The blocklist entry is present at SubTypeValidator.java:147, preventing the JNDI injection attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is NOT present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability involves deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target contains the upstream fix (commit 9f4e97019f by Tatu Saloranta) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES denylist in SubTypeValidator.java (line 150). This fix was included in upstream release 2.9.10.4 and was part of the 2.9.10.6 base that TuxCare onboarded via commit a627dc2c02. The vulnerable code pattern is not present because the gadget class is blocked from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 is NOT present in jackson-databind 2.9.10.6-tuxcare.2. The vulnerability involves deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target contains the upstream fix (commit 9f4e97019f by Tatu Saloranta) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES denylist in SubTypeValidator.java (line 150). This fix was included in upstream release 2.9.10.4 and was part of the 2.9.10.6 base that TuxCare onboarded via commit a627dc2c02. The vulnerable code pattern is not present because the gadget class is blocked from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4. The target is version 2.9.10.6-tuxcare.2, which already contains the upstream fix. The vulnerable gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig is present in the SubTypeValidator blocklist at lines 152-154, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.10.4, before TuxCare onboarded version 2.9.10.6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4. The target is version 2.9.10.6-tuxcare.2, which already contains the upstream fix. The vulnerable gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig is present in the SubTypeValidator blocklist at lines 152-154, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.10.4, before TuxCare onboarded version 2.9.10.6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is NOT present in jackson-databind 2.9.10.6. The vulnerability involves deserialization gadgets related to br.com.anteros.dbcp.AnterosDBCPConfig. The fix (adding this class to the deserialization blocklist) was included in upstream release 2.9.10.4 (11-Apr-2020), and the target version 2.9.10.6 (24-Aug-2020) already contains this fix. The blocklist entry is present at SubTypeValidator.java:154 and is active by default during all deserialization operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 is NOT present in jackson-databind 2.9.10.6. The vulnerability involves deserialization gadgets related to br.com.anteros.dbcp.AnterosDBCPConfig. The fix (adding this class to the deserialization blocklist) was included in upstream release 2.9.10.4 (11-Apr-2020), and the target version 2.9.10.6 (24-Aug-2020) already contains this fix. The blocklist entry is present at SubTypeValidator.java:154 and is active by default during all deserialization operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2021-20190 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2022-42004 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" }, "action_statement": "Vulnerability CVE-2022-42004 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-06T18:52:00.040792+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-54512 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" }, "action_statement": "Vulnerability CVE-2026-54512 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-09T14:21:35.881861+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.6-tuxcare.4.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.6-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.10.6 is not affected by CVE-2026-54518. The vulnerable method `processUnwrappedCreatorProperties()` does not exist in this version. The feature it implements\u2014support for `@JsonUnwrapped` with `@JsonCreator` parameters\u2014was added in version 2.19.0 (commit 502fe888da, November 2024) and is explicitly unsupported in 2.9.x. Any attempt to define a creator parameter with `@JsonUnwrapped` ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Version 2.9.10.6 is not affected by CVE-2026-54518. The vulnerable method `processUnwrappedCreatorProperties()` does not exist in this version. The feature it implements\u2014support for `@JsonUnwrapped` with `@JsonCreator` parameters\u2014was added in version 2.19.0 (commit 502fe888da, November 2024) and is explicitly unsupported in 2.9.x. Any attempt to define a creator parameter with `@JsonUnwrapped` ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-59888 targets a vulnerability specific to Java Records (introduced in Java 16) where @JsonIgnore on a Record component can be bypassed using a PropertyNamingStrategy-renamed JSON key. The target version jackson-databind 2.9.10.6 is built for Java 1.7 (14 major versions before Java 16) and contains no Record deserialization support. The vulnerability mechanism cannot exist in this versi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 CVE-2026-59888 targets a vulnerability specific to Java Records (introduced in Java 16) where @JsonIgnore on a Record component can be bypassed using a PropertyNamingStrategy-renamed JSON key. The target version jackson-databind 2.9.10.6 is built for Java 1.7 (14 major versions before Java 16) and contains no Record deserialization support. The vulnerability mechanism cannot exist in this versi..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-83557 does not affect version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.10.6 is not affected by CVE-2026-83557. The vulnerability targets DefaultBaseTypeLimitingValidator, a class introduced in jackson-databind 2.11+ that performs base-type validation for polymorphic deserialization. Version 2.9.10.6 uses a fundamentally different validation architecture (SubTypeValidator) that does not implement base-type checking at all. The specific code path describ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-83557" }, "impact_statement": "not_affected \u2014 Version 2.9.10.6 is not affected by CVE-2026-83557. The vulnerability targets DefaultBaseTypeLimitingValidator, a class introduced in jackson-databind 2.11+ that performs base-type validation for polymorphic deserialization. Version 2.9.10.6 uses a fundamentally different validation architecture (SubTypeValidator) that does not implement base-type checking at all. The specific code path describ..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.10.6-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.6-tuxcare.3" } } ], "timestamp": "2026-11-05T10:37:27.142829+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.10.6-tuxcare.3.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }