{ "@id": "urn:uuid:401f0875-030d-48b4-b92d-ee8b772e43f1", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T09:07:00.104026+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.5 is not affected by CVE-2017-15095. The upstream fix (commit ddfddfba by tatu.saloranta@iki.fi) was already present in the 2.9.5 release when TuxCare onboarded it. All dangerous classes from issues #1737 and #1680 are protected via explicit blacklisting and pattern matching in SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "Target version 2.9.5 is not affected by CVE-2017-15095. The upstream fix (commit ddfddfba by tatu.saloranta@iki.fi) was already present in the 2.9.5 release when TuxCare onboarded it. All dangerous classes from issues #1737 and #1680 are protected via explicit blacklisting and pattern matching in SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.5-tuxcare.2) is NOT vulnerable to CVE-2017-17485. The complete fix for this deserialization vulnerability is already present in the codebase, having been included in the upstream 2.9.5 release that TuxCare onboarded. The fix consists of SubTypeValidator class with comprehensive blacklist validation and Spring/C3P0 class hierarchy checks, preventing remote code execution via malicious JSON payloads containing gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "The target repository (jackson-databind 2.9.5-tuxcare.2) is NOT vulnerable to CVE-2017-17485. The complete fix for this deserialization vulnerability is already present in the codebase, having been included in the upstream 2.9.5 release that TuxCare onboarded. The fix consists of SubTypeValidator class with comprehensive blacklist validation and Spring/C3P0 class hierarchy checks, preventing remote code execution via malicious JSON payloads containing gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target version 2.9.5-tuxcare.2 includes the upstream vendor fix (commit 60d459cedc by Tatu Saloranta) that was shipped in the original 2.9.5 release. The fix adds comprehensive validation via SubTypeValidator that blocks deserialization of dangerous gadget classes (TemplatesImpl, InvokerTransformer, InstantiateTransformer, etc.) before bean deserializer construction. This validation is called at BeanDeserializerFactory line 135, on the critical path for all bean deserialization operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target version 2.9.5-tuxcare.2 includes the upstream vendor fix (commit 60d459cedc by Tatu Saloranta) that was shipped in the original 2.9.5 release. The fix adds comprehensive validation via SubTypeValidator that blocks deserialization of dangerous gadget classes (TemplatesImpl, InvokerTransformer, InstantiateTransformer, etc.) before bean deserializer construction. This validation is called at BeanDeserializerFactory line 135, on the critical path for all bean deserialization operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2018-11307 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-11307" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2018-12022 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-12022" }, "action_statement": "Vulnerability CVE-2018-12022 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2018-12023 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-12023" }, "action_statement": "Vulnerability CVE-2018-12023 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2018-14718 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14718" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2018-14719 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14719" }, "action_statement": "Vulnerability CVE-2018-14719 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2018-14720 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14720" }, "action_statement": "Vulnerability CVE-2018-14720 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-13T09:07:00.104026+00:00", "status_notes": "Vulnerability CVE-2018-14721 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.5-tuxcare.7.", "vulnerability": { "name": "CVE-2018-14721" }, "action_statement": "Vulnerability CVE-2018-14721 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.5-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-13T09:07:00.104026+00:00", "status_notes": "Vulnerability CVE-2018-19360 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.5-tuxcare.7.", "vulnerability": { "name": "CVE-2018-19360" }, "action_statement": "Vulnerability CVE-2018-19360 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.5-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-13T09:07:00.104026+00:00", "status_notes": "Vulnerability CVE-2018-19361 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.5-tuxcare.7.", "vulnerability": { "name": "CVE-2018-19361" }, "action_statement": "Vulnerability CVE-2018-19361 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.5-tuxcare.7." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2018-19362 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19362" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.9.5-tuxcare.3. The vulnerability involves two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist to achieve remote code execution. The upstream fix adding these classes to the blacklist was already present in the 2.9.5 release that TuxCare onboarded. The fix is found at SubTypeValidator.java lines 61-62, authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 038b471e2e, which predates the first TuxCare commit (e313f420cab \"Onboard version 2.9.5\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.9.5-tuxcare.3. The vulnerability involves two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist to achieve remote code execution. The upstream fix adding these classes to the blacklist was already present in the 2.9.5 release that TuxCare onboarded. The fix is found at SubTypeValidator.java lines 61-62, authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 038b471e2e, which predates the first TuxCare commit (e313f420cab \"Onboard version 2.9.5\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 (c3p0 deserialization gadget bypass) is NOT present in jackson-databind 2.9.5-tuxcare.2. The fix was already included in the upstream 2.9.5 release that TuxCare onboarded. The defense logic blocking com.mchange.v2.c3p0.*DataSource classes is present in SubTypeValidator.java lines 177-187, preventing malicious JSON with c3p0 type hints from triggering remote code execution during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 (c3p0 deserialization gadget bypass) is NOT present in jackson-databind 2.9.5-tuxcare.2. The fix was already included in the upstream 2.9.5 release that TuxCare onboarded. The defense logic blocking com.mchange.v2.c3p0.*DataSource classes is present in SubTypeValidator.java lines 177-187, preventing malicious JSON with c3p0 type hints from triggering remote code execution during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2019-12086 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12086" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2019-12384 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12384" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2019-12814 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12814" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2019-14379 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14379" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2019-14439 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14439" }, "action_statement": "Vulnerability CVE-2019-14439 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:18:00.045786+00:00", "status_notes": "Vulnerability CVE-2019-14540 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14540" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2019-14892 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14892" }, "action_statement": "Vulnerability CVE-2019-14892 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-13T09:07:00.104026+00:00", "status_notes": "Vulnerability CVE-2019-14893 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.5-tuxcare.7.", "vulnerability": { "name": "CVE-2019-14893" }, "action_statement": "Vulnerability CVE-2019-14893 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.5-tuxcare.7." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:18:00.045786+00:00", "status_notes": "Vulnerability CVE-2019-16335 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16335" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2019-16942 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16942" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2019-16943 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16943" }, "action_statement": "Vulnerability CVE-2019-16943 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2019-17267 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17267" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2019-17531 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17531" }, "action_statement": "Vulnerability CVE-2019-17531 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2019-20330 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-20330" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-10650 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10650" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:18:00.045786+00:00", "status_notes": "Vulnerability CVE-2020-10672 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10672" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-10673 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10673" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-10969 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10969" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-11111 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11111" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-11112 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11112" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-11113 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11113" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-11619 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11619" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:18:00.045786+00:00", "status_notes": "Vulnerability CVE-2020-11620 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11620" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-14061 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-14062 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-14195 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14195" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-36181 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-8840 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-8840" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-13T09:07:00.104026+00:00", "status_notes": "Vulnerability CVE-2020-9546 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.5-tuxcare.7.", "vulnerability": { "name": "CVE-2020-9546" }, "action_statement": "Vulnerability CVE-2020-9546 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.5-tuxcare.7." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-9547 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9547" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2021-20190 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.5 is not affected by CVE-2026-54512. The vulnerability specifically targets PolymorphicTypeValidator (PTV), a configurable type validation mechanism introduced in jackson-databind 2.10.0. Version 2.9.5 predates PTV and uses a different validation architecture (SubTypeValidator with hard-coded blacklist) that is not subject to the generic-parameter bypass described in the CVE. The vulnerable method _resolveAndValidateGeneric() does not exist in this version. TuxCare has backported this CVE to versions 2.14.1+ but not to 2.9.5, consistent with the CVE's stated affected range \"From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4\".", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.9.5 is not affected by CVE-2026-54512. The vulnerability specifically targets PolymorphicTypeValidator (PTV), a configurable type validation mechanism introduced in jackson-databind 2.10.0. Version 2.9.5 predates PTV and uses a different validation architecture (SubTypeValidator with hard-coded blacklist) that is not subject to the generic-parameter bypass described in the CVE. The vulnerable method _resolveAndValidateGeneric() does not exist in this version. TuxCare has backported this CVE to versions 2.14.1+ but not to 2.9.5, consistent with the CVE's stated affected range \"From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4\"." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-54518 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54518" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-59888 affects Java Records deserialization with @JsonIgnore annotations when PropertyNamingStrategy is used. The target version (jackson-databind 2.9.5) does not support Java Records. Records support was added in version 2.12.0 (2020), and the vulnerable pattern was introduced in 2.15.0. The target predates both by 2+ years. TuxCare backported this CVE to versions 2.15.0 through 2.21.2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 CVE-2026-59888 affects Java Records deserialization with @JsonIgnore annotations when PropertyNamingStrategy is used. The target version (jackson-databind 2.9.5) does not support Java Records. Records support was added in version 2.12.0 (2020), and the vulnerable pattern was introduced in 2.15.0. The target predates both by 2+ years. TuxCare backported this CVE to versions 2.15.0 through 2.21.2..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-83557 does not affect version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-83557 targets `DefaultBaseTypeLimitingValidator` \u2014 a base-type validation class introduced in jackson-databind 2.10+ \u2014 and specifically concerns the absence of `java.lang.Comparable` from its unsafe base types list. Version 2.9.5 predates this validation architecture entirely; it uses `SubTypeValidator`, a simpler denylist-based validator with no concept of base-type restrictions. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-83557" }, "impact_statement": "not_affected \u2014 CVE-2026-83557 targets `DefaultBaseTypeLimitingValidator` \u2014 a base-type validation class introduced in jackson-databind 2.10+ \u2014 and specifically concerns the absence of `java.lang.Comparable` from its unsafe base types list. Version 2.9.5 predates this validation architecture entirely; it uses `SubTypeValidator`, a simpler denylist-based validator with no concept of base-type restrictions. The ..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.5-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5-tuxcare.6" } } ], "timestamp": "2026-11-10T11:17:30.378765+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.5-tuxcare.6.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }