{ "@id": "urn:uuid:890d3299-7b5c-4f44-b133-c2b31f8bfadc", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T18:04:00.707637+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is NOT present in jackson-databind 2.9.7-tuxcare.4. The vulnerability affects versions prior to 2.8.11 and 2.9.4, but version 2.9.7 (released Sep 2018) includes upstream fixes from issues #1680 and #1737 that blacklist all the dangerous gadget classes. The SubTypeValidator class contains the complete blacklist and validation is enforced in the deserialization path via BeanDeserializerFactory._validateSubType(). All vulnerable classes (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, Spring/c3p0 gadgets) are blocked. The fixes were authored by upstream maintainer Tatu Saloranta and shipped in the 2.9.7 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 is NOT present in jackson-databind 2.9.7-tuxcare.4. The vulnerability affects versions prior to 2.8.11 and 2.9.4, but version 2.9.7 (released Sep 2018) includes upstream fixes from issues #1680 and #1737 that blacklist all the dangerous gadget classes. The SubTypeValidator class contains the complete blacklist and validation is enforced in the deserialization path via BeanDeserializerFactory._validateSubType(). All vulnerable classes (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, Spring/c3p0 gadgets) are blocked. The fixes were authored by upstream maintainer Tatu Saloranta and shipped in the 2.9.7 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is an incomplete fix for CVE-2017-7525, allowing RCE via malicious JSON that bypasses deserialization blacklists when Spring libraries are present (affects jackson-databind \u22642.8.10 and 2.9.0-2.9.3). Target: jackson-databind 2.9.7-tuxcare.4. Analysis confirms the fix is present: SubTypeValidator class with comprehensive blacklist validation was added by upstream Jackson maintainer Tatu Saloranta in commit 2235894210, which shipped in upstream 2.9.7 before TuxCare onboarding (first TuxCare commit: 409565b0). The fix includes: (1) exact class name blacklist for dangerous classes including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader; (2) Spring pattern matching blocking any class extending AbstractPointcutAdvisor or AbstractApplicationContext; (3) C3P0 pattern matching blocking classes ending with DataSource; (4) proper integration in BeanDeserializerFactory.createBeanDeserializer (line 135). All defenses verified present and functional. Verdict: not_affected (upstream fix).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 is an incomplete fix for CVE-2017-7525, allowing RCE via malicious JSON that bypasses deserialization blacklists when Spring libraries are present (affects jackson-databind \u22642.8.10 and 2.9.0-2.9.3). Target: jackson-databind 2.9.7-tuxcare.4. Analysis confirms the fix is present: SubTypeValidator class with comprehensive blacklist validation was added by upstream Jackson maintainer Tatu Saloranta in commit 2235894210, which shipped in upstream 2.9.7 before TuxCare onboarding (first TuxCare commit: 409565b0). The fix includes: (1) exact class name blacklist for dangerous classes including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader; (2) Spring pattern matching blocking any class extending AbstractPointcutAdvisor or AbstractApplicationContext; (3) C3P0 pattern matching blocking classes ending with DataSource; (4) proper integration in BeanDeserializerFactory.createBeanDeserializer (line 135). All defenses verified present and functional. Verdict: not_affected (upstream fix).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is NOT present in jackson-databind 2.9.7-tuxcare.4. The vulnerability (deserialization RCE via polymorphic typing with gadget classes) was fixed by upstream Jackson maintainer Tatu Saloranta in commit 2235894210 (Dec 2017), which introduced SubTypeValidator with a comprehensive blacklist of dangerous classes including InvokerTransformer, InstantiateTransformer, MethodClosure, TemplatesImpl, and others explicitly addressing issue #1599 (CVE-2017-7525). This fix was included in upstream release 2.7.9.2 and shipped in the 2.9.7 release that TuxCare onboarded\u2014no TuxCare backport was needed. The defense is active at BeanDeserializerFactory.createBeanDeserializer() line 135, blocking dangerous class deserialization before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 is NOT present in jackson-databind 2.9.7-tuxcare.4. The vulnerability (deserialization RCE via polymorphic typing with gadget classes) was fixed by upstream Jackson maintainer Tatu Saloranta in commit 2235894210 (Dec 2017), which introduced SubTypeValidator with a comprehensive blacklist of dangerous classes including InvokerTransformer, InstantiateTransformer, MethodClosure, TemplatesImpl, and others explicitly addressing issue #1599 (CVE-2017-7525). This fix was included in upstream release 2.7.9.2 and shipped in the 2.9.7 release that TuxCare onboarded\u2014no TuxCare backport was needed. The defense is active at BeanDeserializerFactory.createBeanDeserializer() line 135, blocking dangerous class deserialization before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT a vulnerability in jackson-databind 2.9.7-tuxcare.4. The fix (blacklisting org.apache.ibatis.parsing.XPathParser to prevent deserialization-based data exfiltration) was already present in upstream version 2.9.7 when TuxCare onboarded it. The vulnerable code pattern does not exist in this version because upstream maintainer Tatu Saloranta fixed it in May 2018 (commit 27b4defc27), before the 2.9.7 release that TuxCare later onboarded in October 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is NOT a vulnerability in jackson-databind 2.9.7-tuxcare.4. The fix (blacklisting org.apache.ibatis.parsing.XPathParser to prevent deserialization-based data exfiltration) was already present in upstream version 2.9.7 when TuxCare onboarded it. The vulnerable code pattern does not exist in this version because upstream maintainer Tatu Saloranta fixed it in May 2018 (commit 27b4defc27), before the 2.9.7 release that TuxCare later onboarded in October 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target is version 2.9.7-tuxcare.4, which already includes the upstream fix in its base release. The fix adds three class names to SubTypeValidator's deserialization blacklist: jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet. These entries are present in the target at SubTypeValidator.java lines 64-69. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream 2.9.7 release before TuxCare onboarded the codebase (first TuxCare commit: 409565b0a95f028fecea7c77f6b04c291e581678 \"Onboard version 2.9.7\"). The blacklist mechanism is properly wired: validateSubType() checks _cfgIllegalClassNames.contains(full) at line 175, breaks if matched, and throws JsonMappingException at lines 208-209.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target is version 2.9.7-tuxcare.4, which already includes the upstream fix in its base release. The fix adds three class names to SubTypeValidator's deserialization blacklist: jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet. These entries are present in the target at SubTypeValidator.java lines 64-69. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream 2.9.7 release before TuxCare onboarded the codebase (first TuxCare commit: 409565b0a95f028fecea7c77f6b04c291e581678 \"Onboard version 2.9.7\"). The blacklist mechanism is properly wired: validateSubType() checks _cfgIllegalClassNames.contains(full) at line 175, breaks if matched, and throws JsonMappingException at lines 208-209.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind versions prior to 2.9.6. The target is jackson-databind 2.9.7-tuxcare.4, which already includes the upstream fix that blacklists Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.7 release before TuxCare onboarding. The vulnerable deserialization pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 affects jackson-databind versions prior to 2.9.6. The target is jackson-databind 2.9.7-tuxcare.4, which already includes the upstream fix that blacklists Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.7 release before TuxCare onboarding. The vulnerable deserialization pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.9.7-tuxcare.4. The vulnerability (unsafe polymorphic deserialization of org.slf4j.ext.EventData) was fixed by the upstream FasterXML maintainer in commit 87d29af25e, which was included in the upstream 2.9.7 release. The fix adds org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 71-75), preventing this class from being deserialized. TuxCare onboarded this already-fixed version. The defense is active by default with no configuration required.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.9.7-tuxcare.4. The vulnerability (unsafe polymorphic deserialization of org.slf4j.ext.EventData) was fixed by the upstream FasterXML maintainer in commit 87d29af25e, which was included in the upstream 2.9.7 release. The fix adds org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 71-75), preventing this class from being deserialized. TuxCare onboarded this already-fixed version. The defense is active by default with no configuration required.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.9.7-tuxcare.4 is NOT AFFECTED by CVE-2018-14719. The vulnerability affects versions before 2.9.7, and the fix (adding flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor to the polymorphic deserialization blocklist) was already present in the upstream 2.9.7 release. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the version that TuxCare onboarded, meaning the vulnerable pattern never existed in the TuxCare-maintained codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "The target jackson-databind version 2.9.7-tuxcare.4 is NOT AFFECTED by CVE-2018-14719. The vulnerability affects versions before 2.9.7, and the fix (adding flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor to the polymorphic deserialization blocklist) was already present in the upstream 2.9.7 release. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the version that TuxCare onboarded, meaning the vulnerable pattern never existed in the TuxCare-maintained codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.9.7-tuxcare.4. The vulnerability affects versions before 2.9.7, and the target version 2.9.7 contains the upstream fix (commit 87d29af25e) that was shipped with the original 2.9.7 release. The fix adds four dangerous classes to the deserialization blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java, preventing XXE attacks via polymorphic deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.9.7-tuxcare.4. The vulnerability affects versions before 2.9.7, and the target version 2.9.7 contains the upstream fix (commit 87d29af25e) that was shipped with the original 2.9.7 release. The fix adds four dangerous classes to the deserialization blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java, preventing XXE attacks via polymorphic deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.9.7-tuxcare.4 is NOT affected by CVE-2018-14721. The vulnerability pattern (polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl enabling SSRF) is not present because the upstream fix blocking this class was already shipped in jackson-databind 2.9.7, which TuxCare onboarded. The blocklist entry exists in SubTypeValidator.java:75, and validation occurs before any deserialization in BeanDeserializerFactory.java:135.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "Target jackson-databind 2.9.7-tuxcare.4 is NOT affected by CVE-2018-14721. The vulnerability pattern (polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl enabling SSRF) is not present because the upstream fix blocking this class was already shipped in jackson-databind 2.9.7, which TuxCare onboarded. The blocklist entry exists in SubTypeValidator.java:75, and validation occurs before any deserialization in BeanDeserializerFactory.java:135.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2018-19360 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19360" }, "action_statement": "Vulnerability CVE-2018-19360 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2018-19361 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19361" }, "action_statement": "Vulnerability CVE-2018-19361 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2018-19362 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19362" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.9.7-tuxcare.4. The vulnerability involved an incomplete deserialization blacklist that allowed two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to bypass security controls. The fix adding these classes to the blacklist was included in upstream release 2.9.7, which TuxCare onboarded. Both gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 59-60) and are actively enforced by the validateSubType() method. The vulnerable pattern (incomplete blacklist) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.9.7-tuxcare.4. The vulnerability involved an incomplete deserialization blacklist that allowed two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to bypass security controls. The fix adding these classes to the blacklist was included in upstream release 2.9.7, which TuxCare onboarded. Both gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 59-60) and are actively enforced by the validateSubType() method. The vulnerable pattern (incomplete blacklist) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 affects jackson-databind versions before 2.9.5. The target is version 2.9.7-tuxcare.4, which already contains the upstream fix. The c3p0 deserialization defense (blocking classes matching \"com.mchange.v2.c3p0.*DataSource\") was added by upstream author Tatu Saloranta in commit 6799f8f10cc (2018-02-10) and shipped with the 2.9.7 release that TuxCare onboarded. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 affects jackson-databind versions before 2.9.5. The target is version 2.9.7-tuxcare.4, which already contains the upstream fix. The c3p0 deserialization defense (blocking classes matching \"com.mchange.v2.c3p0.*DataSource\") was added by upstream author Tatu Saloranta in commit 6799f8f10cc (2018-02-10) and shipped with the 2.9.7 release that TuxCare onboarded. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-12086 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12086" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-12384 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12384" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-12814 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12814" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-14379 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14379" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-14439 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14439" }, "action_statement": "Vulnerability CVE-2019-14439 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-14540 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14540" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-14892 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14892" }, "action_statement": "Vulnerability CVE-2019-14892 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-14893 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14893" }, "action_statement": "Vulnerability CVE-2019-14893 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-16335 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16335" }, "action_statement": "Vulnerability CVE-2019-16335 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-16942 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16942" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-16943 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16943" }, "action_statement": "Vulnerability CVE-2019-16943 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-17267 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17267" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-17531 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17531" }, "action_statement": "Vulnerability CVE-2019-17531 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2019-20330 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-20330" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-10650 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10650" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-10672 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10672" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-10673 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10673" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-10969 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10969" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-11111 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11111" }, "action_statement": "Vulnerability CVE-2020-11111 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-11112 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11112" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-11113 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11113" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-11619 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11619" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:04:00.707637+00:00", "status_notes": "Vulnerability CVE-2020-11620 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11620" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-14061 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-14062 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-14195 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14195" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-36181 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-8840 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-8840" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-9546 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9546" }, "action_statement": "Vulnerability CVE-2020-9546 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-9547 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9547" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2021-20190 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.7 is not affected by CVE-2026-54512. The vulnerability targets bypass of PolymorphicTypeValidator (PTV) allowlist configurations when type identifiers contain generic parameters (e.g., java.util.ArrayList bypassing an allowlist that only permits ArrayList). However, the PTV mechanism does not exist in version 2.9.7, which predates its introduction in version 2.10.0. Version 2.9.7 only has SubTypeValidator with a hardcoded blacklist of ~20 known gadget classes, not a configurable allowlist. The architectural mechanism that the CVE targets (configurable PTV with allowlist semantics) is absent from this version, making the specific vulnerability pattern impossible to manifest. While 2.9.7 has polymorphic deserialization support, the concept of \"bypassing a configured allowlist by smuggling denied types as generic parameters\" cannot occur when no allowlist configuration mechanism exists.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.9.7 is not affected by CVE-2026-54512. The vulnerability targets bypass of PolymorphicTypeValidator (PTV) allowlist configurations when type identifiers contain generic parameters (e.g., java.util.ArrayList bypassing an allowlist that only permits ArrayList). However, the PTV mechanism does not exist in version 2.9.7, which predates its introduction in version 2.10.0. Version 2.9.7 only has SubTypeValidator with a hardcoded blacklist of ~20 known gadget classes, not a configurable allowlist. The architectural mechanism that the CVE targets (configurable PTV with allowlist semantics) is absent from this version, making the specific vulnerability pattern impossible to manifest. While 2.9.7 has polymorphic deserialization support, the concept of \"bypassing a configured allowlist by smuggling denied types as generic parameters\" cannot occur when no allowlist configuration mechanism exists." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.7 is NOT AFFECTED by CVE-2026-54518. The vulnerability requires the `processUnwrappedCreatorProperties()` method and support for unwrapped creator parameters (combining `@JsonUnwrapped` with `@JsonCreator`), which were not implemented until commit 502fe888da (2024-11-13), first appearing in version 2.21.0+. The specific vulnerable code path does not exist in 2.9.7. Code comment at B...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Version 2.9.7 is NOT AFFECTED by CVE-2026-54518. The vulnerability requires the `processUnwrappedCreatorProperties()` method and support for unwrapped creator parameters (combining `@JsonUnwrapped` with `@JsonCreator`), which were not implemented until commit 502fe888da (2024-11-13), first appearing in version 2.21.0+. The specific vulnerable code path does not exist in 2.9.7. Code comment at B..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 jackson-databind 2.9.7 is not affected by CVE-2026-59888. The vulnerability requires Java Records support with @JsonIgnore annotations and PropertyNamingStrategy, but version 2.9.7 predates Java Records entirely. Java Records were introduced in Java 14 (preview, March 2020) and became stable in Java 16 (March 2021). Jackson's Records support was added in version 2.12 (November 2020), while vers...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 jackson-databind 2.9.7 is not affected by CVE-2026-59888. The vulnerability requires Java Records support with @JsonIgnore annotations and PropertyNamingStrategy, but version 2.9.7 predates Java Records entirely. Java Records were introduced in Java 14 (preview, March 2020) and became stable in Java 16 (March 2021). Jackson's Records support was added in version 2.12 (November 2020), while vers..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.7-tuxcare.7 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7-tuxcare.7" } } ], "timestamp": "2026-11-10T18:03:46.249784+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.7-tuxcare.7.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }