{ "@id": "urn:uuid:df6cea10-80d2-4f60-a0b7-7f85712dc7eb", "role": "Document Creator", "author": "https://tuxcare.com", "version": 27, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T11:04:00.115545+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:11:20.672019+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4, involving a polymorphic deserialization flaw that allows arbitrary code execution. The target repository is jackson-databind version 2.9.9.1-tuxcare.4, which already contains the fix. The vulnerability allowed attackers to exploit polymorphic type handling by specifying dangerous class names (like java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring/C3P0 classes) in JSON input to ObjectMapper.readValue(). The fix adds these classes to a blacklist (DEFAULT_NO_DESER_CLASS_NAMES) that rejects their deserialization. All required blacklist entries are present in the target's SubTypeValidator.java file (lines 47-48, 51, 200-220). The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.9.1 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4, involving a polymorphic deserialization flaw that allows arbitrary code execution. The target repository is jackson-databind version 2.9.9.1-tuxcare.4, which already contains the fix. The vulnerability allowed attackers to exploit polymorphic type handling by specifying dangerous class names (like java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring/C3P0 classes) in JSON input to ObjectMapper.readValue(). The fix adds these classes to a blacklist (DEFAULT_NO_DESER_CLASS_NAMES) that rejects their deserialization. All required blacklist entries are present in the target's SubTypeValidator.java file (lines 47-48, 51, 200-220). The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.9.1 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:46:24.540154+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is not present in jackson-databind 2.9.9.1-tuxcare.4. The vulnerability was fixed in upstream versions 2.8.10 (issue #1737) and 2.8.11 (issue #1855) through the introduction of SubTypeValidator class and expanded blacklist of dangerous gadget classes. The target version 2.9.9.1 is significantly newer (released July 2019) and includes all required fixes from the upstream vendor. The SubTypeValidator contains all blacklist entries for Spring framework types (AbstractPointcutAdvisor, AbstractApplicationContext), c3p0 DataSource classes, Tomcat DBCP, JDK types (FileHandler, UnicastRemoteObject), and other gadget classes identified in the CVE. The validation is actively invoked during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 is not present in jackson-databind 2.9.9.1-tuxcare.4. The vulnerability was fixed in upstream versions 2.8.10 (issue #1737) and 2.8.11 (issue #1855) through the introduction of SubTypeValidator class and expanded blacklist of dangerous gadget classes. The target version 2.9.9.1 is significantly newer (released July 2019) and includes all required fixes from the upstream vendor. The SubTypeValidator contains all blacklist entries for Spring framework types (AbstractPointcutAdvisor, AbstractApplicationContext), c3p0 DataSource classes, Tomcat DBCP, JDK types (FileHandler, UnicastRemoteObject), and other gadget classes identified in the CVE. The validation is actively invoked during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:29:58.600651+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.9.1 is NOT affected by CVE-2017-7525. The upstream vendor (FasterXML) shipped the fix in release 2.9.9.1 via SubTypeValidator class that blacklists dangerous deserialization gadget classes including both TemplatesImpl variants. TuxCare onboarded this version with the fix already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "Target version 2.9.9.1 is NOT affected by CVE-2017-7525. The upstream vendor (FasterXML) shipped the fix in release 2.9.9.1 via SubTypeValidator class that blacklists dangerous deserialization gadget classes including both TemplatesImpl variants. TuxCare onboarded this version with the fix already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:21:55.137725+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.9.9.1-tuxcare.4. The vulnerability was fixed in upstream version 2.9.6 (commit 27b4defc27 by Tatu Saloranta), which added org.apache.ibatis.parsing.XPathParser to the deserialization blacklist in SubTypeValidator.java. Since the target is based on upstream 2.9.9.1 (newer than 2.9.6), the fix was already included in the upstream release that TuxCare onboarded. The blacklist entry is present on line 62 of SubTypeValidator.java, preventing deserialization of the iBatis XPathParser gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.9.9.1-tuxcare.4. The vulnerability was fixed in upstream version 2.9.6 (commit 27b4defc27 by Tatu Saloranta), which added org.apache.ibatis.parsing.XPathParser to the deserialization blacklist in SubTypeValidator.java. Since the target is based on upstream 2.9.9.1 (newer than 2.9.6), the fix was already included in the upstream release that TuxCare onboarded. The blacklist entry is present on line 62 of SubTypeValidator.java, preventing deserialization of the iBatis XPathParser gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T17:20:54.241430+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is not present in jackson-databind 2.9.9.1-tuxcare.4. The upstream fix (commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a by Tatu Saloranta) that blacklists the vulnerable Jodd-db and Oracle JDBC gadget classes was already included in the upstream 2.9.9.1 release before TuxCare onboarded it. The SubTypeValidator.java file contains the required blacklist entries for jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet at lines 64-69, preventing polymorphic deserialization of these classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 is not present in jackson-databind 2.9.9.1-tuxcare.4. The upstream fix (commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a by Tatu Saloranta) that blacklists the vulnerable Jodd-db and Oracle JDBC gadget classes was already included in the upstream 2.9.9.1 release before TuxCare onboarded it. The SubTypeValidator.java file contains the required blacklist entries for jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet at lines 64-69, preventing polymorphic deserialization of these classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:21:53.187202+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.9.9.1-tuxcare.4. The vulnerability involves polymorphic deserialization of Oracle JDBC driver classes (OracleManagedConnectionFactory, OracleJDBCRowSet) that enable JNDI/LDAP lookup attacks when Default Typing is enabled. The fix blacklists these classes in SubTypeValidator. This fix was already present in upstream release 2.9.9.1 (commit 28badf7e by tatu.saloranta@iki.fi, June 2018) before TuxCare onboarded the version. Lines 67-69 of SubTypeValidator.java contain the defense that blocks deserialization of the two Oracle JDBC classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.9.9.1-tuxcare.4. The vulnerability involves polymorphic deserialization of Oracle JDBC driver classes (OracleManagedConnectionFactory, OracleJDBCRowSet) that enable JNDI/LDAP lookup attacks when Default Typing is enabled. The fix blacklists these classes in SubTypeValidator. This fix was already present in upstream release 2.9.9.1 (commit 28badf7e by tatu.saloranta@iki.fi, June 2018) before TuxCare onboarded the version. Lines 67-69 of SubTypeValidator.java contain the defense that blocks deserialization of the two Oracle JDBC classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:58:31.761827+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is not present in jackson-databind 2.9.9.1-tuxcare.4. The fix (adding org.slf4j.ext.EventData to the deserialization blacklist) was already included in the upstream 2.9.9.1 release before TuxCare onboarded the project. The CVE affects versions before 2.9.7; the target is 2.9.9.1, which includes the upstream fix. The blacklist entry is present in SubTypeValidator.java:72 and is enforced by default on the deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is not present in jackson-databind 2.9.9.1-tuxcare.4. The fix (adding org.slf4j.ext.EventData to the deserialization blacklist) was already included in the upstream 2.9.9.1 release before TuxCare onboarded the project. The CVE affects versions before 2.9.7; the target is 2.9.9.1, which includes the upstream fix. The blacklist entry is present in SubTypeValidator.java:72 and is enforced by default on the deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:02:25.196465+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is not present in jackson-databind 2.9.9.1-tuxcare.4. The vulnerability concerns polymorphic deserialization of BlazeDS classes (specifically flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor) that could lead to arbitrary code execution. The upstream fix (commit 87d29af25e by Tatu Saloranta) was already present in the upstream release 2.9.9.1 that TuxCare onboarded. The dangerous BlazeDS class is blacklisted in SubTypeValidator.java and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 is not present in jackson-databind 2.9.9.1-tuxcare.4. The vulnerability concerns polymorphic deserialization of BlazeDS classes (specifically flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor) that could lead to arbitrary code execution. The upstream fix (commit 87d29af25e by Tatu Saloranta) was already present in the upstream release 2.9.9.1 that TuxCare onboarded. The dangerous BlazeDS class is blacklisted in SubTypeValidator.java and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:09:29.528523+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.9.1-tuxcare.4 is NOT vulnerable to CVE-2018-14720. The fix for this vulnerability (blocking dangerous classes including com.sun.deploy.security.ruleset.DRSHelper, org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization) was already present in the upstream release 2.9.9.1 that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java lines 71-75, added by upstream author Tatu Saloranta in commit 0899726ec34.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "The target jackson-databind 2.9.9.1-tuxcare.4 is NOT vulnerable to CVE-2018-14720. The fix for this vulnerability (blocking dangerous classes including com.sun.deploy.security.ruleset.DRSHelper, org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization) was already present in the upstream release 2.9.9.1 that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java lines 71-75, added by upstream author Tatu Saloranta in commit 0899726ec34.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:40:05.423100+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target version 2.9.9.1 is NOT vulnerable to CVE-2018-14721. The fix blocking polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl is present in SubTypeValidator.java:75. This fix originated from upstream commit 87d29af25e by Tatu Saloranta and shipped in the upstream release 2.9.9.1 that TuxCare onboarded. The CVE affects versions before 2.9.7, and the target is a later version with the upstream fix already integrated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "The target version 2.9.9.1 is NOT vulnerable to CVE-2018-14721. The fix blocking polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl is present in SubTypeValidator.java:75. This fix originated from upstream commit 87d29af25e by Tatu Saloranta and shipped in the upstream release 2.9.9.1 that TuxCare onboarded. The CVE affects versions before 2.9.7, and the target is a later version with the upstream fix already integrated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T12:52:53.936815+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.9.1-tuxcare.4 is NOT affected by CVE-2018-19360. The upstream fix that blocks org.apache.axis2.transport.jms.JMSOutTransportInfo and three other dangerous classes from polymorphic deserialization was already present in the upstream 2.9.9.1 release. The fix (commit 72cd4025a2) was authored by upstream maintainer Tatu Saloranta on November 19, 2018, and shipped in the version TuxCare onboarded. The target's SubTypeValidator.java contains all four blocklist entries from the security patch, and the validation mechanism is properly wired into the deserialization flow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "Target version 2.9.9.1-tuxcare.4 is NOT affected by CVE-2018-19360. The upstream fix that blocks org.apache.axis2.transport.jms.JMSOutTransportInfo and three other dangerous classes from polymorphic deserialization was already present in the upstream 2.9.9.1 release. The fix (commit 72cd4025a2) was authored by upstream maintainer Tatu Saloranta on November 19, 2018, and shipped in the version TuxCare onboarded. The target's SubTypeValidator.java contains all four blocklist entries from the security patch, and the validation mechanism is properly wired into the deserialization flow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:58:57.863833+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.9.1 is not vulnerable to CVE-2018-19361. The fix for this vulnerability (blocking openjpa classes from polymorphic deserialization) was already present in the upstream release 2.9.9.1 that TuxCare onboarded. The vulnerable classes org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime are in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 79-80), preventing their instantiation during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "Target version 2.9.9.1 is not vulnerable to CVE-2018-19361. The fix for this vulnerability (blocking openjpa classes from polymorphic deserialization) was already present in the upstream release 2.9.9.1 that TuxCare onboarded. The vulnerable classes org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime are in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 79-80), preventing their instantiation during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:26:39.614024+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.jboss.util.propertyeditor.DocumentEditor in polymorphic deserialization. The target version 2.9.9.1-tuxcare.4 already contains the upstream fix (commit 72cd4025a22 by Tatu Saloranta on 2018-11-19), which adds the required blocklist entry at SubTypeValidator.java:78. This fix was shipped in upstream release 2.9.9.1 before TuxCare's onboarding, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.jboss.util.propertyeditor.DocumentEditor in polymorphic deserialization. The target version 2.9.9.1-tuxcare.4 already contains the upstream fix (commit 72cd4025a22 by Tatu Saloranta on 2018-11-19), which adds the required blocklist entry at SubTypeValidator.java:78. This fix was shipped in upstream release 2.9.9.1 before TuxCare's onboarding, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3. The target version 2.9.9.1 contains the upstream fix (commit 038b471e2e) that adds org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory to the deserialization blacklist in SubTypeValidator.java. This fix shipped in the upstream release before TuxCare onboarded version 2.9.9.1, preventing the two gadget-based remote code execution vectors described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3. The target version 2.9.9.1 contains the upstream fix (commit 038b471e2e) that adds org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory to the deserialization blacklist in SubTypeValidator.java. This fix shipped in the upstream release before TuxCare onboarded version 2.9.9.1, preventing the two gadget-based remote code execution vectors described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:56:28.350475+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 affects jackson-databind versions before 2.9.5. The target version 2.9.9.1 already contains the upstream fix (commit 6799f8f10c by Tatu Saloranta) that blocks deserialization of c3p0 DataSource classes via pattern matching in SubTypeValidator.java. The vulnerable code pattern is not present because the fix was already included in the upstream 2.9.9.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 affects jackson-databind versions before 2.9.5. The target version 2.9.9.1 already contains the upstream fix (commit 6799f8f10c by Tatu Saloranta) that blocks deserialization of c3p0 DataSource classes via pattern matching in SubTypeValidator.java. The vulnerable code pattern is not present because the fix was already included in the upstream 2.9.9.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.9.1 already contains the upstream fix for CVE-2019-12086. The vulnerability affects jackson-databind versions before 2.9.9, and this target is version 2.9.9.1. The fix (blocking com.mysql.cj.jdbc.admin.MiniAdmin from polymorphic deserialization) is present in SubTypeValidator.java at line 84, added by upstream vendor FasterXML in commit dda513bd7 on May 14, 2019.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "Target version 2.9.9.1 already contains the upstream fix for CVE-2019-12086. The vulnerability affects jackson-databind versions before 2.9.9, and this target is version 2.9.9.1. The fix (blocking com.mysql.cj.jdbc.admin.MiniAdmin from polymorphic deserialization) is present in SubTypeValidator.java at line 84, added by upstream vendor FasterXML in commit dda513bd7 on May 14, 2019." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-01T18:40:56.913293+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.9.9.1-tuxcare.4. The vulnerability affects versions \"before 2.9.9.1\", and the fix was included in the upstream 2.9.9.1 release. The blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource is present at SubTypeValidator.java:87, preventing polymorphic deserialization of this dangerous class. The fix commit (c9ef4a10d6) was auth...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.9.9.1-tuxcare.4. The vulnerability affects versions \"before 2.9.9.1\", and the fix was included in the upstream 2.9.9.1 release. The blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource is present at SubTypeValidator.java:87, preventing polymorphic deserialization of this dangerous class. The fix commit (c9ef4a10d6) was auth..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 fixed upstream before 2.9.9.1: CVE-2019-12814 fix 5f7c69bba07a by tatu.saloranta@iki.fi (2019-06-13) is an ancestor of tuxcare-current/2.9.9.1 (inside upstream tag jackson-databind-2.9.9.1); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 fixed upstream before 2.9.9.1: CVE-2019-12814 fix 5f7c69bba07a by tatu.saloranta@iki.fi (2019-06-13) is an ancestor of tuxcare-current/2.9.9.1 (inside upstream tag jackson-databind-2.9.9.1); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:00.284610+00:00", "status_notes": "Vulnerability CVE-2019-14379 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4.", "vulnerability": { "name": "CVE-2019-14379" }, "action_statement": "Vulnerability CVE-2019-14379 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2019-14439 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14439" }, "action_statement": "Vulnerability CVE-2019-14439 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-10T11:04:00.115545+00:00", "status_notes": "Vulnerability CVE-2019-14540 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.7.", "vulnerability": { "name": "CVE-2019-14540" }, "action_statement": "Vulnerability CVE-2019-14540 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-05T10:19:51.255388+00:00", "status_notes": "Vulnerability CVE-2019-14892 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.5.", "vulnerability": { "name": "CVE-2019-14892" }, "action_statement": "Vulnerability CVE-2019-14892 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2019-14893 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14893" }, "action_statement": "Vulnerability CVE-2019-14893 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-09T12:56:53.416655+00:00", "status_notes": "Vulnerability CVE-2019-16335 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6.", "vulnerability": { "name": "CVE-2019-16335" }, "action_statement": "Vulnerability CVE-2019-16335 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-05T10:19:51.255388+00:00", "status_notes": "Vulnerability CVE-2019-16942 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.5.", "vulnerability": { "name": "CVE-2019-16942" }, "action_statement": "Vulnerability CVE-2019-16942 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2019-16943 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16943" }, "action_statement": "Vulnerability CVE-2019-16943 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-05T10:19:51.255388+00:00", "status_notes": "Vulnerability CVE-2019-17267 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.5.", "vulnerability": { "name": "CVE-2019-17267" }, "action_statement": "Vulnerability CVE-2019-17267 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2019-17531 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17531" }, "action_statement": "Vulnerability CVE-2019-17531 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-09T12:56:53.416655+00:00", "status_notes": "Vulnerability CVE-2019-20330 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6.", "vulnerability": { "name": "CVE-2019-20330" }, "action_statement": "Vulnerability CVE-2019-20330 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-05T10:19:51.255388+00:00", "status_notes": "Vulnerability CVE-2020-10650 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.5.", "vulnerability": { "name": "CVE-2020-10650" }, "action_statement": "Vulnerability CVE-2020-10650 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-10T11:04:00.115545+00:00", "status_notes": "Vulnerability CVE-2020-10672 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.7.", "vulnerability": { "name": "CVE-2020-10672" }, "action_statement": "Vulnerability CVE-2020-10672 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-09T12:56:00.072378+00:00", "status_notes": "Vulnerability CVE-2020-10673 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6.", "vulnerability": { "name": "CVE-2020-10673" }, "action_statement": "Vulnerability CVE-2020-10673 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-09T12:56:00.072378+00:00", "status_notes": "Vulnerability CVE-2020-10969 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6.", "vulnerability": { "name": "CVE-2020-10969" }, "action_statement": "Vulnerability CVE-2020-10969 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-09T12:56:27.637927+00:00", "status_notes": "Vulnerability CVE-2020-11111 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11111" }, "action_statement": "Vulnerability CVE-2020-11111 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-09T12:56:27.637927+00:00", "status_notes": "Vulnerability CVE-2020-11112 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11112" }, "action_statement": "Vulnerability CVE-2020-11112 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-09T12:56:53.416655+00:00", "status_notes": "Vulnerability CVE-2020-11113 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11113" }, "action_statement": "Vulnerability CVE-2020-11113 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-09T12:56:27.637927+00:00", "status_notes": "Vulnerability CVE-2020-11619 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11619" }, "action_statement": "Vulnerability CVE-2020-11619 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-10T11:04:00.115545+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.7.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.7." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2020-14061 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.3.", "vulnerability": { "name": "CVE-2020-14061" }, "action_statement": "Vulnerability CVE-2020-14061 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:00.284610+00:00", "status_notes": "Vulnerability CVE-2020-14062 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4.", "vulnerability": { "name": "CVE-2020-14062" }, "action_statement": "Vulnerability CVE-2020-14062 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-10T11:04:00.115545+00:00", "status_notes": "Vulnerability CVE-2020-14195 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.7.", "vulnerability": { "name": "CVE-2020-14195" }, "action_statement": "Vulnerability CVE-2020-14195 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2020-24616 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.3.", "vulnerability": { "name": "CVE-2020-24616" }, "action_statement": "Vulnerability CVE-2020-24616 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:00.284610+00:00", "status_notes": "Vulnerability CVE-2020-24750 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4.", "vulnerability": { "name": "CVE-2020-24750" }, "action_statement": "Vulnerability CVE-2020-24750 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:00.284610+00:00", "status_notes": "Vulnerability CVE-2020-35728 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4.", "vulnerability": { "name": "CVE-2020-35728" }, "action_statement": "Vulnerability CVE-2020-35728 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-09T12:56:27.637927+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:00.284610+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:00.284610+00:00", "status_notes": "Vulnerability CVE-2020-36183 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36183" }, "action_statement": "Vulnerability CVE-2020-36183 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:00.284610+00:00", "status_notes": "Vulnerability CVE-2020-36187 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36187" }, "action_statement": "Vulnerability CVE-2020-36187 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:00.284610+00:00", "status_notes": "Vulnerability CVE-2020-36189 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36189" }, "action_statement": "Vulnerability CVE-2020-36189 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-09T12:56:53.416655+00:00", "status_notes": "Vulnerability CVE-2020-8840 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6.", "vulnerability": { "name": "CVE-2020-8840" }, "action_statement": "Vulnerability CVE-2020-8840 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-9546 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9546" }, "action_statement": "Vulnerability CVE-2020-9546 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-09T12:56:27.637927+00:00", "status_notes": "Vulnerability CVE-2020-9547 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6.", "vulnerability": { "name": "CVE-2020-9547" }, "action_statement": "Vulnerability CVE-2020-9547 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:00.284610+00:00", "status_notes": "Vulnerability CVE-2021-20190 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4.", "vulnerability": { "name": "CVE-2021-20190" }, "action_statement": "Vulnerability CVE-2021-20190 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-06T18:52:00.040792+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2026-54512 describes a vulnerability in jackson-databind's PolymorphicTypeValidator (PTV) where generic type parameters bypass validation during type resolution. Version 2.9.9.1 is not affected because it predates PTV entirely\u2014PTV was introduced in 2.10.0. The 2.9.9.1 source tree contains no PolymorphicTypeValidator, no BasicPolymorphicTypeValidator and no DatabindContext._resolveAndValidateGeneric(); the jsontype package holds only SubTypeValidator, a fixed deny-list of known gadget class names applied in BeanDeserializerFactory.createBeanDeserializer(). The reported attack consists of smuggling a class past a caller-configured PTV allow-list as a generic type argument, and no such allow-list mechanism exists in this version for the type identifier to evade.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "CVE-2026-54512 describes a vulnerability in jackson-databind's PolymorphicTypeValidator (PTV) where generic type parameters bypass validation during type resolution. Version 2.9.9.1 is not affected because it predates PTV entirely\u2014PTV was introduced in 2.10.0. The 2.9.9.1 source tree contains no PolymorphicTypeValidator, no BasicPolymorphicTypeValidator and no DatabindContext._resolveAndValidateGeneric(); the jsontype package holds only SubTypeValidator, a fixed deny-list of known gadget class names applied in BeanDeserializerFactory.createBeanDeserializer(). The reported attack consists of smuggling a class past a caller-configured PTV allow-list as a generic type argument, and no such allow-list mechanism exists in this version for the type identifier to evade." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-09T12:56:53.416655+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T02:07:49.249153+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.9.1 does not support the vulnerable feature. CVE-2026-54518 concerns @JsonView bypass in unwrapped creator parameters (constructor/factory parameters annotated with both @JsonView and @JsonUnwrapped). This feature was explicitly unsupported in version 2.9.9.1, which actively rejects the combination with a JsonMappingException, and was only added 5 years later in 2024 via issue #1467...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Version 2.9.9.1 does not support the vulnerable feature. CVE-2026-54518 concerns @JsonView bypass in unwrapped creator parameters (constructor/factory parameters annotated with both @JsonView and @JsonUnwrapped). This feature was explicitly unsupported in version 2.9.9.1, which actively rejects the combination with a JsonMappingException, and was only added 5 years later in 2024 via issue #1467..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-03T01:42:00.098539+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.9.1-tuxcare.4 predates the affected version range (>= 2.15.0) and lacks Java Record support entirely. CVE-2026-59888 specifically affects Java Record deserialization when combined with PropertyNamingStrategy - the @JsonIgnore bypass occurs because Records preserve ignored properties into the renaming phase. Non-Record POJOs are immune because ignored properties are removed before _r...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 Version 2.9.9.1-tuxcare.4 predates the affected version range (>= 2.15.0) and lacks Java Record support entirely. CVE-2026-59888 specifically affects Java Record deserialization when combined with PropertyNamingStrategy - the @JsonIgnore bypass occurs because Records preserve ignored properties into the renaming phase. Non-Record POJOs are immune because ignored properties are removed before _r..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.3.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-11-05T10:19:51.255388+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.5.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.1-tuxcare.5." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.9.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:31:41.509579+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.9.1-tuxcare.2.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }