{ "@id": "urn:uuid:108a4b92-f05d-4379-8b9c-4b7049236c5b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 32, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T18:21:05.400347+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T13:06:45.482707+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 fix was already present in upstream jackson-databind 2.9.9.3. The target repository contains the complete blacklist mechanism in SubTypeValidator.java that prevents deserialization of dangerous classes including java.util.logging.FileHandler and java.rmi.server.UnicastRemoteObject (issue #1737). The fix was authored by upstream vendor Tatu Saloranta in commit ddfddfba6414adbecaff99684ef66eebd3a92e92 (Aug 17, 2017) and was part of the upstream release before TuxCare's onboarding commit c321948e2a (Sep 10, 2026).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 fix was already present in upstream jackson-databind 2.9.9.3. The target repository contains the complete blacklist mechanism in SubTypeValidator.java that prevents deserialization of dangerous classes including java.util.logging.FileHandler and java.rmi.server.UnicastRemoteObject (issue #1737). The fix was authored by upstream vendor Tatu Saloranta in commit ddfddfba6414adbecaff99684ef66eebd3a92e92 (Aug 17, 2017) and was part of the upstream release before TuxCare's onboarding commit c321948e2a (Sep 10, 2026).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:41:47.392844+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.9.3-tuxcare.2 is NOT vulnerable to CVE-2017-17485. The vulnerability required blacklisting additional dangerous classes (Spring, JDK, C3P0, Tomcat types) to prevent polymorphic deserialization RCE attacks. All upstream fixes (issues #1737 and #1855) were already present in the 2.9.9.3 release that TuxCare onboarded. The SubTypeValidator class exists with comprehensive blacklists including all CVE-specific classes plus extensive additions from later security patches. The validator is properly integrated into BeanDeserializerFactory and cannot be bypassed or disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "The target jackson-databind 2.9.9.3-tuxcare.2 is NOT vulnerable to CVE-2017-17485. The vulnerability required blacklisting additional dangerous classes (Spring, JDK, C3P0, Tomcat types) to prevent polymorphic deserialization RCE attacks. All upstream fixes (issues #1737 and #1855) were already present in the 2.9.9.3 release that TuxCare onboarded. The SubTypeValidator class exists with comprehensive blacklists including all CVE-specific classes plus extensive additions from later security patches. The validator is properly integrated into BeanDeserializerFactory and cannot be bypassed or disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:25:36.969179+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is not present in jackson-databind 2.9.9.3-tuxcare.2. The vulnerability was fixed in upstream Jackson 2.8.9 via commit 60d459cedc, which introduced SubTypeValidator with a blocklist of dangerous gadget classes. This fix was included in the upstream 2.9.9.3 release that TuxCare onboarded. The target contains the complete defense: SubTypeValidator with DEFAULT_NO_DESER_CLASS_NAMES blocklist (including TemplatesImpl and other gadget classes), invoked via _validateSubType() during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 is not present in jackson-databind 2.9.9.3-tuxcare.2. The vulnerability was fixed in upstream Jackson 2.8.9 via commit 60d459cedc, which introduced SubTypeValidator with a blocklist of dangerous gadget classes. This fix was included in the upstream 2.9.9.3 release that TuxCare onboarded. The target contains the complete defense: SubTypeValidator with DEFAULT_NO_DESER_CLASS_NAMES blocklist (including TemplatesImpl and other gadget classes), invoked via _validateSubType() during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T13:15:34.961054+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind version 2.9.9.3-tuxcare.2. The vulnerability involves Jackson default typing with the iBatis XPathParser gadget class allowing data exfiltration. The fix (blacklisting \"org.apache.ibatis.parsing.XPathParser\" in SubTypeValidator.java) is present in the target at line 62. This fix was authored by upstream (Tatu Saloranta, tatu.saloranta@iki.fi) via commit 27b4defc270454dea6842bd9279f17387eceb737 and was already included in the upstream release 2.9.9.3 when TuxCare onboarded it via commit c321948e2a. The vulnerable pattern is not present because the upstream vendor fixed it before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind version 2.9.9.3-tuxcare.2. The vulnerability involves Jackson default typing with the iBatis XPathParser gadget class allowing data exfiltration. The fix (blacklisting \"org.apache.ibatis.parsing.XPathParser\" in SubTypeValidator.java) is present in the target at line 62. This fix was authored by upstream (Tatu Saloranta, tatu.saloranta@iki.fi) via commit 27b4defc270454dea6842bd9279f17387eceb737 and was already included in the upstream release 2.9.9.3 when TuxCare onboarded it via commit c321948e2a. The vulnerable pattern is not present because the upstream vendor fixed it before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T17:16:29.149062+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is NOT present in jackson-databind 2.9.9.3. The upstream vendor (FasterXML) fixed this vulnerability in version 2.9.6 by adding jodd.db.connection.DataSourceConnectionProvider to the SubTypeValidator blacklist. The target version 2.9.9.3 is newer than 2.9.6 and already contains the upstream fix. The vulnerable code pattern (allowing polymorphic deserialization of the Jodd-db gadget class) is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 is NOT present in jackson-databind 2.9.9.3. The upstream vendor (FasterXML) fixed this vulnerability in version 2.9.6 by adding jodd.db.connection.DataSourceConnectionProvider to the SubTypeValidator blacklist. The target version 2.9.9.3 is newer than 2.9.6 and already contains the upstream fix. The vulnerable code pattern (allowing polymorphic deserialization of the Jodd-db gadget class) is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T16:18:43.675482+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.9.9.3 is not affected by CVE-2018-12023. The vulnerability (missing blocklist for Oracle JDBC gadget classes that enable JNDI/LDAP deserialization attacks) was fixed in upstream release 2.9.9.3 before TuxCare onboarded it. The SubTypeValidator contains the required blocklist entries at lines 68-69 that prevent deserialization of oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet, blocking the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "The target jackson-databind version 2.9.9.3 is not affected by CVE-2018-12023. The vulnerability (missing blocklist for Oracle JDBC gadget classes that enable JNDI/LDAP deserialization attacks) was fixed in upstream release 2.9.9.3 before TuxCare onboarded it. The SubTypeValidator contains the required blocklist entries at lines 68-69 that prevent deserialization of oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet, blocking the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T13:44:47.079180+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 affects jackson-databind versions before 2.9.7 due to missing blocklist entries for dangerous classes (org.slf4j.ext.EventData and others) that enable arbitrary code execution via polymorphic deserialization. The target version 2.9.9.3-tuxcare.2 is NOT vulnerable because it ships with the upstream fix (commit 87d29af25e by Tatu Saloranta) that adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 71-75). This fix was already present in upstream version 2.9.9.3 before TuxCare onboarded it, so the vulnerable code pattern never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 affects jackson-databind versions before 2.9.7 due to missing blocklist entries for dangerous classes (org.slf4j.ext.EventData and others) that enable arbitrary code execution via polymorphic deserialization. The target version 2.9.9.3-tuxcare.2 is NOT vulnerable because it ships with the upstream fix (commit 87d29af25e by Tatu Saloranta) that adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 71-75). This fix was already present in upstream version 2.9.9.3 before TuxCare onboarded it, so the vulnerable code pattern never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:58:22.317135+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is NOT present in the target. The fix for jackson-databind issue #2097 (blocking dangerous classes from polymorphic deserialization including flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, org.slf4j.ext.EventData, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was already included in the upstream release 2.9.9.3 that TuxCare onboarded. The blacklist entries are present in SubTypeValidator.java:72-75 (refactored from BeanDeserializerFactory in earlier versions). The fix commit 87d29af25e by upstream author tatu.saloranta@iki.fi is an ancestor of HEAD and predates the first TuxCare commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 is NOT present in the target. The fix for jackson-databind issue #2097 (blocking dangerous classes from polymorphic deserialization including flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, org.slf4j.ext.EventData, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was already included in the upstream release 2.9.9.3 that TuxCare onboarded. The blacklist entries are present in SubTypeValidator.java:72-75 (refactored from BeanDeserializerFactory in earlier versions). The fix commit 87d29af25e by upstream author tatu.saloranta@iki.fi is an ancestor of HEAD and predates the first TuxCare commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:06:14.080942+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.9.3 is NOT affected by CVE-2018-14720. The upstream vendor fix (commit 87d29af25e) that blacklists the four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was already present in the upstream release 2.9.9.3 that TuxCare onboarded. The vulnerable code pattern (ability to polymorphically deserialize these classes) is not present because the blacklist validation is active in SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "Target version 2.9.9.3 is NOT affected by CVE-2018-14720. The upstream vendor fix (commit 87d29af25e) that blacklists the four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was already present in the upstream release 2.9.9.3 that TuxCare onboarded. The vulnerable code pattern (ability to polymorphically deserialize these classes) is not present because the blacklist validation is active in SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T14:33:43.598820+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is not present in jackson-databind 2.9.9.3-tuxcare.2. The vulnerability requires the absence of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from the polymorphic deserialization blacklist. The target repository contains this class in the blacklist (SubTypeValidator.java:75), preventing SSRF attacks via this gadget. The fix was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e and shipped in the upstream 2.9.9.3 release that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 is not present in jackson-databind 2.9.9.3-tuxcare.2. The vulnerability requires the absence of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from the polymorphic deserialization blacklist. The target repository contains this class in the blacklist (SubTypeValidator.java:75), preventing SSRF attacks via this gadget. The fix was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e and shipped in the upstream 2.9.9.3 release that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T12:42:09.520685+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind 2.x before 2.9.8. Target version 2.9.9.3-tuxcare.2 is not affected because the upstream vendor fix (commit 72cd4025a2, Fix #2186) was already present in the 2.9.9.3 release that TuxCare onboarded. The vulnerable class org.apache.axis2.transport.jms.JMSOutTransportInfo is blocked in SubTypeValidator.java line 81, preventing polymorphic deserialization. This is an upstream fix authored by tatu.saloranta@iki.fi that shipped before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 affects jackson-databind 2.x before 2.9.8. Target version 2.9.9.3-tuxcare.2 is not affected because the upstream vendor fix (commit 72cd4025a2, Fix #2186) was already present in the 2.9.9.3 release that TuxCare onboarded. The vulnerable class org.apache.axis2.transport.jms.JMSOutTransportInfo is blocked in SubTypeValidator.java line 81, preventing polymorphic deserialization. This is an upstream fix authored by tatu.saloranta@iki.fi that shipped before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T16:54:53.626272+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.9.3 is NOT AFFECTED by CVE-2018-19361. The vulnerability was fixed in upstream jackson-databind 2.9.8 (released Nov 2018) by adding openjpa class names to the polymorphic deserialization blocklist. The fix (commit 72cd4025a229fb28ec133235003dd4616f70afaa by upstream author Tatu Saloranta) was already present in the upstream 2.9.9.3 release that TuxCare onboarded. The blocklist entries for org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime are present in SubTypeValidator.java lines 79-80, and validation is enforced in the core deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "Target version 2.9.9.3 is NOT AFFECTED by CVE-2018-19361. The vulnerability was fixed in upstream jackson-databind 2.9.8 (released Nov 2018) by adding openjpa class names to the polymorphic deserialization blocklist. The fix (commit 72cd4025a229fb28ec133235003dd4616f70afaa by upstream author Tatu Saloranta) was already present in the upstream 2.9.9.3 release that TuxCare onboarded. The blocklist entries for org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime are present in SubTypeValidator.java lines 79-80, and validation is enforced in the core deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T15:24:04.222754+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.9.3) is not affected by CVE-2018-19362. The vulnerability concerns polymorphic deserialization of the jboss-common-core class \"org.jboss.util.propertyeditor.DocumentEditor\" leading to potential remote code execution. The fix, which adds this class to the blacklist in SubTypeValidator.java, was already present in the upstream 2.9.9.3 release. CVE-2018-19362 affects versions \"before 2.9.8\" and the target version 2.9.9.3 is greater than 2.9.8. The fix was authored by upstream developer Tatu Saloranta in commit 72cd4025a229fb28ec133235003dd4616f70afaa, which is an ancestor of the TuxCare onboarding commit (c321948e2a59e29327613e07509694d93c2fc12b). Therefore, the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "The target repository (jackson-databind 2.9.9.3) is not affected by CVE-2018-19362. The vulnerability concerns polymorphic deserialization of the jboss-common-core class \"org.jboss.util.propertyeditor.DocumentEditor\" leading to potential remote code execution. The fix, which adds this class to the blacklist in SubTypeValidator.java, was already present in the upstream 2.9.9.3 release. CVE-2018-19362 affects versions \"before 2.9.8\" and the target version 2.9.9.3 is greater than 2.9.8. The fix was authored by upstream developer Tatu Saloranta in commit 72cd4025a229fb28ec133235003dd4616f70afaa, which is an ancestor of the TuxCare onboarding commit (c321948e2a59e29327613e07509694d93c2fc12b). Therefore, the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in target version 2.9.9.3-tuxcare.4. The fix (blacklisting org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) is present in SubTypeValidator.java lines 59-60. This fix was introduced by upstream author Tatu Saloranta in commit 038b471e2e and shipped in upstream version 2.9.9.3, which TuxCare later onboarded via commit c321948e2a. The vulnerable pattern is not present because the fix was already in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is NOT present in target version 2.9.9.3-tuxcare.4. The fix (blacklisting org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) is present in SubTypeValidator.java lines 59-60. This fix was introduced by upstream author Tatu Saloranta in commit 038b471e2e and shipped in upstream version 2.9.9.3, which TuxCare later onboarded via commit c321948e2a. The vulnerable pattern is not present because the fix was already in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T13:38:39.136681+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.9.9.3-tuxcare.2. The vulnerability allowed RCE via deserialization of c3p0 gadget classes (ComboPooledDataSource, etc.) when default typing was enabled. The upstream vendor fix (commit 6799f8f10c by Tatu Saloranta) was already included in the upstream release 2.9.9.3, which TuxCare later onboarded. The fix adds validation in SubTypeValidator.java (lines 203-212) that blocks any class matching the pattern com.mchange.v2.c3p0.*DataSource from being deserialized. This defense is reachable on the execution path from ObjectMapper.readValue through BeanDeserializerFactory._validateSubType, effectively preventing the attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.9.9.3-tuxcare.2. The vulnerability allowed RCE via deserialization of c3p0 gadget classes (ComboPooledDataSource, etc.) when default typing was enabled. The upstream vendor fix (commit 6799f8f10c by Tatu Saloranta) was already included in the upstream release 2.9.9.3, which TuxCare later onboarded. The fix adds validation in SubTypeValidator.java (lines 203-212) that blocks any class matching the pattern com.mchange.v2.c3p0.*DataSource from being deserialized. This defense is reachable on the execution path from ObjectMapper.readValue through BeanDeserializerFactory._validateSubType, effectively preventing the attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 fixed upstream before 2.9.9.3: CVE-2019-12086 fix dda513bd7251 by tatu.saloranta@iki.fi (2019-05-14) is an ancestor of tuxcare-current/2.9.9.3 (inside upstream tag jackson-databind-2.9.9.3); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "not_affected \u2014 fixed upstream before 2.9.9.3: CVE-2019-12086 fix dda513bd7251 by tatu.saloranta@iki.fi (2019-05-14) is an ancestor of tuxcare-current/2.9.9.3 (inside upstream tag jackson-databind-2.9.9.3); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is not present in jackson-databind 2.9.9.3. The vulnerability affects versions before 2.9.9.1, and the upstream fix (blocking ch.qos.logback.core.db.DriverManagerConnectionSource from polymorphic deserialization) was included in version 2.9.9.1 via commit c9ef4a10d6. This fix was already present in the upstream release 2.9.9.3 that TuxCare onboarded, so the target version has nev...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 is not present in jackson-databind 2.9.9.3. The vulnerability affects versions before 2.9.9.1, and the upstream fix (blocking ch.qos.logback.core.db.DriverManagerConnectionSource from polymorphic deserialization) was included in version 2.9.9.1 via commit c9ef4a10d6. This fix was already present in the upstream release 2.9.9.3 that TuxCare onboarded, so the target version has nev..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.9.9.3 is not affected by CVE-2019-12814. The fix for this vulnerability (blocking org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer from polymorphic deserialization) was introduced in upstream jackson-databind version 2.9.9.1 and is present in the 2.9.9.3 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 Target version 2.9.9.3 is not affected by CVE-2019-12814. The fix for this vulnerability (blocking org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer from polymorphic deserialization) was introduced in upstream jackson-databind version 2.9.9.1 and is present in the 2.9.9.3 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T12:04:03.421384+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 affects jackson-databind versions before 2.9.9.2. The target repository is version 2.9.9.3-tuxcare.1, which already contains the upstream fix. The fix (commit ad418eeb97) adds blacklist entries for net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource to SubTypeValidator.java, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.9.9.3 release before TuxCare onboarded it. The vulnerable pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 affects jackson-databind versions before 2.9.9.2. The target repository is version 2.9.9.3-tuxcare.1, which already contains the upstream fix. The fix (commit ad418eeb97) adds blacklist entries for net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource to SubTypeValidator.java, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.9.9.3 release before TuxCare onboarded it. The vulnerable pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T13:29:29.992370+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2. The target is version 2.9.9.3-tuxcare.2, which includes the upstream fix. The fix (commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b) adds blacklist entries for dangerous classes including ch.qos.logback.core.db.JNDIConnectionSource to SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.9.9.3 release that TuxCare onboarded. The vulnerable code pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2. The target is version 2.9.9.3-tuxcare.2, which includes the upstream fix. The fix (commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b) adds blacklist entries for dangerous classes including ch.qos.logback.core.db.JNDIConnectionSource to SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.9.9.3 release that TuxCare onboarded. The vulnerable code pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:45.125168+00:00", "status_notes": "Vulnerability CVE-2019-14540 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14540" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-05T10:27:31.337522+00:00", "status_notes": "Vulnerability CVE-2019-14892 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.5.", "vulnerability": { "name": "CVE-2019-14892" }, "action_statement": "Vulnerability CVE-2019-14892 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2019-14893 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14893" }, "action_statement": "Vulnerability CVE-2019-14893 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2019-16335 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16335" }, "action_statement": "Vulnerability CVE-2019-16335 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2019-16942 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16942" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2019-16943 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16943" }, "action_statement": "Vulnerability CVE-2019-16943 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T12:27:07.160372+00:00", "status_notes": "Vulnerability CVE-2019-17267 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.4.", "vulnerability": { "name": "CVE-2019-17267" }, "action_statement": "Vulnerability CVE-2019-17267 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-05T10:27:31.337522+00:00", "status_notes": "Vulnerability CVE-2019-17531 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.5.", "vulnerability": { "name": "CVE-2019-17531" }, "action_statement": "Vulnerability CVE-2019-17531 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:19.180547+00:00", "status_notes": "Vulnerability CVE-2019-20330 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2019-20330" }, "action_statement": "Vulnerability CVE-2019-20330 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-05T10:27:31.337522+00:00", "status_notes": "Vulnerability CVE-2020-10650 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-10650" }, "action_statement": "Vulnerability CVE-2020-10650 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:35.708133+00:00", "status_notes": "Vulnerability CVE-2020-10672 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-10672" }, "action_statement": "Vulnerability CVE-2020-10672 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:19.180547+00:00", "status_notes": "Vulnerability CVE-2020-10673 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-10673" }, "action_statement": "Vulnerability CVE-2020-10673 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:25.521573+00:00", "status_notes": "Vulnerability CVE-2020-10969 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-10969" }, "action_statement": "Vulnerability CVE-2020-10969 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:50.538721+00:00", "status_notes": "Vulnerability CVE-2020-11111 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11111" }, "action_statement": "Vulnerability CVE-2020-11111 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:42.626069+00:00", "status_notes": "Vulnerability CVE-2020-11112 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11112" }, "action_statement": "Vulnerability CVE-2020-11112 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:35.708133+00:00", "status_notes": "Vulnerability CVE-2020-11113 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11113" }, "action_statement": "Vulnerability CVE-2020-11113 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:57.948466+00:00", "status_notes": "Vulnerability CVE-2020-11619 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11619" }, "action_statement": "Vulnerability CVE-2020-11619 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:25.521573+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-05T10:27:31.337522+00:00", "status_notes": "Vulnerability CVE-2020-14061 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-14061" }, "action_statement": "Vulnerability CVE-2020-14061 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.5." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-14062 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:42.626069+00:00", "status_notes": "Vulnerability CVE-2020-14195 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-14195" }, "action_statement": "Vulnerability CVE-2020-14195 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:35.708133+00:00", "status_notes": "Vulnerability CVE-2020-24616 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-24616" }, "action_statement": "Vulnerability CVE-2020-24616 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:57.948466+00:00", "status_notes": "Vulnerability CVE-2020-8840 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-8840" }, "action_statement": "Vulnerability CVE-2020-8840 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:50.538721+00:00", "status_notes": "Vulnerability CVE-2020-9546 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-9546" }, "action_statement": "Vulnerability CVE-2020-9546 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:20:19.180547+00:00", "status_notes": "Vulnerability CVE-2020-9547 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-9547" }, "action_statement": "Vulnerability CVE-2020-9547 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2021-20190 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-06T18:52:00.040792+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.9.3 is not affected by CVE-2026-54512. The vulnerability requires PolymorphicTypeValidator (PTV), which was introduced in version 2.10.0 (commit 1135b2c1d, issue #2195). Version 2.9.9.3 predates PTV entirely and uses a different security model (SubTypeValidator deny-list) that does not exhibit the vulnerable pattern. The CVE explicitly states the affected range is \"from 2.10.0 until 2.18.8, 2.21.4, and 3.1.4\", confirming 2.9.9.3 is outside the vulnerable range.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.9.9.3 is not affected by CVE-2026-54512. The vulnerability requires PolymorphicTypeValidator (PTV), which was introduced in version 2.10.0 (commit 1135b2c1d, issue #2195). Version 2.9.9.3 predates PTV entirely and uses a different security model (SubTypeValidator deny-list) that does not exhibit the vulnerable pattern. The CVE explicitly states the affected range is \"from 2.10.0 until 2.18.8, 2.21.4, and 3.1.4\", confirming 2.9.9.3 is outside the vulnerable range." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-10T18:21:05.400347+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T01:58:00.203387+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.9.9.3 is not affected by CVE-2026-54518. The vulnerability concerns @JsonView bypass in unwrapped creator parameters, but this feature (@JsonUnwrapped with @JsonCreator) does not exist in version 2.9.9.3. The feature was added after version 2.14.2 (commit 502fe888da implementing issue #1467), and the vulnerable code path (processUnwrappedCreatorProperties method) is absent from...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Target version 2.9.9.3 is not affected by CVE-2026-54518. The vulnerability concerns @JsonView bypass in unwrapped creator parameters, but this feature (@JsonUnwrapped with @JsonCreator) does not exist in version 2.9.9.3. The feature was added after version 2.14.2 (commit 502fe888da implementing issue #1467), and the vulnerable code path (processUnwrappedCreatorProperties method) is absent from..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-03T01:33:00.141045+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Jackson-databind 2.9.9.3 is not affected by CVE-2026-59888. This vulnerability is specific to Java Records (introduced in Java 14+), which require special handling where @JsonIgnore-annotated Record components are tracked in _ignoredPropertyNames but not removed from the properties map. The target version targets Java 7 (confirmed in pom.xml javac.src.version=1.7) and has no Record support - ex...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 Jackson-databind 2.9.9.3 is not affected by CVE-2026-59888. This vulnerability is specific to Java Records (introduced in Java 14+), which require special handling where @JsonIgnore-annotated Record components are tracked in _ignoredPropertyNames but not removed from the properties map. The target version targets Java 7 (confirmed in pom.xml javac.src.version=1.7) and has no Record support - ex..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:58.185503+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-05T10:27:31.337522+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.5.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9.3-tuxcare.5." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.9.3-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.3-tuxcare.3" } } ], "timestamp": "2026-11-02T09:39:35.541552+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.9.3-tuxcare.3.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }