{ "@id": "urn:uuid:e3df3d9c-cf58-4c6a-8d3e-188c0ed7a194", "role": "Document Creator", "author": "https://tuxcare.com", "version": 7, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-09T14:00:15.730497+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind 2.11.4-tuxcare.3. The vulnerability required blacklisting additional dangerous classes to prevent polymorphic deserialization attacks. The target version contains a comprehensive blacklist in SubTypeValidator.java (lines 30-211) including all CVE-2017-15095 classes: JdbcRowSetImpl, FileHandler, UnicastRemoteObject, and Spring/C3P0 types. This fix was part of upstream jackson-databind releases prior to 2.11.4 and shipped with the base version that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 is not present in jackson-databind 2.11.4-tuxcare.3. The vulnerability required blacklisting additional dangerous classes to prevent polymorphic deserialization attacks. The target version contains a comprehensive blacklist in SubTypeValidator.java (lines 30-211) including all CVE-2017-15095 classes: JdbcRowSetImpl, FileHandler, UnicastRemoteObject, and Spring/C3P0 types. This fix was part of upstream jackson-databind releases prior to 2.11.4 and shipped with the base version that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 (incomplete fix for CVE-2017-7525 deserialization blacklist) is NOT present in jackson-databind 2.11.4-tuxcare.3. The comprehensive fix was already included in the upstream jackson-databind 2.11.4 release that TuxCare onboarded. The target contains SubTypeValidator.java with the complete blacklist for all gadget classes mentioned in the patches (#1737: FileHandler, UnicastRemoteObject, Spring classes, c3p0 classes; #1855: BasicDataSource, BCEL ClassLoader) plus sophisticated pattern-matching for Spring framework and c3p0 classes. This fix was authored by upstream (tatu.saloranta@iki.fi) and shipped in the upstream 2.11.4 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 (incomplete fix for CVE-2017-7525 deserialization blacklist) is NOT present in jackson-databind 2.11.4-tuxcare.3. The comprehensive fix was already included in the upstream jackson-databind 2.11.4 release that TuxCare onboarded. The target contains SubTypeValidator.java with the complete blacklist for all gadget classes mentioned in the patches (#1737: FileHandler, UnicastRemoteObject, Spring classes, c3p0 classes; #1855: BasicDataSource, BCEL ClassLoader) plus sophisticated pattern-matching for Spring framework and c3p0 classes. This fix was authored by upstream (tatu.saloranta@iki.fi) and shipped in the upstream 2.11.4 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.11.4-tuxcare.3 is not affected by CVE-2017-7525. The vulnerability, which allowed arbitrary code execution through deserialization of malicious gadget classes, was fixed in the upstream Jackson release. The target contains SubTypeValidator with a comprehensive blacklist of dangerous classes (including all CVE-2017-7525 gadgets: TemplatesImpl, InvokerTransformer, InstantiateTransformer, MethodClosure, ConvertedClosure, ObjectFactory), which is called during bean deserialization in BeanDeserializerFactory.createBeanDeserializer() at line 141. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.11.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "Target jackson-databind 2.11.4-tuxcare.3 is not affected by CVE-2017-7525. The vulnerability, which allowed arbitrary code execution through deserialization of malicious gadget classes, was fixed in the upstream Jackson release. The target contains SubTypeValidator with a comprehensive blacklist of dangerous classes (including all CVE-2017-7525 gadgets: TemplatesImpl, InvokerTransformer, InstantiateTransformer, MethodClosure, ConvertedClosure, ObjectFactory), which is called during bean deserialization in BeanDeserializerFactory.createBeanDeserializer() at line 141. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.11.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.11.4-tuxcare.3. The upstream fix that blacklists org.apache.ibatis.parsing.XPathParser from polymorphic deserialization was already included in the upstream 2.11.4 release that TuxCare onboarded. The fix (commit 27b4defc27) was authored by Tatu Saloranta and adds the dangerous class to DEFAULT_NO_DESER_CLASS_NAMES, preventing data exfiltration attacks via XML external entity processing during Jackson deserialization with default typing enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.11.4-tuxcare.3. The upstream fix that blacklists org.apache.ibatis.parsing.XPathParser from polymorphic deserialization was already included in the upstream 2.11.4 release that TuxCare onboarded. The fix (commit 27b4defc27) was authored by Tatu Saloranta and adds the dangerous class to DEFAULT_NO_DESER_CLASS_NAMES, preventing data exfiltration attacks via XML external entity processing during Jackson deserialization with default typing enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability allows remote code execution via polymorphic deserialization of Jodd-db gadget classes when Default Typing is enabled. The fix\u2014blacklisting jodd.db.connection.DataSourceConnectionProvider and related Oracle JDBC classes\u2014was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commits 28badf7ef6 and 7487cf7eb1. These commits were already present in upstream release 2.11.4 before TuxCare onboarded the version (onboarding commit 285cedb88). The dangerous class is confirmed present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist at SubTypeValidator.java:68, and the blacklist is actively enforced via SubTypeValidator.validateSubType() called from BeanDeserializerFactory:924.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability allows remote code execution via polymorphic deserialization of Jodd-db gadget classes when Default Typing is enabled. The fix\u2014blacklisting jodd.db.connection.DataSourceConnectionProvider and related Oracle JDBC classes\u2014was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commits 28badf7ef6 and 7487cf7eb1. These commits were already present in upstream release 2.11.4 before TuxCare onboarded the version (onboarding commit 285cedb88). The dangerous class is confirmed present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist at SubTypeValidator.java:68, and the blacklist is actively enforced via SubTypeValidator.validateSubType() called from BeanDeserializerFactory:924.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target repository is jackson-databind version 2.11.4-tuxcare.3, which is significantly newer than the affected versions. The vulnerability involves polymorphic deserialization of Oracle JDBC classes that can perform JNDI/LDAP injection attacks. The upstream fix (commit 28badf7ef6) added oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in the upstream release 2.11.4 before TuxCare onboarded the version. The target's SubTypeValidator.java contains these classes in the DEFAULT_NO_DESER_CLASS_NAMES blacklist at lines 70-72, and the validation mechanism is actively invoked during bean deserialization through BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target repository is jackson-databind version 2.11.4-tuxcare.3, which is significantly newer than the affected versions. The vulnerability involves polymorphic deserialization of Oracle JDBC classes that can perform JNDI/LDAP injection attacks. The upstream fix (commit 28badf7ef6) added oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in the upstream release 2.11.4 before TuxCare onboarded the version. The target's SubTypeValidator.java contains these classes in the DEFAULT_NO_DESER_CLASS_NAMES blacklist at lines 70-72, and the validation mechanism is actively invoked during bean deserialization through BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.4 is NOT AFFECTED by CVE-2018-14718. The vulnerability involves polymorphic deserialization of org.slf4j.ext.EventData that could lead to arbitrary code execution. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44) added org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist, which was already present in the upstream 2.11.4 release that TuxCare onboarded. The vulnerable code pattern (unblocked deserialization of slf4j-ext classes) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "The target jackson-databind 2.11.4 is NOT AFFECTED by CVE-2018-14718. The vulnerability involves polymorphic deserialization of org.slf4j.ext.EventData that could lead to arbitrary code execution. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44) added org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist, which was already present in the upstream 2.11.4 release that TuxCare onboarded. The vulnerable code pattern (unblocked deserialization of slf4j-ext classes) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.4 is NOT AFFECTED by CVE-2018-14719. The vulnerability involved unsafe polymorphic deserialization of blaze-ds classes (flex.messaging.*) allowing remote code execution. The upstream fix (commit 0899726ec34, authored by Tatu Saloranta on 2018-08-16) added four dangerous classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, including flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor. This fix was already present in the upstream 2.11.4 release when TuxCare onboarded it (first TuxCare commit 285cedb8 \"Onboard version 2.11.4\"). The blacklist is actively enforced during polymorphic deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "The target jackson-databind 2.11.4 is NOT AFFECTED by CVE-2018-14719. The vulnerability involved unsafe polymorphic deserialization of blaze-ds classes (flex.messaging.*) allowing remote code execution. The upstream fix (commit 0899726ec34, authored by Tatu Saloranta on 2018-08-16) added four dangerous classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, including flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor. This fix was already present in the upstream 2.11.4 release when TuxCare onboarded it (first TuxCare commit 285cedb8 \"Onboard version 2.11.4\"). The blacklist is actively enforced during polymorphic deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not present in jackson-databind 2.11.4. The vulnerability concerned the ability to conduct XXE attacks via polymorphic deserialization of four specific JDK and 3rd-party classes. The upstream vendor (Tatu Saloranta) added these four classes to the deserialization blocklist in commit 87d29af25e, which shipped in jackson-databind 2.9.7. Since the target version 2.11.4 is well after 2.9.7, this fix was already present in the upstream release that TuxCare onboarded. The blocklist is enforced by SubTypeValidator.validateSubType(), which is called during bean deserialization in BeanDeserializerFactory.createBeanDeserializer() before any deserializer is built.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 is not present in jackson-databind 2.11.4. The vulnerability concerned the ability to conduct XXE attacks via polymorphic deserialization of four specific JDK and 3rd-party classes. The upstream vendor (Tatu Saloranta) added these four classes to the deserialization blocklist in commit 87d29af25e, which shipped in jackson-databind 2.9.7. Since the target version 2.11.4 is well after 2.9.7, this fix was already present in the upstream release that TuxCare onboarded. The blocklist is enforced by SubTypeValidator.validateSubType(), which is called during bean deserialization in BeanDeserializerFactory.createBeanDeserializer() before any deserializer is built.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.11.4-tuxcare.3 is not affected by CVE-2018-14721. The fix\u2014adding org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the polymorphic deserialization blocklist\u2014was already present in the upstream jackson-databind 2.11.4 release that TuxCare onboarded. The blocklist entry exists in SubTypeValidator.java line 78 and is enforced unconditionally during bean deserialization via BeanDeserializerFactory._validateSubType (line 141), which throws a JsonMappingException when a blocked class is encountered. The vulnerable pattern (unrestricted polymorphic deserialization of the axis2-jaxws gadget class) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "The target repository jackson-databind 2.11.4-tuxcare.3 is not affected by CVE-2018-14721. The fix\u2014adding org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the polymorphic deserialization blocklist\u2014was already present in the upstream jackson-databind 2.11.4 release that TuxCare onboarded. The blocklist entry exists in SubTypeValidator.java line 78 and is enforced unconditionally during bean deserialization via BeanDeserializerFactory._validateSubType (line 141), which throws a JsonMappingException when a blocked class is encountered. The vulnerable pattern (unrestricted polymorphic deserialization of the axis2-jaxws gadget class) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.11.4-tuxcare.3) is NOT affected by CVE-2018-19360. The vulnerability requires the absence of a blocklist entry for `org.apache.axis2.transport.jms.JMSOutTransportInfo` in SubTypeValidator. This blocklist entry is present at SubTypeValidator.java:85 and is actively enforced during polymorphic deserialization via BeanDeserializerFactory. The fix was authored by Tatu Saloranta (upstream Jackson maintainer) in commit 72cd4025a2 and was already included in the upstream Jackson 2.11.4 release that TuxCare onboarded (commit 285cedb8). CVE-2018-19360 affects \"2.x before 2.9.8\"; version 2.11.4 is after 2.9.8 and contains the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "The target repository (jackson-databind 2.11.4-tuxcare.3) is NOT affected by CVE-2018-19360. The vulnerability requires the absence of a blocklist entry for `org.apache.axis2.transport.jms.JMSOutTransportInfo` in SubTypeValidator. This blocklist entry is present at SubTypeValidator.java:85 and is actively enforced during polymorphic deserialization via BeanDeserializerFactory. The fix was authored by Tatu Saloranta (upstream Jackson maintainer) in commit 72cd4025a2 and was already included in the upstream Jackson 2.11.4 release that TuxCare onboarded (commit 285cedb8). CVE-2018-19360 affects \"2.x before 2.9.8\"; version 2.11.4 is after 2.9.8 and contains the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability affects versions before 2.9.8 and exploits the absence of blacklist entries for Apache OpenJPA classes in polymorphic deserialization. The target version (2.11.4) already contains the upstream fix that adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix was authored by upstream maintainer Tatu Saloranta and was present in the upstream 2.11.4 release that TuxCare onboarded, making the vulnerable code pattern absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability affects versions before 2.9.8 and exploits the absence of blacklist entries for Apache OpenJPA classes in polymorphic deserialization. The target version (2.11.4) already contains the upstream fix that adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix was authored by upstream maintainer Tatu Saloranta and was present in the upstream 2.11.4 release that TuxCare onboarded, making the vulnerable code pattern absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.4-tuxcare.3 is not affected by CVE-2018-19362. The vulnerability requires the absence of specific class names (org.jboss.util.propertyeditor.DocumentEditor, org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime, org.apache.axis2.transport.jms.JMSOutTransportInfo) from the polymorphic deserialization blocklist. The upstream fix commit 72cd4025a229fb28ec133235003dd4616f70afaa (authored by Tatu Saloranta) added these classes to the blocklist and was already present in the upstream jackson-databind 2.11.4 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "The target jackson-databind 2.11.4-tuxcare.3 is not affected by CVE-2018-19362. The vulnerability requires the absence of specific class names (org.jboss.util.propertyeditor.DocumentEditor, org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime, org.apache.axis2.transport.jms.JMSOutTransportInfo) from the polymorphic deserialization blocklist. The upstream fix commit 72cd4025a229fb28ec133235003dd4616f70afaa (authored by Tatu Saloranta) added these classes to the blocklist and was already present in the upstream jackson-databind 2.11.4 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 exploits incomplete blacklist allowing deserialization of two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) leading to RCE. Target version 2.11.4-tuxcare.3 contains the upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 038b471e2e, which shipped in upstream release 2.8.11.1 and was included when TuxCare onboarded version 2.11.4. Both gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java:62-63), and the validation is enforced during bean deserialization via BeanDeserializerFactory._validateSubType(). The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 exploits incomplete blacklist allowing deserialization of two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) leading to RCE. Target version 2.11.4-tuxcare.3 contains the upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 038b471e2e, which shipped in upstream release 2.8.11.1 and was included when TuxCare onboarded version 2.11.4. Both gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java:62-63), and the validation is enforced during bean deserialization via BeanDeserializerFactory._validateSubType(). The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 targets Jackson's polymorphic deserialization, exploitable via c3p0 DataSource gadget classes when default typing is enabled. The fix (blocking all classes matching pattern `com.mchange.v2.c3p0.*DataSource`) was applied by upstream author Tatu Saloranta on 2018-02-10 (commit 6799f8f10c) and shipped in the upstream Jackson 2.11.4 release (2020-12-11). TuxCare onboarded version 2.11.4 in its already-fixed state on 2020-12-11 (commit 285cedb883). The vulnerable code pattern is not present in the target; the defense logic is active in SubTypeValidator.validateSubType() at lines 253-263.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 targets Jackson's polymorphic deserialization, exploitable via c3p0 DataSource gadget classes when default typing is enabled. The fix (blocking all classes matching pattern `com.mchange.v2.c3p0.*DataSource`) was applied by upstream author Tatu Saloranta on 2018-02-10 (commit 6799f8f10c) and shipped in the upstream Jackson 2.11.4 release (2020-12-11). TuxCare onboarded version 2.11.4 in its already-fixed state on 2020-12-11 (commit 285cedb883). The vulnerable code pattern is not present in the target; the defense logic is active in SubTypeValidator.validateSubType() at lines 253-263.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is not present in jackson-databind 2.11.4-tuxcare.3. The vulnerability requires the dangerous class com.mysql.cj.jdbc.admin.MiniAdmin to be absent from the deserialization blocklist. The target contains the fix at SubTypeValidator.java:88, which blocks this class from polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream Jackson 2.11.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 is not present in jackson-databind 2.11.4-tuxcare.3. The vulnerability requires the dangerous class com.mysql.cj.jdbc.admin.MiniAdmin to be absent from the deserialization blocklist. The target contains the fix at SubTypeValidator.java:88, which blocks this class from polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream Jackson 2.11.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is not present in jackson-databind 2.11.4. The vulnerability involves polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource. The upstream fix (commit c9ef4a10d6f by Tatu Saloranta) that blocks this class was already included in the upstream release before TuxCare onboarded version 2.11.4. The fix is present at SubTypeValidator....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 is not present in jackson-databind 2.11.4. The vulnerability involves polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource. The upstream fix (commit c9ef4a10d6f by Tatu Saloranta) that blocks this class was already included in the upstream release before TuxCare onboarded version 2.11.4. The fix is present at SubTypeValidator...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9. The target version 2.11.4-tuxcare.3 already contains the upstream fix (commit 5f7c69bba0 by Tatu Saloranta) that blocks deserialization of org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer classes. This fix was present in the upstream 2.11.4 release before TuxCare onboarding (commit 285cedb88349). The vulnerable p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9. The target version 2.11.4-tuxcare.3 already contains the upstream fix (commit 5f7c69bba0 by Tatu Saloranta) that blocks deserialization of org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer classes. This fix was present in the upstream 2.11.4 release before TuxCare onboarding (commit 285cedb88349). The vulnerable p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 affects jackson-databind versions before 2.9.9.2, 2.8.11.4, and 2.7.9.6 due to missing blacklist entries for dangerous classes that enable RCE via unsafe deserialization. The target version 2.11.4-tuxcare.3 already contains the upstream fix (commit ad418eeb97) that adds net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource to the SubTypeValidator blacklist. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the 2.11.4 release that TuxCare onboarded, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 affects jackson-databind versions before 2.9.9.2, 2.8.11.4, and 2.7.9.6 due to missing blacklist entries for dangerous classes that enable RCE via unsafe deserialization. The target version 2.11.4-tuxcare.3 already contains the upstream fix (commit ad418eeb97) that adds net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource to the SubTypeValidator blacklist. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the 2.11.4 release that TuxCare onboarded, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.11.4-tuxcare.3 is NOT affected by CVE-2019-14439. The dangerous logback class `ch.qos.logback.core.db.JNDIConnectionSource` is already blacklisted in SubTypeValidator.java (lines 101-102), preventing polymorphic deserialization attacks. This fix was included in upstream release 2.11.4 via commit ad418eeb97 by upstream maintainer Tatu Saloranta, before TuxCare onboarded the version. The vulnerable pattern (absence of blacklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "Target jackson-databind 2.11.4-tuxcare.3 is NOT affected by CVE-2019-14439. The dangerous logback class `ch.qos.logback.core.db.JNDIConnectionSource` is already blacklisted in SubTypeValidator.java (lines 101-102), preventing polymorphic deserialization attacks. This fix was included in upstream release 2.11.4 via commit ad418eeb97 by upstream maintainer Tatu Saloranta, before TuxCare onboarded the version. The vulnerable pattern (absence of blacklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is NOT present in jackson-databind 2.11.4. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig/HikariDataSource classes as gadgets for code execution. The upstream fix (commits d4983c740f and 73c1c2cc76 from Aug-Sep 2019) added these classes to the SubTypeValidator blocklist, preventing their deserialization. These fixes were already present in the upstream 2.11.4 release when TuxCare onboarded it in September 2026, as confirmed by the fix commits being ancestors of the first TuxCare commit (285cedb88349). The vulnerable code pattern is absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 is NOT present in jackson-databind 2.11.4. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig/HikariDataSource classes as gadgets for code execution. The upstream fix (commits d4983c740f and 73c1c2cc76 from Aug-Sep 2019) added these classes to the SubTypeValidator blocklist, preventing their deserialization. These fixes were already present in the upstream 2.11.4 release when TuxCare onboarded it in September 2026, as confirmed by the fix commits being ancestors of the first TuxCare commit (285cedb88349). The vulnerable code pattern is absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability (polymorphic deserialization of malicious commons-configuration JNDI classes leading to arbitrary code execution) was fixed in the upstream jackson-databind release by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blocklist. This fix was already present in the upstream 2.11.4 release when TuxCare onboarded it, so no backport was necessary.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability (polymorphic deserialization of malicious commons-configuration JNDI classes leading to arbitrary code execution) was fixed in the upstream jackson-databind release by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blocklist. This fix was already present in the upstream 2.11.4 release when TuxCare onboarded it, so no backport was necessary.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.11.4-tuxcare.3 is NOT AFFECTED by CVE-2019-14893. The vulnerability, which allows polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution, has been fixed by the upstream vendor. The fix commit 998efd7082 \"Fix #2469\" added the malicious class to the deserialization blacklist in SubTypeValidator.java (line 117). This fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.11.4, which TuxCare subsequently onboarded. The blacklist check is properly integrated into the deserialization flow via BeanDeserializerFactory._validateSubType(), blocking instantiation of the dangerous class before it can be exploited.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "The target repository jackson-databind version 2.11.4-tuxcare.3 is NOT AFFECTED by CVE-2019-14893. The vulnerability, which allows polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution, has been fixed by the upstream vendor. The fix commit 998efd7082 \"Fix #2469\" added the malicious class to the deserialization blacklist in SubTypeValidator.java (line 117). This fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.11.4, which TuxCare subsequently onboarded. The blacklist check is properly integrated into the deserialization flow via BeanDeserializerFactory._validateSubType(), blocking instantiation of the dangerous class before it can be exploited.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.11.4 is NOT AFFECTED by CVE-2019-16335. The upstream fix (commit 73c1c2cc76) that blocks com.zaxxer.hikari.HikariDataSource from polymorphic deserialization was already present in the upstream release 2.9.10 (September 2019), which predates the target version. The fix is present at line 107 of SubTypeValidator.java and is enforced in the deserialization flow via BeanDeserializerFactory._validateSubType(). Author: Tatu Saloranta (upstream maintainer), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "Target jackson-databind version 2.11.4 is NOT AFFECTED by CVE-2019-16335. The upstream fix (commit 73c1c2cc76) that blocks com.zaxxer.hikari.HikariDataSource from polymorphic deserialization was already present in the upstream release 2.9.10 (September 2019), which predates the target version. The fix is present at line 107 of SubTypeValidator.java and is enforced in the deserialization flow via BeanDeserializerFactory._validateSubType(). Author: Tatu Saloranta (upstream maintainer), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.11.4-tuxcare.3 is not affected by CVE-2019-16942. The fix (blacklisting org.apache.commons.dbcp.datasources.PerUserPoolDataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource) was already present in the upstream jackson-databind 2.11.4 release that TuxCare onboarded. The vulnerable pattern (missing blacklist entries) does not exist in the target. The blacklist entries are present at SubTypeValidator.java lines 122-124 and actively prevent polymorphic deserialization of these gadget classes when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "Target jackson-databind 2.11.4-tuxcare.3 is not affected by CVE-2019-16942. The fix (blacklisting org.apache.commons.dbcp.datasources.PerUserPoolDataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource) was already present in the upstream jackson-databind 2.11.4 release that TuxCare onboarded. The vulnerable pattern (missing blacklist entries) does not exist in the target. The blacklist entries are present at SubTypeValidator.java lines 122-124 and actively prevent polymorphic deserialization of these gadget classes when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.4-tuxcare.3 is NOT AFFECTED by CVE-2019-16943. The upstream FasterXML vendor already fixed this polymorphic typing vulnerability in version 2.11.4 by adding com.p6spy.engine.spy.P6DataSource and commons-dbcp datasource classes to the SubTypeValidator blocklist (commits 9593e16 and 328a0f8, authored by tatu.saloranta@iki.fi). TuxCare subsequently onboarded this already-fixed upstream version via commit 285cedb. The vulnerable pattern (missing blocklist entries for p6spy and commons-dbcp gadget classes) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "The target jackson-databind 2.11.4-tuxcare.3 is NOT AFFECTED by CVE-2019-16943. The upstream FasterXML vendor already fixed this polymorphic typing vulnerability in version 2.11.4 by adding com.p6spy.engine.spy.P6DataSource and commons-dbcp datasource classes to the SubTypeValidator blocklist (commits 9593e16 and 328a0f8, authored by tatu.saloranta@iki.fi). TuxCare subsequently onboarded this already-fixed upstream version via commit 285cedb. The vulnerable pattern (missing blocklist entries for p6spy and commons-dbcp gadget classes) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to a polymorphic typing deserialization vulnerability involving net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.11.4-tuxcare.3) is not affected because the upstream fix was already present in version 2.11.4 when TuxCare onboarded it. The fix (commit 191a4cdf87 by upstream author Tatu Saloranta) adds the vulnerable class to SubTypeValidator's blocklist at line 99, preventing its deserialization. This upstream fix shipped in versions 2.8.11.5 and 2.9.10, well before version 2.11.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to a polymorphic typing deserialization vulnerability involving net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.11.4-tuxcare.3) is not affected because the upstream fix was already present in version 2.11.4 when TuxCare onboarded it. The fix (commit 191a4cdf87 by upstream author Tatu Saloranta) adds the vulnerable class to SubTypeValidator's blocklist at line 99, preventing its deserialization. This upstream fix shipped in versions 2.8.11.5 and 2.9.10, well before version 2.11.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is not present in jackson-databind 2.11.4-tuxcare.3. The fix that blocks deserialization of the two dangerous log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) was already included in the upstream release 2.11.4 that TuxCare onboarded. The vulnerable pattern (ability to deserialize these classes to achieve arbitrary code execution) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is not present in jackson-databind 2.11.4-tuxcare.3. The fix that blocks deserialization of the two dangerous log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) was already included in the upstream release 2.11.4 that TuxCare onboarded. The vulnerable pattern (ability to deserialize these classes to achieve arbitrary code execution) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.11.4-tuxcare.3. The target already contains the upstream fix that blocks deserialization of the two vulnerable ehcache JNDI selector classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector). This fix was authored by Tatu Saloranta in upstream commit fc4214a883 and shipped in the upstream jackson-databind 2.11.4 release, which TuxCare then onboarded. The vulnerable pattern (missing ehcache blocklist entries) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.11.4-tuxcare.3. The target already contains the upstream fix that blocks deserialization of the two vulnerable ehcache JNDI selector classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector). This fix was authored by Tatu Saloranta in upstream commit fc4214a883 and shipped in the upstream jackson-databind 2.11.4 release, which TuxCare then onboarded. The vulnerable pattern (missing ehcache blocklist entries) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability involves unsafe deserialization of ignite-jta JNDI classes that could lead to arbitrary code execution. The fix, which adds three class names (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) to a deserialization blacklist in SubTypeValidator.java, was authored by upstream maintainer Tatu Saloranta in commit a424c038ba0c0d65e579e22001dec925902ac0ef and shipped in the upstream jackson-databind 2.11.4 release before TuxCare onboarded it. The target version already contains this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability involves unsafe deserialization of ignite-jta JNDI classes that could lead to arbitrary code execution. The fix, which adds three class names (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) to a deserialization blacklist in SubTypeValidator.java, was authored by upstream maintainer Tatu Saloranta in commit a424c038ba0c0d65e579e22001dec925902ac0ef and shipped in the upstream jackson-databind 2.11.4 release before TuxCare onboarded it. The target version already contains this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of the gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The fix (commit 592872f4235c7f2a3280725278da55544032f72d) adds this class to the deserialization blacklist in SubTypeValidator.java and was already present in the upstream jackson-databind 2.11.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "CVE-2020-10672 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of the gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The fix (commit 592872f4235c7f2a3280725278da55544032f72d) adds this class to the deserialization blacklist in SubTypeValidator.java and was already present in the upstream jackson-databind 2.11.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4 due to the ability to deserialize the dangerous gadget class com.caucho.config.types.ResourceRef. The target version 2.11.4 includes the upstream fix that adds this class to the deserialization blacklist in SubTypeValidator.java. The fix was shipped in the upstream release before TuxCare onboarded version 2.11.4, making the vulnerable code pattern not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4 due to the ability to deserialize the dangerous gadget class com.caucho.config.types.ResourceRef. The target version 2.11.4 includes the upstream fix that adds this class to the deserialization blacklist in SubTypeValidator.java. The fix was shipped in the upstream release before TuxCare onboarded version 2.11.4, making the vulnerable code pattern not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability concerns Jackson's polymorphic deserialization allowing instantiation of org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class. The target repository contains the upstream fix that adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 166-168). The fix was authored by upstream maintainer Tatu Saloranta (commit 05d7e0e13f4, 2020-03-25) and shipped in the upstream 2.11.4 release before TuxCare onboarded it (onboarding commit 285cedb883 by amoniatovskiy@cloudlinux.com). The blocklist is actively enforced by BeanDeserializerFactory's validation logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability concerns Jackson's polymorphic deserialization allowing instantiation of org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class. The target repository contains the upstream fix that adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 166-168). The fix was authored by upstream maintainer Tatu Saloranta (commit 05d7e0e13f4, 2020-03-25) and shipped in the upstream 2.11.4 release before TuxCare onboarded it (onboarding commit 285cedb883 by amoniatovskiy@cloudlinux.com). The blocklist is actively enforced by BeanDeserializerFactory's validation logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to deserialization gadget javax.swing.JEditorPane. The target (jackson-databind 2.11.4-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream 2.11.4 release. The vulnerable code pattern does not exist in this version - javax.swing.JEditorPane is blocked in SubTypeValidator.java (lines 146-148). The fix commit (4d038c9de0a) was authored by upstream maintainer Tatu Saloranta on 2020-03-03 and was included in the upstream release before TuxCare onboarded version 2.11.4 (onboarding commit 285cedb88 by amoniatovskiy@cloudlinux.com).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to deserialization gadget javax.swing.JEditorPane. The target (jackson-databind 2.11.4-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream 2.11.4 release. The vulnerable code pattern does not exist in this version - javax.swing.JEditorPane is blocked in SubTypeValidator.java (lines 146-148). The fix commit (4d038c9de0a) was authored by upstream maintainer Tatu Saloranta on 2020-03-03 and was included in the upstream release before TuxCare onboarded version 2.11.4 (onboarding commit 285cedb88 by amoniatovskiy@cloudlinux.com).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.4-tuxcare.3 is not affected by CVE-2020-11111. The upstream version 2.11.4 already contains the fix (commit 08fbfacf89) that blocks deserialization of org.apache.activemq.* gadget classes. All 9 activemq classes mentioned in the CVE are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 172-180). The fix was authored by qxo (49526356@qq.com), not TuxCare, and was present in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "The target jackson-databind 2.11.4-tuxcare.3 is not affected by CVE-2020-11111. The upstream version 2.11.4 already contains the fix (commit 08fbfacf89) that blocks deserialization of org.apache.activemq.* gadget classes. All 9 activemq classes mentioned in the CVE are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 172-180). The fix was authored by qxo (49526356@qq.com), not TuxCare, and was present in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is not present in jackson-databind 2.11.4-tuxcare.3. The vulnerability affects versions before 2.9.10.4, and the fix was included in the upstream 2.11.4 release. The fix adds \"org.apache.commons.proxy.provider.remoting.RmiProvider\" to the SubTypeValidator blocklist (line 183), preventing deserialization of this dangerous gadget class. This fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and was already present when TuxCare onboarded version 2.11.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 is not present in jackson-databind 2.11.4-tuxcare.3. The vulnerability affects versions before 2.9.10.4, and the fix was included in the upstream 2.11.4 release. The fix adds \"org.apache.commons.proxy.provider.remoting.RmiProvider\" to the SubTypeValidator blocklist (line 183), preventing deserialization of this dangerous gadget class. This fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and was already present when TuxCare onboarded version 2.11.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 affects jackson-databind versions that allow deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The target repository (jackson-databind 2.11.4-tuxcare.3) is NOT AFFECTED because the upstream vendor fix (commit e2ba12d5d6 by Tatu Saloranta) was already included in the upstream 2.11.4 release that TuxCare onboarded. The fix adds \"org.apache.openjpa.ee.WASRegistryManagedRuntime\" to the SubTypeValidator blocklist at line 84, preventing deserialization of this dangerous class. The vulnerable pattern (ability to deserialize the gadget class) is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 affects jackson-databind versions that allow deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The target repository (jackson-databind 2.11.4-tuxcare.3) is NOT AFFECTED because the upstream vendor fix (commit e2ba12d5d6 by Tatu Saloranta) was already included in the upstream 2.11.4 release that TuxCare onboarded. The fix adds \"org.apache.openjpa.ee.WASRegistryManagedRuntime\" to the SubTypeValidator blocklist at line 84, preventing deserialization of this dangerous class. The vulnerable pattern (ability to deserialize the gadget class) is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 affects jackson-databind versions before 2.9.10.4. The target is version 2.11.4, which already contains the upstream fix. The vulnerable pattern (absence of blocklist entries for MethodLocatingFactoryBean and BeanReferenceFactoryBean) is not present. The fix commit 113e89fb08b1b6b072d60b3e4737ed407c13db9a by upstream maintainer Tatu Saloranta was included in the upstream 2.11.4 release before TuxCare onboarded it. The gadget classes are properly blocked in SubTypeValidator.java lines 52-54, preventing deserialization-based exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 affects jackson-databind versions before 2.9.10.4. The target is version 2.11.4, which already contains the upstream fix. The vulnerable pattern (absence of blocklist entries for MethodLocatingFactoryBean and BeanReferenceFactoryBean) is not present. The fix commit 113e89fb08b1b6b072d60b3e4737ed407c13db9a by upstream maintainer Tatu Saloranta was included in the upstream 2.11.4 release before TuxCare onboarded it. The gadget classes are properly blocked in SubTypeValidator.java lines 52-54, preventing deserialization-based exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.11.4-tuxcare.3) is NOT AFFECTED because the upstream fix was already included in the 2.11.4 release that TuxCare onboarded. The fix adds org.apache.commons.jelly.impl.Embedded to the deserialization blocklist in SubTypeValidator.java (line 186), preventing instantiation of this gadget class during polymorphic deserialization. The blocklist is immutable and enforced before any deserialization occurs, with no bypass mechanism available through public APIs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.11.4-tuxcare.3) is NOT AFFECTED because the upstream fix was already included in the 2.11.4 release that TuxCare onboarded. The fix adds org.apache.commons.jelly.impl.Embedded to the deserialization blocklist in SubTypeValidator.java (line 186), preventing instantiation of this gadget class during polymorphic deserialization. The blocklist is immutable and enforced before any deserialization occurs, with no bypass mechanism available through public APIs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is NOT present in jackson-databind 2.11.4. The vulnerability concerns deserialization gadgets in Apache Drill's shaded dependencies (specifically oadd.org.apache.xalan.lib.sql.JNDIConnectionPool). The target contains the upstream fix that blacklists this class (SubTypeValidator.java line 189), preventing exploitation. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the original 2.11.4 release, predating any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 is NOT present in jackson-databind 2.11.4. The vulnerability concerns deserialization gadgets in Apache Drill's shaded dependencies (specifically oadd.org.apache.xalan.lib.sql.JNDIConnectionPool). The target contains the upstream fix that blacklists this class (SubTypeValidator.java line 189), preventing exploitation. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the original 2.11.4 release, predating any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 concerns Jackson-databind's deserialization of Oracle AQjms connection factory gadget classes that enable arbitrary code execution. The target (jackson-databind 2.11.4-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already present in the jackson-databind 2.11.4 release that TuxCare onboarded. The fix commit (5c8642aeae by tatu.saloranta@iki.fi, 2020-04-24) added five Oracle AQjms class names to SubTypeValidator's deserialization blocklist, preventing their instantiation during polymorphic type handling. This fix first shipped in upstream version 2.9.10.5 (2020-06-21) and was included in all subsequent releases including 2.11.4 (2020-12-11). Git ancestry analysis confirms the fix commit is an ancestor of TuxCare's onboarding commit (285cedb88), meaning it was part of the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "CVE-2020-14061 concerns Jackson-databind's deserialization of Oracle AQjms connection factory gadget classes that enable arbitrary code execution. The target (jackson-databind 2.11.4-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already present in the jackson-databind 2.11.4 release that TuxCare onboarded. The fix commit (5c8642aeae by tatu.saloranta@iki.fi, 2020-04-24) added five Oracle AQjms class names to SubTypeValidator's deserialization blocklist, preventing their instantiation during polymorphic type handling. This fix first shipped in upstream version 2.9.10.5 (2020-06-21) and was included in all subsequent releases including 2.11.4 (2020-12-11). Git ancestry analysis confirms the fix commit is an ancestor of TuxCare's onboarding commit (285cedb88), meaning it was part of the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target version (jackson-databind 2.11.4-tuxcare.3) is not affected by CVE-2020-14062. The vulnerability requires the ability to deserialize the class `com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool` to achieve code execution via JNDI injection. The target already contains the fix: a blacklist entry at SubTypeValidator.java:119 that blocks deserialization of this dangerous class. This fix was authored by the upstream FasterXML maintainer (tatu.saloranta@iki.fi) in commit 840eae2ca8 and was already present in the upstream 2.11.4 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "The target version (jackson-databind 2.11.4-tuxcare.3) is not affected by CVE-2020-14062. The vulnerability requires the ability to deserialize the class `com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool` to achieve code execution via JNDI injection. The target already contains the fix: a blacklist entry at SubTypeValidator.java:119 that blocks deserialization of this dangerous class. This fix was authored by the upstream FasterXML maintainer (tatu.saloranta@iki.fi) in commit 840eae2ca8 and was already present in the upstream 2.11.4 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target repository jackson-databind version 2.11.4-tuxcare.3 is NOT AFFECTED by CVE-2020-14195. The vulnerability fix (blocking deserialization of org.jsecurity.realm.jndi.JndiRealmFactory) is already present in the code, shipped as part of the upstream release 2.11.4 that TuxCare onboarded. The fix was committed by upstream maintainer Tatu Saloranta in commit f6d9c664f6 before the TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "Target repository jackson-databind version 2.11.4-tuxcare.3 is NOT AFFECTED by CVE-2020-14195. The vulnerability fix (blocking deserialization of org.jsecurity.realm.jndi.JndiRealmFactory) is already present in the code, shipped as part of the upstream release 2.11.4 that TuxCare onboarded. The fix was committed by upstream maintainer Tatu Saloranta in commit f6d9c664f6 before the TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is not present in jackson-databind 2.11.4-tuxcare.3. The vulnerability affects versions before 2.9.10.6, and the fix was already included in the upstream 2.11.4 release. The dangerous class br.com.anteros.dbcp.AnterosDBCPDataSource is blacklisted in SubTypeValidator.java (line 144), preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7 on 2020-08-10, which was included in the upstream 2.11.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 is not present in jackson-databind 2.11.4-tuxcare.3. The vulnerability affects versions before 2.9.10.6, and the fix was already included in the upstream 2.11.4 release. The dangerous class br.com.anteros.dbcp.AnterosDBCPDataSource is blacklisted in SubTypeValidator.java (line 144), preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7 on 2020-08-10, which was included in the upstream 2.11.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.4-tuxcare.3 is NOT vulnerable to CVE-2020-24750. The upstream vendor (FasterXML) fixed this vulnerability in commit 6cc9f1a1af by adding com.pastdev.httpcomponents.configuration.JndiConfiguration to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.11.4 release that TuxCare onboarded. The gadget class is blocked at line 204 of SubTypeValidator.java, preventing exploitation via polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "The target jackson-databind 2.11.4-tuxcare.3 is NOT vulnerable to CVE-2020-24750. The upstream vendor (FasterXML) fixed this vulnerability in commit 6cc9f1a1af by adding com.pastdev.httpcomponents.configuration.JndiConfiguration to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.11.4 release that TuxCare onboarded. The gadget class is blocked at line 204 of SubTypeValidator.java, preventing exploitation via polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE in DOMDeserializer) is NOT present in jackson-databind 2.11.4-tuxcare.3. The fix was already included in the upstream 2.11.4 release that TuxCare onboarded. Lines 43-49 of DOMDeserializer.java contain the XXE protections (disallow-doctype-decl=true, load-external-dtd=false) added by upstream commit 612f971b78 authored by Tatu Saloranta (tatu.saloranta@iki.fi). This commit is an ancestor of the TuxCare onboarding commit 285cedb88349cac738d21239626f47f92b72bef4, confirming it shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE in DOMDeserializer) is NOT present in jackson-databind 2.11.4-tuxcare.3. The fix was already included in the upstream 2.11.4 release that TuxCare onboarded. Lines 43-49 of DOMDeserializer.java contain the XXE protections (disallow-doctype-decl=true, load-external-dtd=false) added by upstream commit 612f971b78 authored by Tatu Saloranta (tatu.saloranta@iki.fi). This commit is an ancestor of the TuxCare onboarding commit 285cedb88349cac738d21239626f47f92b72bef4, confirming it shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:25.121019+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-35728 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" }, "action_statement": "Vulnerability CVE-2020-35728 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-09T13:59:55.015964+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.4-tuxcare.5.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.4-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-09T14:00:15.730497+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.4-tuxcare.5.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.4-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-09T13:59:39.824503+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.4-tuxcare.5.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.4-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-36183 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" }, "action_statement": "Vulnerability CVE-2020-36183 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-09T14:00:01.699857+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.4-tuxcare.5.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.4-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-36187 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" }, "action_statement": "Vulnerability CVE-2020-36187 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:25.121019+00:00", "status_notes": "Vulnerability CVE-2020-36188 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-06T06:15:09.638899+00:00", "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is not present in jackson-databind 2.11.4-tuxcare.3. The vulnerability involves missing blocklist entries for org.apache.xbean.propertyeditor.JndiConverter, which enables JNDI injection attacks via polymorphic deserialization. The upstream vendor fix (commits 914e7c9f2c and 9bb52c7122, authored by Tatu Saloranta) added JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in upstream version 2.11.4 when TuxCare onboarded it (first TuxCare commit 285cedb88), making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 is not present in jackson-databind 2.11.4-tuxcare.3. The vulnerability involves missing blocklist entries for org.apache.xbean.propertyeditor.JndiConverter, which enables JNDI injection attacks via polymorphic deserialization. The upstream vendor fix (commits 914e7c9f2c and 9bb52c7122, authored by Tatu Saloranta) added JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in upstream version 2.11.4 when TuxCare onboarded it (first TuxCare commit 285cedb88), making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.4-tuxcare.3 is NOT affected by CVE-2020-9546. The upstream FasterXML fix for this vulnerability (adding org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to the deserialization blocklist) was already present in the upstream jackson-databind 2.11.4 release that TuxCare onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "The target jackson-databind 2.11.4-tuxcare.3 is NOT affected by CVE-2020-9546. The upstream FasterXML fix for this vulnerability (adding org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to the deserialization blocklist) was already present in the upstream jackson-databind 2.11.4 release that TuxCare onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.11.4-tuxcare.3 is not affected by CVE-2020-9547. The vulnerability involves deserialization of the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The upstream fix (commit 1e64db6a2f) blocking this class was already present in the upstream 2.11.4 release that TuxCare onboarded. The gadget class is blocked in SubTypeValidator.java line 141, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "Target jackson-databind 2.11.4-tuxcare.3 is not affected by CVE-2020-9547. The vulnerability involves deserialization of the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The upstream fix (commit 1e64db6a2f) blocking this class was already present in the upstream 2.11.4 release that TuxCare onboarded. The gadget class is blocked in SubTypeValidator.java line 141, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to unsafe deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.11.4-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream 2.11.4 release. The malicious class is blocklisted in SubTypeValidator.java line 142, preventing its deserialization and blocking the attack chain to remote code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to unsafe deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.11.4-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream 2.11.4 release. The malicious class is blocklisted in SubTypeValidator.java line 142, preventing its deserialization and blocking the attack chain to remote code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability involves deserialization of javax.swing.JTextPane gadget class, which was blocked by upstream fix commit 7dbf51bf78d (authored by Tatu Saloranta on 2020-09-17). This fix was already included in the upstream 2.11.4 release before TuxCare onboarding. The target contains the protection at SubTypeValidator.java:148, where JTextPane is in the deserialization blocklist. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.11.4-tuxcare.3. The vulnerability involves deserialization of javax.swing.JTextPane gadget class, which was blocked by upstream fix commit 7dbf51bf78d (authored by Tatu Saloranta on 2020-09-17). This fix was already included in the upstream 2.11.4 release before TuxCare onboarding. The target contains the protection at SubTypeValidator.java:148, where JTextPane is in the deserialization blocklist. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2021-46877 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:25.121019+00:00", "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.11.4-tuxcare.3 is NOT AFFECTED by CVE-2026-54518. The vulnerability concerns UnwrappedPropertyHandler.processUnwrappedCreatorProperties() bypassing @JsonView checks when unwrapped creator parameters are used. However, this method and the underlying feature (@JsonUnwrapped with @JsonCreator) do not exist in version 2.11.4. The feature was introduced in jackson-databind 2.19.0 (i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Target version 2.11.4-tuxcare.3 is NOT AFFECTED by CVE-2026-54518. The vulnerability concerns UnwrappedPropertyHandler.processUnwrappedCreatorProperties() bypassing @JsonView checks when unwrapped creator parameters are used. However, this method and the underlying feature (@JsonUnwrapped with @JsonCreator) do not exist in version 2.11.4. The feature was introduced in jackson-databind 2.19.0 (i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Jackson-databind 2.11.4 is NOT affected by CVE-2026-59888. The vulnerability is specific to Java Records deserialization with PropertyNamingStrategy, but Records support was not added until Jackson 2.12.0 (commit dd2ed05fff). Version 2.11.4 has no Records-related code (grep for isRecord/getRecordComponents/RecordAccessor returns no matches in src/main). For POJOs, the code path is not vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 Jackson-databind 2.11.4 is NOT affected by CVE-2026-59888. The vulnerability is specific to Java Records deserialization with PropertyNamingStrategy, but Records support was not added until Jackson 2.12.0 (commit dd2ed05fff). Version 2.11.4 has no Records-related code (grep for isRecord/getRecordComponents/RecordAccessor returns no matches in src/main). For POJOs, the code path is not vulnerabl..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.11.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4-tuxcare.4" } } ], "timestamp": "2026-11-05T10:18:06.486868+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.11.4-tuxcare.4.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }