{
  "@id": "urn:uuid:fdc89f76-76dd-48d5-96e9-d72d56033ab9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T11:18:15.059040+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4, allowing arbitrary code execution via polymorphic deserialization of dangerous classes. The target version 2.12.2-tuxcare.3 contains the comprehensive fix for issue #1737, which blacklists dangerous classes including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and Spring/C3P0 types. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in the upstream release 2.12.2 when TuxCare onboarded it. The vulnerable pattern (allowing arbitrary class instantiation without validation) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4, allowing arbitrary code execution via polymorphic deserialization of dangerous classes. The target version 2.12.2-tuxcare.3 contains the comprehensive fix for issue #1737, which blacklists dangerous classes including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and Spring/C3P0 types. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in the upstream release 2.12.2 when TuxCare onboarded it. The vulnerable pattern (allowing arbitrary class instantiation without validation) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3 due to an incomplete deserialization blacklist that could be bypassed when Spring libraries are available. The target version 2.12.2-tuxcare.3 contains the complete upstream fix that was already present in the jackson-databind 2.12.2 release onboarded by TuxCare. The fix includes SubTypeValidator with a comprehensive blacklist of dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, and Spring/C3P0 classes) plus special handling for Spring class hierarchies. The validation is properly integrated into BeanDeserializerFactory and executes before any bean deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3 due to an incomplete deserialization blacklist that could be bypassed when Spring libraries are available. The target version 2.12.2-tuxcare.3 contains the complete upstream fix that was already present in the jackson-databind 2.12.2 release onboarded by TuxCare. The fix includes SubTypeValidator with a comprehensive blacklist of dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, and Spring/C3P0 classes) plus special handling for Spring class hierarchies. The validation is properly integrated into BeanDeserializerFactory and executes before any bean deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9 due to unsafe deserialization allowing code execution via malicious type metadata. The target repository (jackson-databind 2.12.2-tuxcare.3) is NOT affected because the fix was already present in the upstream 2.12.2 release that TuxCare onboarded. The fix (SubTypeValidator with blocklist of dangerous classes including both TemplatesImpl variants) was introduced by upstream commit 2235894210c75f624a3d0cd60bfb0434a20a18bf, authored by Tatu Saloranta, and is active in the target at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java lines 42-43, enforced via BeanDeserializerFactory._validateSubType() at line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9 due to unsafe deserialization allowing code execution via malicious type metadata. The target repository (jackson-databind 2.12.2-tuxcare.3) is NOT affected because the fix was already present in the upstream 2.12.2 release that TuxCare onboarded. The fix (SubTypeValidator with blocklist of dangerous classes including both TemplatesImpl variants) was introduced by upstream commit 2235894210c75f624a3d0cd60bfb0434a20a18bf, authored by Tatu Saloranta, and is active in the target at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java lines 42-43, enforced via BeanDeserializerFactory._validateSubType() at line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5 and was fixed by adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist. The target version 2.12.2 already contains this fix in SubTypeValidator.java line 65, applied by upstream commit 27b4defc270454dea6842bd9279f17387eceb737 (author: tatu.saloranta@iki.fi) before TuxCare onboarded version 2.12.2. The fix was shipped in the upstream 2.12.2 release. Verdict: not_affected with upstream vendor attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5 and was fixed by adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist. The target version 2.12.2 already contains this fix in SubTypeValidator.java line 65, applied by upstream commit 27b4defc270454dea6842bd9279f17387eceb737 (author: tatu.saloranta@iki.fi) before TuxCare onboarded version 2.12.2. The fix was shipped in the upstream 2.12.2 release. Verdict: not_affected with upstream vendor attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.2 is not affected by CVE-2018-12022. The fix blocking polymorphic deserialization of dangerous Jodd-db and Oracle JDBC classes was already present in the upstream jackson-databind 2.12.2 release before TuxCare onboarded it. The SubTypeValidator blacklist contains all three CVE-2018-12022 gadget classes, and the validation is properly enforced during deserialization with no bypass mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "Target version 2.12.2 is not affected by CVE-2018-12022. The fix blocking polymorphic deserialization of dangerous Jodd-db and Oracle JDBC classes was already present in the upstream jackson-databind 2.12.2 release before TuxCare onboarded it. The SubTypeValidator blacklist contains all three CVE-2018-12022 gadget classes, and the validation is properly enforced during deserialization with no bypass mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.2 is not affected by CVE-2018-12023. The Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) identified in the CVE are already blocked in SubTypeValidator.java (lines 70-72), preventing their polymorphic deserialization. This fix was introduced by upstream maintainer Tatu Saloranta in commit 7487cf7e (May 2018) and was included in the upstream 2.12.2 release (March 2021) that TuxCare onboarded. The blocklist is enforced by BeanDeserializerFactory during all bean deserialization operations, with no bypass paths available.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "Target version 2.12.2 is not affected by CVE-2018-12023. The Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) identified in the CVE are already blocked in SubTypeValidator.java (lines 70-72), preventing their polymorphic deserialization. This fix was introduced by upstream maintainer Tatu Saloranta in commit 7487cf7e (May 2018) and was included in the upstream 2.12.2 release (March 2021) that TuxCare onboarded. The blocklist is enforced by BeanDeserializerFactory during all bean deserialization operations, with no bypass paths available.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.2-tuxcare.3) is NOT affected by CVE-2018-14718. The vulnerability pattern is absent because the fix was already present in the upstream jackson-databind 2.12.2 release. The blocklist entry \"org.slf4j.ext.EventData\" exists in SubTypeValidator.java line 75, preventing deserialization of the dangerous class. This fix was authored by the upstream maintainer Tatu Saloranta and shipped with the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "The target repository (jackson-databind 2.12.2-tuxcare.3) is NOT affected by CVE-2018-14718. The vulnerability pattern is absent because the fix was already present in the upstream jackson-databind 2.12.2 release. The blocklist entry \"org.slf4j.ext.EventData\" exists in SubTypeValidator.java line 75, preventing deserialization of the dangerous class. This fix was authored by the upstream maintainer Tatu Saloranta and shipped with the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 due to missing blocklist entries for dangerous BlazeDS classes (blaze-ds-opt/blaze-ds-core) in polymorphic deserialization. The target version 2.12.2 already contains the upstream fix (commit 87d29af2) that adds flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes to DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.12.2 before TuxCare onboarding (commit 85cad3c8). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 due to missing blocklist entries for dangerous BlazeDS classes (blaze-ds-opt/blaze-ds-core) in polymorphic deserialization. The target version 2.12.2 already contains the upstream fix (commit 87d29af2) that adds flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes to DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.12.2 before TuxCare onboarding (commit 85cad3c8). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not affecting jackson-databind version 2.12.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks and other exploits. The fix was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 and was already present in upstream version 2.12.2 before TuxCare onboarded it. All four class names are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 75-78), and the validation is integrated into the bean deserialization flow via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is not affecting jackson-databind version 2.12.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks and other exploits. The fix was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 and was already present in upstream version 2.12.2 before TuxCare onboarded it. All four class names are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 75-78), and the validation is integrated into the bean deserialization flow via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 targets jackson-databind's polymorphic deserialization vulnerability allowing SSRF attacks via the axis2-jaxws class. The target repository is jackson-databind 2.12.2-tuxcare.3. The upstream fix (commit 87d29af25e) was already present in the upstream release 2.12.2 that TuxCare onboarded. The defense blocks dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl in SubTypeValidator.java line 78, enforced via BeanDeserializerFactory._validateSubType during deserialization. The vulnerable pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 targets jackson-databind's polymorphic deserialization vulnerability allowing SSRF attacks via the axis2-jaxws class. The target repository is jackson-databind 2.12.2-tuxcare.3. The upstream fix (commit 87d29af25e) was already present in the upstream release 2.12.2 that TuxCare onboarded. The defense blocks dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl in SubTypeValidator.java line 78, enforced via BeanDeserializerFactory._validateSubType during deserialization. The vulnerable pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.2-tuxcare.3) is NOT AFFECTED by CVE-2018-19360. The fix preventing polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo is already present in the codebase. The class is listed in the deserialization blocklist at SubTypeValidator.java:85, and the validateSubType method enforces this protection. This fix was authored by the upstream maintainer (Tatu Saloranta, commit 72cd4025a2) and was already included in the upstream 2.12.2 release when TuxCare onboarded it (commit 85cad3c847). The vulnerable pattern (unrestricted polymorphic deserialization of axis2-transport-jms) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "The target repository (jackson-databind 2.12.2-tuxcare.3) is NOT AFFECTED by CVE-2018-19360. The fix preventing polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo is already present in the codebase. The class is listed in the deserialization blocklist at SubTypeValidator.java:85, and the validateSubType method enforces this protection. This fix was authored by the upstream maintainer (Tatu Saloranta, commit 72cd4025a2) and was already included in the upstream 2.12.2 release when TuxCare onboarded it (commit 85cad3c847). The vulnerable pattern (unrestricted polymorphic deserialization of axis2-transport-jms) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for openjpa classes in polymorphic deserialization. The target repository is jackson-databind 2.12.2-tuxcare.3, which already contains the upstream fix (commit 72cd4025a2) that was shipped in version 2.9.8 (November 2018). The fix adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the deserialization blocklist in SubTypeValidator.java, preventing the vulnerability pattern from being exploitable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for openjpa classes in polymorphic deserialization. The target repository is jackson-databind 2.12.2-tuxcare.3, which already contains the upstream fix (commit 72cd4025a2) that was shipped in version 2.9.8 (November 2018). The fix adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the deserialization blocklist in SubTypeValidator.java, preventing the vulnerability pattern from being exploitable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability (failure to block jboss-common-core DocumentEditor and related classes from polymorphic deserialization) was fixed in upstream commit 72cd4025a2 (Nov 2018) which is present in the upstream 2.12.2 release. All four required blocklist entries (DocumentEditor, RegistryManagedRuntime, JNDIManagedRuntime, JMSOutTransportInfo) are present in SubTypeValidator.java lines 81-85. The fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream release that TuxCare onboarded, not added by TuxCare as a separate backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability (failure to block jboss-common-core DocumentEditor and related classes from polymorphic deserialization) was fixed in upstream commit 72cd4025a2 (Nov 2018) which is present in the upstream 2.12.2 release. All four required blocklist entries (DocumentEditor, RegistryManagedRuntime, JNDIManagedRuntime, JMSOutTransportInfo) are present in SubTypeValidator.java lines 81-85. The fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream release that TuxCare onboarded, not added by TuxCare as a separate backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the deserialization blacklist to achieve remote code execution. The upstream fix adding these classes to the blacklist was included in the upstream 2.12.2 release, before TuxCare onboarding. The target contains the complete fix at SubTypeValidator.java lines 61-63, properly integrated into the deserialization validation flow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the deserialization blacklist to achieve remote code execution. The upstream fix adding these classes to the blacklist was included in the upstream 2.12.2 release, before TuxCare onboarding. The target contains the complete fix at SubTypeValidator.java lines 61-63, properly integrated into the deserialization validation flow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.12.2-tuxcare.3. The fix blocking c3p0 DataSource gadget classes was already included in upstream jackson-databind 2.12.2 when TuxCare onboarded it. The defense code in SubTypeValidator.java (lines 288-297) rejects any class matching the pattern com.mchange.v2.c3p0.*DataSource, preventing the exploitation described in the CVE. This fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) in commit 6799f8f1 and first appeared in upstream version 2.10.0, well before version 2.12.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.12.2-tuxcare.3. The fix blocking c3p0 DataSource gadget classes was already included in upstream jackson-databind 2.12.2 when TuxCare onboarded it. The defense code in SubTypeValidator.java (lines 288-297) rejects any class matching the pattern com.mchange.v2.c3p0.*DataSource, preventing the exploitation described in the CVE. This fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) in commit 6799f8f1 and first appeared in upstream version 2.10.0, well before version 2.12.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target (jackson-databind 2.12.2-tuxcare.3) is NOT affected by CVE-2019-12086. The vulnerability was fixed in upstream version 2.9.9, and version 2.12.2 already contains the fix. The blocklist entry for \"com.mysql.cj.jdbc.admin.MiniAdmin\" is present at SubTypeValidator.java:88, preventing deserialization of this dangerous gadget class when Default Typing is enabled. This fix was authored by the upstream FasterXML maintainer (tatu.saloranta@iki.fi) and was already present in the upstream 2.12.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "The target (jackson-databind 2.12.2-tuxcare.3) is NOT affected by CVE-2019-12086. The vulnerability was fixed in upstream version 2.9.9, and version 2.12.2 already contains the fix. The blocklist entry for \"com.mysql.cj.jdbc.admin.MiniAdmin\" is present at SubTypeValidator.java:88, preventing deserialization of this dangerous gadget class when Default Typing is enabled. This fix was authored by the upstream FasterXML maintainer (tatu.saloranta@iki.fi) and was already present in the upstream 2.12.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target (jackson-databind 2.12.2-tuxcare.3) is not affected by CVE-2019-12384. The vulnerability pattern is not present because the upstream fix was already included in version 2.12.2, which TuxCare onboarded. The fix blocks deserialization of ch.qos.logback.core.db.DriverManagerConnectionSource by adding it to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (line 91). Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 The target (jackson-databind 2.12.2-tuxcare.3) is not affected by CVE-2019-12384. The vulnerability pattern is not present because the upstream fix was already included in version 2.12.2, which TuxCare onboarded. The fix blocks deserialization of ch.qos.logback.core.db.DriverManagerConnectionSource by adding it to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (line 91). Th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is not present in jackson-databind 2.12.2. The vulnerability allowed arbitrary file reads via JDOM XSLTransformer classes when polymorphic typing was enabled. The fix (commit 5f7c69bba0) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was authored by the upstream maintainer Tatu Saloranta and w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 is not present in jackson-databind 2.12.2. The vulnerability allowed arbitrary file reads via JDOM XSLTransformer classes when polymorphic typing was enabled. The fix (commit 5f7c69bba0) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was authored by the upstream maintainer Tatu Saloranta and w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind version 2.12.2) is not affected by CVE-2019-14379. The vulnerability was fixed in the upstream release by adding net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the SubTypeValidator blocklist (line 98). This fix (commit ad418eeb97) was authored by the upstream maintainer (tatu.saloranta@iki.fi) and was already present in the upstream 2.12.2 release when TuxCare onboarded it. The fix commit is an ancestor of the first TuxCare commit (85cad3c847 \"Onboard version 2.12.2\"), confirming it shipped with the upstream release. The blocklist is actively enforced during deserialization via SubTypeValidator.validateSubType() at BeanDeserializerFactory.java line 1000.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "The target repository (jackson-databind version 2.12.2) is not affected by CVE-2019-14379. The vulnerability was fixed in the upstream release by adding net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the SubTypeValidator blocklist (line 98). This fix (commit ad418eeb97) was authored by the upstream maintainer (tatu.saloranta@iki.fi) and was already present in the upstream 2.12.2 release when TuxCare onboarded it. The fix commit is an ancestor of the first TuxCare commit (85cad3c847 \"Onboard version 2.12.2\"), confirming it shipped with the upstream release. The blocklist is actively enforced during deserialization via SubTypeValidator.validateSubType() at BeanDeserializerFactory.java line 1000.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 (and corresponding fixes in 2.8.x, 2.7.x, 2.6.x series). The target repository at version 2.12.2 already contains the upstream fix. The vulnerability allowed JNDI injection via deserialization of ch.qos.logback.core.db.JNDIConnectionSource when Default Typing was enabled. The fix adds this class to the SubTypeValidator blacklist (line 102 of SubTypeValidator.java). This fix was applied by upstream author Tatu Saloranta on July 25, 2019 (commit ad418eeb), well before the 2.12.2 release (March 3, 2021) that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 (and corresponding fixes in 2.8.x, 2.7.x, 2.6.x series). The target repository at version 2.12.2 already contains the upstream fix. The vulnerability allowed JNDI injection via deserialization of ch.qos.logback.core.db.JNDIConnectionSource when Default Typing was enabled. The fix adds this class to the SubTypeValidator blacklist (line 102 of SubTypeValidator.java). This fix was applied by upstream author Tatu Saloranta on July 25, 2019 (commit ad418eeb), well before the 2.12.2 release (March 3, 2021) that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig/HikariDataSource classes. The upstream fix (adding these classes to the deserialization blocklist) was already present in the upstream 2.12.2 release when TuxCare onboarded it. The target code contains the complete defense at SubTypeValidator.java lines 104-107, preventing instantiation of these gadget classes during polymorphic type resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig/HikariDataSource classes. The upstream fix (adding these classes to the deserialization blocklist) was already present in the upstream 2.12.2 release when TuxCare onboarded it. The target code contains the complete defense at SubTypeValidator.java lines 104-107, preventing instantiation of these gadget classes during polymorphic type resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target repository is at version 2.12.2-tuxcare.3, which is significantly newer than the affected versions. The fix that blocks polymorphic deserialization of commons-configuration JNDI gadget classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) is present in SubTypeValidator.java lines 113-114. This fix was authored by upstream maintainer Tatu Saloranta in September 2019 (commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af) and shipped in the upstream 2.12.2 release that TuxCare onboarded. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target repository is at version 2.12.2-tuxcare.3, which is significantly newer than the affected versions. The fix that blocks polymorphic deserialization of commons-configuration JNDI gadget classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) is present in SubTypeValidator.java lines 113-114. This fix was authored by upstream maintainer Tatu Saloranta in September 2019 (commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af) and shipped in the upstream 2.12.2 release that TuxCare onboarded. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is not present in jackson-databind 2.12.2-tuxcare.3. The upstream vendor fix (commit 998efd7) that blacklists the xalan JNDI gadget class 'org.apache.xalan.lib.sql.JNDIConnectionPool' was already included in the jackson-databind 2.12.2 release before TuxCare onboarded it. The fix is present at line 117 of SubTypeValidator.java, preventing polymorphic deserialization of this malicious gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is not present in jackson-databind 2.12.2-tuxcare.3. The upstream vendor fix (commit 998efd7) that blacklists the xalan JNDI gadget class 'org.apache.xalan.lib.sql.JNDIConnectionPool' was already included in the jackson-databind 2.12.2 release before TuxCare onboarded it. The fix is present at line 117 of SubTypeValidator.java, preventing polymorphic deserialization of this malicious gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is not present in jackson-databind 2.12.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could enable arbitrary code execution through property injection. The upstream vendor fix (adding HikariDataSource to the SubTypeValidator blocklist) was already present in upstream release 2.12.2 before TuxCare onboarded it. The blocklist entry is at SubTypeValidator.java:107 and is actively enforced during deserialization via BeanDeserializerFactory:1000. No vulnerable code paths exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 is not present in jackson-databind 2.12.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could enable arbitrary code execution through property injection. The upstream vendor fix (adding HikariDataSource to the SubTypeValidator blocklist) was already present in upstream release 2.12.2 before TuxCare onboarded it. The blocklist entry is at SubTypeValidator.java:107 and is actively enforced during deserialization via BeanDeserializerFactory:1000. No vulnerable code paths exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involved polymorphic deserialization of org.apache.commons.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource, which could enable remote code execution when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in commits 9593e16cf5 and 328a0f833d by adding these classes to SubTypeValidator's blacklist (DEFAULT_NO_DESER_CLASS_NAMES). These fix commits were already present in the upstream 2.12.2 release that TuxCare onboarded (first TuxCare commit: 85cad3c84721). The blacklist is enforced by SubTypeValidator.validateSubType() which is called from BeanDeserializerFactory during all polymorphic deserialization. The vulnerable pattern is absent because the dangerous classes cannot be deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involved polymorphic deserialization of org.apache.commons.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource, which could enable remote code execution when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in commits 9593e16cf5 and 328a0f833d by adding these classes to SubTypeValidator's blacklist (DEFAULT_NO_DESER_CLASS_NAMES). These fix commits were already present in the upstream 2.12.2 release that TuxCare onboarded (first TuxCare commit: 85cad3c84721). The blacklist is enforced by SubTypeValidator.validateSubType() which is called from BeanDeserializerFactory during all polymorphic deserialization. The vulnerable pattern is absent because the dangerous classes cannot be deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1 when Default Typing is enabled, allowing RCE via P6DataSource gadget class deserialization. The target repository (jackson-databind 2.12.2-tuxcare.3) is NOT AFFECTED because the upstream fix (commit 9593e16cf5) was already present in jackson-databind 2.12.2 before TuxCare onboarding. The fix adds P6DataSource, SharedPoolDataSource, and PerUserPoolDataSource to the SubTypeValidator blocklist, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1 when Default Typing is enabled, allowing RCE via P6DataSource gadget class deserialization. The target repository (jackson-databind 2.12.2-tuxcare.3) is NOT AFFECTED because the upstream fix (commit 9593e16cf5) was already present in jackson-databind 2.12.2 before TuxCare onboarding. The fix adds P6DataSource, SharedPoolDataSource, and PerUserPoolDataSource to the SubTypeValidator blocklist, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.2-tuxcare.3 is NOT AFFECTED by CVE-2019-17267. The vulnerability concerns polymorphic deserialization of the malicious gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The fix (adding this class to the SubTypeValidator blacklist) was authored by upstream maintainer Tatu Saloranta in commit 191a4cdf87b and shipped in the upstream jackson-databind 2.12.2 release. TuxCare onboarded version 2.12.2, which already contained this fix. The vulnerable pattern (absence of the blacklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "Target jackson-databind 2.12.2-tuxcare.3 is NOT AFFECTED by CVE-2019-17267. The vulnerability concerns polymorphic deserialization of the malicious gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The fix (adding this class to the SubTypeValidator blacklist) was authored by upstream maintainer Tatu Saloranta in commit 191a4cdf87b and shipped in the upstream jackson-databind 2.12.2 release. TuxCare onboarded version 2.12.2, which already contained this fix. The vulnerable pattern (absence of the blacklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.12.2 is NOT AFFECTED by CVE-2019-17531. The vulnerability involves polymorphic deserialization of log4j-extras (1.2.x) classes that can trigger JNDI lookups leading to remote code execution. The fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0) adds two log4j-extras classes to the deserialization blocklist in SubTypeValidator.java. This fix is present in the target at lines 129-131, and was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi). The fix shipped in the upstream 2.12.2 release before TuxCare onboarded it (first TuxCare commit: 85cad3c84721d150a0f900c902222ad722075526). CVE-2019-17531 affects versions prior to 2.9.10.1, and 2.12.2 > 2.9.10.1, confirming the fix is naturally present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "Target jackson-databind version 2.12.2 is NOT AFFECTED by CVE-2019-17531. The vulnerability involves polymorphic deserialization of log4j-extras (1.2.x) classes that can trigger JNDI lookups leading to remote code execution. The fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0) adds two log4j-extras classes to the deserialization blocklist in SubTypeValidator.java. This fix is present in the target at lines 129-131, and was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi). The fix shipped in the upstream 2.12.2 release before TuxCare onboarded it (first TuxCare commit: 85cad3c84721d150a0f900c902222ad722075526). CVE-2019-17531 affects versions prior to 2.9.10.1, and 2.12.2 > 2.9.10.1, confirming the fix is naturally present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves missing blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that can be exploited for arbitrary code execution via polymorphic deserialization. The target repository already contains the upstream fix (commit fc4214a883d by Tatu Saloranta) which adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was included in the upstream jackson-databind 2.12.2 release that TuxCare onboarded, predating all TuxCare-specific commits on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves missing blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that can be exploited for arbitrary code execution via polymorphic deserialization. The target repository already contains the upstream fix (commit fc4214a883d by Tatu Saloranta) which adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was included in the upstream jackson-databind 2.12.2 release that TuxCare onboarded, predating all TuxCare-specific commits on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 concerns unsafe deserialization of ignite-jta classes in jackson-databind. The target repository (jackson-databind 2.12.2-tuxcare.3) already contains the upstream fix. The three dangerous classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) are present in the deserialization blocklist at SubTypeValidator.java lines 157-160. This fix was authored by upstream FasterXML maintainer Tatu Saloranta in commit a424c038ba and was included in the upstream 2.12.2 release that TuxCare onboarded. The target is not affected because the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 concerns unsafe deserialization of ignite-jta classes in jackson-databind. The target repository (jackson-databind 2.12.2-tuxcare.3) already contains the upstream fix. The three dangerous classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) are present in the deserialization blocklist at SubTypeValidator.java lines 157-160. This fix was authored by upstream FasterXML maintainer Tatu Saloranta in commit a424c038ba and was included in the upstream 2.12.2 release that TuxCare onboarded. The target is not affected because the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 affects jackson-databind versions before 2.9.10.4. The target repository is jackson-databind version 2.12.2-tuxcare.3/4, which already includes the upstream fix. The gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (and RecoverablePooledConnectionFactory) are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 163-164), preventing their deserialization. This fix was shipped in the upstream 2.12.2 release and was already present when TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 affects jackson-databind versions before 2.9.10.4. The target repository is jackson-databind version 2.12.2-tuxcare.3/4, which already includes the upstream fix. The gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (and RecoverablePooledConnectionFactory) are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 163-164), preventing their deserialization. This fix was shipped in the upstream 2.12.2 release and was already present when TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for the deserialization gadget class com.caucho.config.types.ResourceRef. The target repository is jackson-databind version 2.12.2-tuxcare.3, which already contains the upstream fix (commit 1645efbd39 by Tatu Saloranta, dated 2020-03-17). The fix adds ResourceRef to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 167), preventing exploitation of this deserialization gadget. This fix was shipped in the upstream 2.12.2 release and was already present when TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for the deserialization gadget class com.caucho.config.types.ResourceRef. The target repository is jackson-databind version 2.12.2-tuxcare.3, which already contains the upstream fix (commit 1645efbd39 by Tatu Saloranta, dated 2020-03-17). The fix adds ResourceRef to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 167), preventing exploitation of this deserialization gadget. This fix was shipped in the upstream 2.12.2 release and was already present when TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget vulnerability involving org.aoju.bus.proxy.provider.remoting.RmiProvider (bus-proxy). The target repository jackson-databind 2.12.2-tuxcare.3 contains the upstream fix that adds RmiProvider classes to the deserialization blocklist in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta in commit 05d7e0e13f (March 2020) and was already present in the upstream 2.12.2 release that TuxCare onboarded. The vulnerable pattern (ability to deserialize dangerous RmiProvider classes) is not present in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget vulnerability involving org.aoju.bus.proxy.provider.remoting.RmiProvider (bus-proxy). The target repository jackson-databind 2.12.2-tuxcare.3 contains the upstream fix that adds RmiProvider classes to the deserialization blocklist in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta in commit 05d7e0e13f (March 2020) and was already present in the upstream 2.12.2 release that TuxCare onboarded. The vulnerable pattern (ability to deserialize dangerous RmiProvider classes) is not present in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves deserialization of javax.swing.JEditorPane as a gadget type. The upstream vendor fix (commit 6ba4845798) added javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its instantiation during deserialization. This fix was already included in the upstream 2.12.2 release, before TuxCare's onboarding at commit 85cad3c8. The blocklist entry is present at line 150 and is enforced during deserialization via the validateSubType() method, which rejects blocklisted types with a security error.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves deserialization of javax.swing.JEditorPane as a gadget type. The upstream vendor fix (commit 6ba4845798) added javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its instantiation during deserialization. This fix was already included in the upstream 2.12.2 release, before TuxCare's onboarding at commit 85cad3c8. The blocklist entry is present at line 150 and is enforced during deserialization via the validateSubType() method, which rejects blocklisted types with a security error.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 fix is present in target version 2.12.2. All 9 ActiveMQ classes from the upstream patches are blacklisted in SubTypeValidator.java (lines 173-183). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in upstream release 2.12.2, which TuxCare onboarded. This is not a TuxCare backport but an upstream fix already present in the base version when TuxCare started maintaining this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 fix is present in target version 2.12.2. All 9 ActiveMQ classes from the upstream patches are blacklisted in SubTypeValidator.java (lines 173-183). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in upstream release 2.12.2, which TuxCare onboarded. This is not a TuxCare backport but an upstream fix already present in the base version when TuxCare started maintaining this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.12.2 is not affected by CVE-2020-11112. The upstream fix (commit 05d7e0e13f43e12db6a51726df12c8b4d8040676) that blocks deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider was already present in the upstream 2.12.2 release before TuxCare onboarded it. The vulnerable gadget class is blocked at line 186 of SubTypeValidator.java in the DEFAULT_NO_DESER_CLASS_NAMES set, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "Target jackson-databind version 2.12.2 is not affected by CVE-2020-11112. The upstream fix (commit 05d7e0e13f43e12db6a51726df12c8b4d8040676) that blocks deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider was already present in the upstream 2.12.2 release before TuxCare onboarded it. The vulnerable gadget class is blocked at line 186 of SubTypeValidator.java in the DEFAULT_NO_DESER_CLASS_NAMES set, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 does not affect jackson-databind 2.12.2-tuxcare.3. The vulnerability concerns the missing blacklist entry for org.apache.openjpa.ee.WASRegistryManagedRuntime in versions before 2.9.10.4. The target version 2.12.2 already contains the upstream fix (line 84 of SubTypeValidator.java) that was authored by Tatu Saloranta (upstream maintainer) on 2020-03-28 in commit e2ba12d5d60. This fix was part of the upstream 2.12.2 release when TuxCare onboarded it via commit 85cad3c84721 (\"Onboard version 2.12.2\"). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 does not affect jackson-databind 2.12.2-tuxcare.3. The vulnerability concerns the missing blacklist entry for org.apache.openjpa.ee.WASRegistryManagedRuntime in versions before 2.9.10.4. The target version 2.12.2 already contains the upstream fix (line 84 of SubTypeValidator.java) that was authored by Tatu Saloranta (upstream maintainer) on 2020-03-28 in commit e2ba12d5d60. This fix was part of the upstream 2.12.2 release when TuxCare onboarded it via commit 85cad3c84721 (\"Onboard version 2.12.2\"). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is not present in jackson-databind 2.12.2. The vulnerability involves deserialization gadgets in Spring AOP classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean) that could lead to arbitrary code execution. The fix (commit 113e89fb08) adds these classes to SubTypeValidator's blocklist and was already present in the upstream jackson-databind 2.12.2 release that TuxCare onboarded. The target version 2.12.2 is after the fixed version 2.9.10.4 mentioned in the CVE, and the blocklist entries are verified present and enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 is not present in jackson-databind 2.12.2. The vulnerability involves deserialization gadgets in Spring AOP classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean) that could lead to arbitrary code execution. The fix (commit 113e89fb08) adds these classes to SubTypeValidator's blocklist and was already present in the upstream jackson-databind 2.12.2 release that TuxCare onboarded. The target version 2.12.2 is after the fixed version 2.9.10.4 mentioned in the CVE, and the blocklist entries are verified present and enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.2-tuxcare.3) is not affected by CVE-2020-11620. The vulnerability was fixed in upstream version 2.9.10.4 by adding \"org.apache.commons.jelly.impl.Embedded\" to the deserialization blacklist in SubTypeValidator.java. The target version 2.12.2 already contains this fix from the upstream release. The fix commit (77040d85e3) was authored by upstream maintainer Tatu Saloranta and was included in the upstream 2.12.2 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "The target repository (jackson-databind 2.12.2-tuxcare.3) is not affected by CVE-2020-11620. The vulnerability was fixed in upstream version 2.9.10.4 by adding \"org.apache.commons.jelly.impl.Embedded\" to the deserialization blacklist in SubTypeValidator.java. The target version 2.12.2 already contains this fix from the upstream release. The fix commit (77040d85e3) was authored by upstream maintainer Tatu Saloranta and was included in the upstream 2.12.2 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not present in jackson-databind 2.12.2. The vulnerability affects versions before 2.9.10.5, which was released in June 2020. The target version 2.12.2 was released in March 2021, nearly a year after the fix was committed (April 2020). The fix - adding blacklist entries for oadd.org.apache.xalan.lib.sql.JNDIConnectionPool and related classes - is present in SubTypeValidator.java lines 191-195. This fix came with the upstream 2.12.2 release, not from a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 is not present in jackson-databind 2.12.2. The vulnerability affects versions before 2.9.10.5, which was released in June 2020. The target version 2.12.2 was released in March 2021, nearly a year after the fix was committed (April 2020). The fix - adding blacklist entries for oadd.org.apache.xalan.lib.sql.JNDIConnectionPool and related classes - is present in SubTypeValidator.java lines 191-195. This fix came with the upstream 2.12.2 release, not from a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 addresses deserialization gadget classes in Oracle JMS (oracle.jms.AQjms* classes) that could be exploited for remote code execution. The fix adds these five Oracle JMS classes to Jackson's SubTypeValidator blocklist. The target version jackson-databind 2.12.2-tuxcare.3 is NOT vulnerable because the fix was already present in the upstream 2.12.2 release (March 3, 2021). The fix commit 5c8642aeae (April 24, 2020) by upstream author Tatu Saloranta predates the 2.12.2 release and is confirmed present in SubTypeValidator.java lines 200-204.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 addresses deserialization gadget classes in Oracle JMS (oracle.jms.AQjms* classes) that could be exploited for remote code execution. The fix adds these five Oracle JMS classes to Jackson's SubTypeValidator blocklist. The target version jackson-databind 2.12.2-tuxcare.3 is NOT vulnerable because the fix was already present in the upstream 2.12.2 release (March 3, 2021). The fix commit 5c8642aeae (April 24, 2020) by upstream author Tatu Saloranta predates the 2.12.2 release and is confirmed present in SubTypeValidator.java lines 200-204.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.2 is not affected by CVE-2020-14062. The upstream fix commit 840eae2ca81c597a0010b2126f32dce17d384b70 was already present in the upstream release before TuxCare onboarded version 2.12.2. The gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is blocked in SubTypeValidator.java at line 119, preventing deserialization attacks via this gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "Target version 2.12.2 is not affected by CVE-2020-14062. The upstream fix commit 840eae2ca81c597a0010b2126f32dce17d384b70 was already present in the upstream release before TuxCare onboarded version 2.12.2. The gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is blocked in SubTypeValidator.java at line 119, preventing deserialization attacks via this gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability concerns a deserialization gadget (org.jsecurity.realm.jndi.JndiRealmFactory) that allows arbitrary code execution via JSON with polymorphic type information. The upstream vendor (FasterXML) fixed this in commit f6d9c664f6 by adding the malicious class to the SubTypeValidator blocklist. This fix was already present in upstream release 2.12.2 when TuxCare onboarded it (first TuxCare commit: 85cad3c84721d150a0f900c902222ad722075526 \"Onboard version 2.12.2\"). The target contains the defense at SubTypeValidator.java:207.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability concerns a deserialization gadget (org.jsecurity.realm.jndi.JndiRealmFactory) that allows arbitrary code execution via JSON with polymorphic type information. The upstream vendor (FasterXML) fixed this in commit f6d9c664f6 by adding the malicious class to the SubTypeValidator blocklist. This fix was already present in upstream release 2.12.2 when TuxCare onboarded it (first TuxCare commit: 85cad3c84721d150a0f900c902222ad722075526 \"Onboard version 2.12.2\"). The target contains the defense at SubTypeValidator.java:207.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6. The target version 2.12.2 already contains the upstream fix that blacklists br.com.anteros.dbcp.AnterosDBCPDataSource in SubTypeValidator.java (line 147). The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.12.2. The vulnerable deserialization gadget pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6. The target version 2.12.2 already contains the upstream fix that blacklists br.com.anteros.dbcp.AnterosDBCPDataSource in SubTypeValidator.java (line 147). The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.12.2. The vulnerable deserialization gadget pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 affects jackson-databind versions before 2.9.10.6, targeting the deserialization gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration. The target version 2.12.2-tuxcare.3 is NOT vulnerable because the upstream fix (commit 6cc9f1a1af by Tatu Saloranta, 2020-07-20) was already present in the upstream 2.12.2 release before TuxCare onboarded it. The fix adds the gadget class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 210, which causes Jackson to reject deserialization attempts with \"Illegal type to deserialize: prevented for security reasons\". The validator is invoked automatically during bean deserialization (BeanDeserializerFactory.java:140) with no bypass mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 affects jackson-databind versions before 2.9.10.6, targeting the deserialization gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration. The target version 2.12.2-tuxcare.3 is NOT vulnerable because the upstream fix (commit 6cc9f1a1af by Tatu Saloranta, 2020-07-20) was already present in the upstream 2.12.2 release before TuxCare onboarded it. The fix adds the gadget class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 210, which causes Jackson to reject deserialization attempts with \"Illegal type to deserialize: prevented for security reasons\". The validator is invoked automatically during bean deserialization (BeanDeserializerFactory.java:140) with no bypass mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in jackson-databind 2.12.2-tuxcare.3. The upstream vendor (Tatu Saloranta) fixed this vulnerability in January 2020 by adding two XML security features to prevent DOCTYPE declarations and external DTD loading. This fix was already included in the upstream 2.12.2 release (March 2021) when TuxCare onboarded it. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in jackson-databind 2.12.2-tuxcare.3. The upstream vendor (Tatu Saloranta) fixed this vulnerability in January 2020 by adding two XML security features to prevent DOCTYPE declarations and external DTD loading. This fix was already included in the upstream 2.12.2 release (March 2021) when TuxCare onboarded it. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 is not present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves missing blocklist entries for Apache Commons DBCP2 datasource classes (PerUserPoolDataSource, SharedPoolDataSource) that could be exploited as deserialization gadgets. The fix was already present in the upstream 2.12.2 release (committed Dec 15, 2020 by Tatu Saloranta, released Mar 3, 2021) before TuxCare onboarded this version (Sep 10, 2026). Lines 216-219 of SubTypeValidator.java contain the required blocklist entries that prevent deserialization of these dangerous types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "CVE-2020-35490 is not present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves missing blocklist entries for Apache Commons DBCP2 datasource classes (PerUserPoolDataSource, SharedPoolDataSource) that could be exploited as deserialization gadgets. The fix was already present in the upstream 2.12.2 release (committed Dec 15, 2020 by Tatu Saloranta, released Mar 3, 2021) before TuxCare onboarded this version (Sep 10, 2026). Lines 216-219 of SubTypeValidator.java contain the required blocklist entries that prevent deserialization of these dangerous types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for dangerous deserialization gadgets (org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource). The target repository (jackson-databind 2.12.2-tuxcare.3) contains the upstream fix (commit 41b8bdb5cc) that was shipped in the upstream 2.12.2 release. The fix adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, which is automatically enforced during deserialization via BeanDeserializerFactory. Since the fix was authored by the upstream vendor (Tatu Saloranta) and was already present when TuxCare onboarded version 2.12.2, this is classified as an upstream fix that shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for dangerous deserialization gadgets (org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource). The target repository (jackson-databind 2.12.2-tuxcare.3) contains the upstream fix (commit 41b8bdb5cc) that was shipped in the upstream 2.12.2 release. The fix adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, which is automatically enforced during deserialization via BeanDeserializerFactory. Since the fix was authored by the upstream vendor (Tatu Saloranta) and was already present when TuxCare onboarded version 2.12.2, this is classified as an upstream fix that shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves deserialization of the malicious gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool which enables JNDI injection attacks. The fix (adding this class to the deserialization blocklist) was authored by upstream maintainer Tatu Saloranta in commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 and was already present in the upstream jackson-databind 2.12.2 release when TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:240 and is properly enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves deserialization of the malicious gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool which enables JNDI injection attacks. The fix (adding this class to the deserialization blocklist) was authored by upstream maintainer Tatu Saloranta in commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 and was already present in the upstream jackson-databind 2.12.2 release when TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:240 and is properly enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is not present in jackson-databind 2.12.2-tuxcare.3. The vulnerability relates to missing blocklist entries for DriverAdapterCPDS gadget classes in the SubTypeValidator. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta on 2020-12-31) added these classes to the deserialization blocklist and was already included in the upstream 2.12.2 release (tagged 2021-03-03). When TuxCare onboarded version 2.12.2 on 2026-09-10, this fix was already present. The target code contains all required blocklist entries including the specifically-mentioned `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` at line 193 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 is not present in jackson-databind 2.12.2-tuxcare.3. The vulnerability relates to missing blocklist entries for DriverAdapterCPDS gadget classes in the SubTypeValidator. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta on 2020-12-31) added these classes to the deserialization blocklist and was already included in the upstream 2.12.2 release (tagged 2021-03-03). When TuxCare onboarded version 2.12.2 on 2026-09-10, this fix was already present. The target code contains all required blocklist entries including the specifically-mentioned `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` at line 193 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is NOT present in jackson-databind 2.12.2-tuxcare.3. The upstream fix (commit 3ded28aece) blocking DriverAdapterCPDS deserialization gadgets was already included in the base 2.12.2 release that TuxCare onboarded. All five DriverAdapterCPDS class variants are present in SubTypeValidator's blocklist, preventing exploitation via polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 is NOT present in jackson-databind 2.12.2-tuxcare.3. The upstream fix (commit 3ded28aece) blocking DriverAdapterCPDS deserialization gadgets was already included in the base 2.12.2 release that TuxCare onboarded. All five DriverAdapterCPDS class variants are present in SubTypeValidator's blocklist, preventing exploitation via polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involved unsafe deserialization of the `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS` class and related DBCP gadget classes. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their instantiation during deserialization. This fix was already included in upstream version 2.12.2 before TuxCare onboarded it (first TuxCare commit: 85cad3c84721d150a0f900c902222ad722075526). The target repository contains all blocklist entries from the patch at SubTypeValidator.java lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involved unsafe deserialization of the `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS` class and related DBCP gadget classes. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their instantiation during deserialization. This fix was already included in upstream version 2.12.2 before TuxCare onboarded it (first TuxCare commit: 85cad3c84721d150a0f900c902222ad722075526). The target repository contains all blocklist entries from the patch at SubTypeValidator.java lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves unsafe deserialization of org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP gadget classes. The fix (commit 3ded28a by upstream maintainer Tatu Saloranta, Dec 31 2020) adds these classes to jackson-databind's deserialization blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.12.2 release before TuxCare onboarded it (commit 85cad3c847, \"Onboard version 2.12.2\"). The blocklist entries are present at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, preventing deserialization of all DBCP gadget variants.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves unsafe deserialization of org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP gadget classes. The fix (commit 3ded28a by upstream maintainer Tatu Saloranta, Dec 31 2020) adds these classes to jackson-databind's deserialization blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.12.2 release before TuxCare onboarded it (commit 85cad3c847, \"Onboard version 2.12.2\"). The blocklist entries are present at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, preventing deserialization of all DBCP gadget variants.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not present in jackson-databind 2.12.2-tuxcare.3. The gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool is already blocked in the deserialization blocklist (SubTypeValidator.java:243). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29 and shipped in the upstream 2.12.2 release, before TuxCare onboarded this version. The vulnerable code pattern (unblocked JNDI gadget deserialization) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 is not present in jackson-databind 2.12.2-tuxcare.3. The gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool is already blocked in the deserialization blocklist (SubTypeValidator.java:243). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29 and shipped in the upstream 2.12.2 release, before TuxCare onboarded this version. The vulnerable code pattern (unblocked JNDI gadget deserialization) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. The target version 2.12.2-tuxcare.3 is NOT vulnerable because the upstream fix (commit 567194c53a) was already included in the upstream jackson-databind 2.12.2 release before TuxCare onboarded it. The fix adds two class names to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing deserialization of the dangerous gadget classes. This is an upstream-authored fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. The target version 2.12.2-tuxcare.3 is NOT vulnerable because the upstream fix (commit 567194c53a) was already included in the upstream jackson-databind 2.12.2 release before TuxCare onboarded it. The fix adds two class names to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing deserialization of the dangerous gadget classes. This is an upstream-authored fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. The target version 2.12.2-tuxcare.3 is NOT affected because the upstream fix (commit 567194c53a by Tatu Saloranta, dated Dec 26, 2020) was already included in the upstream 2.12.2 release that TuxCare onboarded. The fix adds SharedPoolDataSource to the SubTypeValidator blacklist, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. The target version 2.12.2-tuxcare.3 is NOT affected because the upstream fix (commit 567194c53a by Tatu Saloranta, dated Dec 26, 2020) was already included in the upstream 2.12.2 release that TuxCare onboarded. The fix adds SharedPoolDataSource to the SubTypeValidator blacklist, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is NOT affecting jackson-databind 2.12.2-tuxcare.3. The vulnerability involves deserialization of malicious gadget classes org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. These classes are blacklisted in SubTypeValidator.java (lines 229-230), preventing their deserialization. The fix (commit 3e8fa3beea) was authored by upstream maintainer Tatu Saloranta and was already present in upstream release 2.12.2, which TuxCare onboarded. The target repository contains the complete fix from the upstream vendor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 is NOT affecting jackson-databind 2.12.2-tuxcare.3. The vulnerability involves deserialization of malicious gadget classes org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. These classes are blacklisted in SubTypeValidator.java (lines 229-230), preventing their deserialization. The fix (commit 3e8fa3beea) was authored by upstream maintainer Tatu Saloranta and was already present in upstream release 2.12.2, which TuxCare onboarded. The target repository contains the complete fix from the upstream vendor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.2 is not affected by CVE-2020-36187. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta) was already included in the upstream 2.12.2 release that TuxCare onboarded. The vulnerable pattern (ability to deserialize org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource) is not present because this class is blocked in the DEFAULT_NO_DESER_CLASS_NAMES blacklist at SubTypeValidator.java:230.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "Target version 2.12.2 is not affected by CVE-2020-36187. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta) was already included in the upstream 2.12.2 release that TuxCare onboarded. The vulnerable pattern (ability to deserialize org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource) is not present because this class is blocked in the DEFAULT_NO_DESER_CLASS_NAMES blacklist at SubTypeValidator.java:230.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is not present in jackson-databind 2.12.2-tuxcare.3. The vulnerability relates to unsafe deserialization of two newrelic gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) that could lead to arbitrary code execution. The upstream vendor fix (commit 33d96c13fe) added these classes to the deserialization blacklist in SubTypeValidator.java and was included in the upstream jackson-databind 2.12.2 release that TuxCare onboarded. The defense is active and functional in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 is not present in jackson-databind 2.12.2-tuxcare.3. The vulnerability relates to unsafe deserialization of two newrelic gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) that could lead to arbitrary code execution. The upstream vendor fix (commit 33d96c13fe) added these classes to the deserialization blacklist in SubTypeValidator.java and was included in the upstream jackson-databind 2.12.2 release that TuxCare onboarded. The defense is active and functional in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is NOT present in jackson-databind 2.12.2. The vulnerability involves deserialization gadgets related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource. The fix (adding these classes to SubTypeValidator's blacklist) was committed upstream by Tatu Saloranta on Dec 26, 2020 (commit 33d96c13fe) and was already included in the upstream jackson-databind 2.12.2 release. TuxCare onboarded this version with the fix already present. The target code at lines 221-224 of SubTypeValidator.java contains the protective blacklist entries that prevent deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is NOT present in jackson-databind 2.12.2. The vulnerability involves deserialization gadgets related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource. The fix (adding these classes to SubTypeValidator's blacklist) was committed upstream by Tatu Saloranta on Dec 26, 2020 (commit 33d96c13fe) and was already included in the upstream jackson-databind 2.12.2 release. TuxCare onboarded this version with the fix already present. The target code at lines 221-224 of SubTypeValidator.java contains the protective blacklist entries that prevent deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.2-tuxcare.3) is NOT affected by CVE-2020-8840. The vulnerability concerns missing blocklist entries for org.apache.xbean.propertyeditor.JndiConverter, which enables JNDI injection attacks via polymorphic deserialization. The upstream fix (commit 914e7c9f2cb by Tatu Saloranta, 2020-02-09) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist was already included in the upstream jackson-databind 2.12.2 release. This fix is present at line 138 of SubTypeValidator.java in the target, preventing deserialization of the malicious gadget class. Since the fix was authored by the upstream maintainer and shipped in the base release (not backported by TuxCare), the verdict is not_affected with upstream fix attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "The target repository (jackson-databind 2.12.2-tuxcare.3) is NOT affected by CVE-2020-8840. The vulnerability concerns missing blocklist entries for org.apache.xbean.propertyeditor.JndiConverter, which enables JNDI injection attacks via polymorphic deserialization. The upstream fix (commit 914e7c9f2cb by Tatu Saloranta, 2020-02-09) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist was already included in the upstream jackson-databind 2.12.2 release. This fix is present at line 138 of SubTypeValidator.java in the target, preventing deserialization of the malicious gadget class. Since the fix was authored by the upstream maintainer and shipped in the base release (not backported by TuxCare), the verdict is not_affected with upstream fix attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind 2.x before 2.9.10.4. The target version 2.12.2-tuxcare.3 contains the upstream fix (commit 1e64db6a2f) that adds org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to the SubTypeValidator blocklist. This fix was already present in the upstream 2.12.2 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (85cad3c84721d150a0f900c902222ad722075526, \"Onboard version 2.12.2\"). The vulnerable gadget class cannot be deserialized due to the blocklist enforcement in SubTypeValidator.validateSubType() at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 affects jackson-databind 2.x before 2.9.10.4. The target version 2.12.2-tuxcare.3 contains the upstream fix (commit 1e64db6a2f) that adds org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to the SubTypeValidator blocklist. This fix was already present in the upstream 2.12.2 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (85cad3c84721d150a0f900c902222ad722075526, \"Onboard version 2.12.2\"). The vulnerable gadget class cannot be deserialized due to the blocklist enforcement in SubTypeValidator.validateSubType() at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to deserialization gadgets related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target repository is jackson-databind version 2.12.2-tuxcare.3, which already contains the upstream fix. The vulnerable class is blocked in SubTypeValidator.java line 144, preventing its deserialization. This fix was included in the upstream jackson-databind 2.12.2 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta on 2020-02-29.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to deserialization gadgets related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target repository is jackson-databind version 2.12.2-tuxcare.3, which already contains the upstream fix. The vulnerable class is blocked in SubTypeValidator.java line 144, preventing its deserialization. This fix was included in the upstream jackson-databind 2.12.2 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta on 2020-02-29.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is not present in jackson-databind 2.12.2-tuxcare.3. The vulnerability concerns unsafe deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The target contains the upstream vendor's fix (blocklist entry at SubTypeValidator.java:145) which prevents deserialization of this class. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commit 9f4e97019fb0dd836533d0b6198c88787e235ae2 and shipped with the upstream jackson-databind 2.12.2 release, prior to TuxCare onboarding commit 85cad3c8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 is not present in jackson-databind 2.12.2-tuxcare.3. The vulnerability concerns unsafe deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The target contains the upstream vendor's fix (blocklist entry at SubTypeValidator.java:145) which prevents deserialization of this class. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commit 9f4e97019fb0dd836533d0b6198c88787e235ae2 and shipped with the upstream jackson-databind 2.12.2 release, prior to TuxCare onboarding commit 85cad3c8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves deserialization gadget classes (javax.swing.JTextPane and others) that can be exploited for arbitrary code execution. The fix, which adds these dangerous classes to a denylist in SubTypeValidator.java, was already included in the upstream Jackson 2.12.2 release that TuxCare onboarded. The dangerous classes are blocked at lines 149-214 of SubTypeValidator.java, and the validation is properly integrated into the deserialization path via BeanDeserializerFactory. Fix commits 7dbf51bf78 and 08fbfacf89 are ancestors of HEAD and predate TuxCare's first commit (85cad3c84), confirming this is an upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.12.2-tuxcare.3. The vulnerability involves deserialization gadget classes (javax.swing.JTextPane and others) that can be exploited for arbitrary code execution. The fix, which adds these dangerous classes to a denylist in SubTypeValidator.java, was already included in the upstream Jackson 2.12.2 release that TuxCare onboarded. The dangerous classes are blocked at lines 149-214 of SubTypeValidator.java, and the validation is properly integrated into the deserialization path via BeanDeserializerFactory. Fix commits 7dbf51bf78 and 08fbfacf89 are ancestors of HEAD and predate TuxCare's first commit (85cad3c84), confirming this is an upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 affects version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "action_statement": "Vulnerability CVE-2022-42004 affects version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.12.2-tuxcare.3 is NOT affected by CVE-2026-54517. The vulnerability requires a specific code change (Jackson issue #5237) that routes setterless collection/map properties through the merging buffer path during property-based creator deserialization. This change was introduced in version 2.20.0-rc2-SNAPSHOT (August 2025) and is not present in the 2.12.2 codebase. Without this prerequis...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Version 2.12.2-tuxcare.3 is NOT affected by CVE-2026-54517. The vulnerability requires a specific code change (Jackson issue #5237) that routes setterless collection/map properties through the merging buffer path during property-based creator deserialization. This change was introduced in version 2.20.0-rc2-SNAPSHOT (August 2025) and is not present in the 2.12.2 codebase. Without this prerequis..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.12.2-tuxcare.3 is not affected by CVE-2026-54518. The vulnerability requires unwrapped creator parameter support, which was introduced in jackson-databind 2.19 and fixed in 2.21.4/3.1.4. Version 2.12.2 explicitly rejects the @JsonUnwrapped + @JsonCreator combination with an InvalidDefinitionException. The vulnerable method `processUnwrappedCreatorProperties()` does not exist in this v...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.12.2-tuxcare.3 is not affected by CVE-2026-54518. The vulnerability requires unwrapped creator parameter support, which was introduced in jackson-databind 2.19 and fixed in 2.21.4/3.1.4. Version 2.12.2 explicitly rejects the @JsonUnwrapped + @JsonCreator combination with an InvalidDefinitionException. The vulnerable method `processUnwrappedCreatorProperties()` does not exist in this v..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.12.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:18:15.059040+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.12.2-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}