{ "@id": "urn:uuid:adfc07d5-2c2f-4aef-aca5-189eda7bc8b7", "role": "Document Creator", "author": "https://tuxcare.com", "version": 75, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T09:58:52.142537+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:09:44.726673+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4 (released 2017-2018). The target version 2.12.6.1 (released March 2022) is 4+ years newer and already contains the upstream fixes. The SubTypeValidator class includes all blacklisted classes from the CVE patches (com.sun.rowset.JdbcRowSetImpl, java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring/C3P0 types). The validation is active and called during bean deserialization. The fixes shipped in the upstream Jackson release f758e50f0e, not via TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4 (released 2017-2018). The target version 2.12.6.1 (released March 2022) is 4+ years newer and already contains the upstream fixes. The SubTypeValidator class includes all blacklisted classes from the CVE patches (com.sun.rowset.JdbcRowSetImpl, java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring/C3P0 types). The validation is active and called during bean deserialization. The fixes shipped in the upstream Jackson release f758e50f0e, not via TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:45:35.958455+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.6.1-tuxcare.3 is NOT AFFECTED by CVE-2017-17485. The comprehensive fix (SubTypeValidator with blacklist validation for dangerous deserialization gadget classes) was authored by upstream FasterXML contributors (Tatu Saloranta, Andrew Tolbert) and shipped in the upstream release 2.12.6.1 that TuxCare onboarded. The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "Target version 2.12.6.1-tuxcare.3 is NOT AFFECTED by CVE-2017-17485. The comprehensive fix (SubTypeValidator with blacklist validation for dangerous deserialization gadget classes) was authored by upstream FasterXML contributors (Tatu Saloranta, Andrew Tolbert) and shipped in the upstream release 2.12.6.1 that TuxCare onboarded. The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:28:36.636935+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.6.1-tuxcare.3 is NOT affected by CVE-2017-7525. The vulnerability (arbitrary code execution via deserialization of dangerous classes like TemplatesImpl, InvokerTransformer) was fixed in the upstream release through SubTypeValidator, which blocks all dangerous classes identified in the CVE. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 2235894210c on Dec 18, 2017, and shipped in upstream version 2.8.11, which is well before the target's base version 2.12.6.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "The target jackson-databind 2.12.6.1-tuxcare.3 is NOT affected by CVE-2017-7525. The vulnerability (arbitrary code execution via deserialization of dangerous classes like TemplatesImpl, InvokerTransformer) was fixed in the upstream release through SubTypeValidator, which blocks all dangerous classes identified in the CVE. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 2235894210c on Dec 18, 2017, and shipped in upstream version 2.8.11, which is well before the target's base version 2.12.6.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:19:28.539186+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves using Jackson default typing with the iBatis XPathParser gadget class to exfiltrate data. The fix adds \"org.apache.ibatis.parsing.XPathParser\" to the deserialization blacklist in SubTypeValidator.java. This fix is already present in the target at line 65, introduced by upstream commit 27b4defc270454dea6842bd9279f17387eceb737 authored by Tatu Saloranta. The fix shipped in the upstream release 2.12.6.1 that TuxCare onboarded, making this an upstream-provided fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves using Jackson default typing with the iBatis XPathParser gadget class to exfiltrate data. The fix adds \"org.apache.ibatis.parsing.XPathParser\" to the deserialization blacklist in SubTypeValidator.java. This fix is already present in the target at line 65, introduced by upstream commit 27b4defc270454dea6842bd9279f17387eceb737 authored by Tatu Saloranta. The fix shipped in the upstream release 2.12.6.1 that TuxCare onboarded, making this an upstream-provided fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T17:19:24.126381+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target (jackson-databind 2.12.6.1-tuxcare.3) is not affected by CVE-2018-12022. The vulnerability allows arbitrary code execution via polymorphic deserialization of Jodd-db gadget classes when Default Typing is enabled. The fix (blocklisting jodd.db.connection.DataSourceConnectionProvider and related Oracle JDBC classes) was implemented by upstream maintainer Tatu Saloranta in commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a and was already present in upstream version 2.12.6.1 before TuxCare onboarded it. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "The target (jackson-databind 2.12.6.1-tuxcare.3) is not affected by CVE-2018-12022. The vulnerability allows arbitrary code execution via polymorphic deserialization of Jodd-db gadget classes when Default Typing is enabled. The fix (blocklisting jodd.db.connection.DataSourceConnectionProvider and related Oracle JDBC classes) was implemented by upstream maintainer Tatu Saloranta in commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a and was already present in upstream version 2.12.6.1 before TuxCare onboarded it. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:21:06.039557+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target repository is jackson-databind version 2.12.6.1-tuxcare.3, which is significantly newer. The vulnerability involves unrestricted deserialization of Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled, allowing JNDI/LDAP injection attacks. The fix (blacklisting these classes in SubTypeValidator) was introduced by upstream maintainer Tatu Saloranta in commit 28badf7ef60 and was already present in the upstream jackson-databind 2.12.6.1 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target repository is jackson-databind version 2.12.6.1-tuxcare.3, which is significantly newer. The vulnerability involves unrestricted deserialization of Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled, allowing JNDI/LDAP injection attacks. The fix (blacklisting these classes in SubTypeValidator) was introduced by upstream maintainer Tatu Saloranta in commit 28badf7ef60 and was already present in the upstream jackson-databind 2.12.6.1 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:52:02.256694+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The fix that blocks org.slf4j.ext.EventData and other dangerous classes from polymorphic deserialization was already included in the upstream jackson-databind 2.12.6.1 release (commit 87d29af by Tatu Saloranta) when TuxCare onboarded this version. The blacklist in SubTypeValidator.java (lines 74-78) includes all four classes from the CVE-2018-14718 patch, and the validation is actively enforced during bean deserialization at BeanDeserializerFactory line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The fix that blocks org.slf4j.ext.EventData and other dangerous classes from polymorphic deserialization was already included in the upstream jackson-databind 2.12.6.1 release (commit 87d29af by Tatu Saloranta) when TuxCare onboarded this version. The blacklist in SubTypeValidator.java (lines 74-78) includes all four classes from the CVE-2018-14718 patch, and the validation is actively enforced during bean deserialization at BeanDeserializerFactory line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:01:11.316675+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is not present in jackson-databind 2.12.6.1. The vulnerability required blocking blaze-ds classes from polymorphic deserialization. The upstream fix (commit 87d29af25e) added \"flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor\" and related classes to the deserialization blacklist, and this fix was already present in the upstream release that TuxCare onboarded. The target contains the fix at SubTypeValidator.java lines 74-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 is not present in jackson-databind 2.12.6.1. The vulnerability required blocking blaze-ds classes from polymorphic deserialization. The upstream fix (commit 87d29af25e) added \"flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor\" and related classes to the deserialization blacklist, and this fix was already present in the upstream release that TuxCare onboarded. The target contains the fix at SubTypeValidator.java lines 74-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:08:25.826245+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.12.6.1-tuxcare.3 is NOT affected by CVE-2018-14720. The vulnerability involves four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE and other attacks via polymorphic deserialization. The upstream fix (commit 87d29af25e) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.12.6.1 release that TuxCare onboarded, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "The target repository jackson-databind 2.12.6.1-tuxcare.3 is NOT affected by CVE-2018-14720. The vulnerability involves four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE and other attacks via polymorphic deserialization. The upstream fix (commit 87d29af25e) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.12.6.1 release that TuxCare onboarded, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:38:19.408252+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is not present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability allows SSRF attacks via polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. The upstream fix (commit 87d29af25e) that blocks this class from deserialization was already present in release 2.12.6.1 before TuxCare onboarded it. The blocklist entry prevents the malicious class from being instantiated during JSON deserialization, blocking the SSRF attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 is not present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability allows SSRF attacks via polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. The upstream fix (commit 87d29af25e) that blocks this class from deserialization was already present in release 2.12.6.1 before TuxCare onboarded it. The blocklist entry prevents the malicious class from being instantiated during JSON deserialization, blocking the SSRF attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T12:49:38.434607+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is not present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability affects versions before 2.9.8, and the fix (commit 72cd4025a2) was shipped in upstream release 2.10.0+, well before the target version. The blocklist in SubTypeValidator.java line 85 contains the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo, preventing its deserialization. This defense is enforced unconditionally during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 is not present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability affects versions before 2.9.8, and the fix (commit 72cd4025a2) was shipped in upstream release 2.10.0+, well before the target version. The blocklist in SubTypeValidator.java line 85 contains the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo, preventing its deserialization. This defense is enforced unconditionally during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:56:42.390113+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is not present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that could lead to code execution. The fix was implemented by FasterXML upstream in commit 72cd4025a2 (authored by tatu.saloranta@iki.fi) and shipped in the upstream release that TuxCare onboarded. The target contains the fix: openjpa classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (SubTypeValidator.java lines 82-84), preventing their deserialization. The blocklist is enforced via SubTypeValidator.instance().validateSubType() called by BeanDeserializerFactory during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 is not present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that could lead to code execution. The fix was implemented by FasterXML upstream in commit 72cd4025a2 (authored by tatu.saloranta@iki.fi) and shipped in the upstream release that TuxCare onboarded. The target contains the fix: openjpa classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (SubTypeValidator.java lines 82-84), preventing their deserialization. The blocklist is enforced via SubTypeValidator.instance().validateSubType() called by BeanDeserializerFactory during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:25:11.271555+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 concerns polymorphic deserialization gadgets (jboss-common-core class \"org.jboss.util.propertyeditor.DocumentEditor\" and three others) that jackson-databind must block. The target repository jackson-databind 2.12.6.1-tuxcare.3 already contains the upstream fix (commit 72cd4025a2 by Tatu Saloranta) that adds these four class names to the SubTypeValidator blocklist. The fix was present in the upstream 2.12.6.1 release before TuxCare onboarded it, making this an upstream fix rather than a TuxCare backport. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 concerns polymorphic deserialization gadgets (jboss-common-core class \"org.jboss.util.propertyeditor.DocumentEditor\" and three others) that jackson-databind must block. The target repository jackson-databind 2.12.6.1-tuxcare.3 already contains the upstream fix (commit 72cd4025a2 by Tatu Saloranta) that adds these four class names to the SubTypeValidator blocklist. The fix was present in the upstream 2.12.6.1 release before TuxCare onboarded it, making this an upstream fix rather than a TuxCare backport. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.12.6.1. The vulnerability affected versions through 2.8.11 and 2.9.x through 2.9.3, exploitable via two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed the existing deserialization blacklist. The upstream fix (commit 038b471e2e, January 2018) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix was already present in upstream release 2.8.11.1 and all subsequent versions. Target version 2.12.6.1, onboarded by TuxCare in September 2026, inherited this fix from upstream. Both blacklist entries are confirmed present at SubTypeValidator.java lines 62-63.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.12.6.1. The vulnerability affected versions through 2.8.11 and 2.9.x through 2.9.3, exploitable via two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed the existing deserialization blacklist. The upstream fix (commit 038b471e2e, January 2018) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix was already present in upstream release 2.8.11.1 and all subsequent versions. Target version 2.12.6.1, onboarded by TuxCare in September 2026, inherited this fix from upstream. Both blacklist entries are confirmed present at SubTypeValidator.java lines 62-63.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:49:07.796693+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind version 2.12.6.1) is NOT affected by CVE-2018-7489. The vulnerability involved incomplete blocking of c3p0 gadget classes in Jackson's polymorphic deserialization. The fix (commit 6799f8f10c) was applied in upstream version 2.7.9.3 (February 2018) and is present in the target code at SubTypeValidator.java lines 288-298, which blocks all classes starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\". The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded, not backported by TuxCare. CVE-2018-7489 affects versions before 2.9.5; the target version 2.12.6.1 is substantially later and includes the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "The target repository (jackson-databind version 2.12.6.1) is NOT affected by CVE-2018-7489. The vulnerability involved incomplete blocking of c3p0 gadget classes in Jackson's polymorphic deserialization. The fix (commit 6799f8f10c) was applied in upstream version 2.7.9.3 (February 2018) and is present in the target code at SubTypeValidator.java lines 288-298, which blocks all classes starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\". The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded, not backported by TuxCare. CVE-2018-7489 affects versions before 2.9.5; the target version 2.12.6.1 is substantially later and includes the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:33:25.157477+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves polymorphic deserialization of the com.mysql.cj.jdbc.admin.MiniAdmin class, which could allow arbitrary file reads when Default Typing is enabled and mysql-connector-java jar is in the classpath. The fix (adding MiniAdmin to the deserialization blacklist in SubTypeValidator.java) was already included in the upstream release 2.12.6.1 that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves polymorphic deserialization of the com.mysql.cj.jdbc.admin.MiniAdmin class, which could allow arbitrary file reads when Default Typing is enabled and mysql-connector-java jar is in the classpath. The fix (adding MiniAdmin to the deserialization blacklist in SubTypeValidator.java) was already included in the upstream release 2.12.6.1 that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-01T18:36:00.118354+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The fix for this vulnerability was already included in the upstream release 2.12.6.1 that TuxCare onboarded. The blocklist entry for 'ch.qos.logback.core.db.DriverManagerConnectionSource' is present in SubTypeValidator.java at line 91, preventing polymorphic deserialization of the dangerous logback-core class. The fix was aut...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The fix for this vulnerability was already included in the upstream release 2.12.6.1 that TuxCare onboarded. The blocklist entry for 'ch.qos.logback.core.db.DriverManagerConnectionSource' is present in SubTypeValidator.java at line 91, preventing polymorphic deserialization of the dangerous logback-core class. The fix was aut..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-02T07:16:00.084166+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.12.6.1 is NOT AFFECTED by CVE-2019-12814. The upstream vendor fix that blocks JDOM XSLTransformer classes from polymorphic deserialization was already present in the upstream release 2.7.9.6 (June 2019) and is included in all subsequent versions including 2.12.6.1. The fix commit (5f7c69bba07a7155adde130d9dee2e54a54f1fa5 by Tatu Saloranta) added org.jdom.transform....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 The target jackson-databind 2.12.6.1 is NOT AFFECTED by CVE-2019-12814. The upstream vendor fix that blocks JDOM XSLTransformer classes from polymorphic deserialization was already present in the upstream release 2.7.9.6 (June 2019) and is included in all subsequent versions including 2.12.6.1. The fix commit (5f7c69bba07a7155adde130d9dee2e54a54f1fa5 by Tatu Saloranta) added org.jdom.transform...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T12:11:13.395831+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379: The vulnerable deserialization pattern is not present in jackson-databind 2.12.6.1-tuxcare.3. The upstream fix (commit ad418eeb97 by Tatu Saloranta, July 2019) added net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blacklist in SubTypeValidator.java (line 98). This fix shipped in upstream release 2.12.6.1, which TuxCare subsequently onboarded. The target version (2.12.6.1) is significantly newer than the CVE's affected versions (before 2.9.9.2, 2.8.11.4, 2.7.9.6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379: The vulnerable deserialization pattern is not present in jackson-databind 2.12.6.1-tuxcare.3. The upstream fix (commit ad418eeb97 by Tatu Saloranta, July 2019) added net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blacklist in SubTypeValidator.java (line 98). This fix shipped in upstream release 2.12.6.1, which TuxCare subsequently onboarded. The target version (2.12.6.1) is significantly newer than the CVE's affected versions (before 2.9.9.2, 2.8.11.4, 2.7.9.6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:32:06.363098+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind version 2.12.6.1-tuxcare.3) is not affected by CVE-2019-14439. The vulnerability involves polymorphic typing allowing deserialization of dangerous logback classes (ch.qos.logback.core.db.JNDIConnectionSource) when Default Typing is enabled. The fix, which adds this class to a deserialization blocklist in SubTypeValidator.java, was implemented by upstream maintainer Tatu Saloranta in commit ad418eeb97 on July 25, 2019. This fix was already present in the upstream jackson-databind release that TuxCare onboarded on September 10, 2026 (commit 9f25905de4), approximately 7 years after the fix was applied. The blocklist entry is confirmed present at line 102 of SubTypeValidator.java, preventing exploitation of this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "The target repository (jackson-databind version 2.12.6.1-tuxcare.3) is not affected by CVE-2019-14439. The vulnerability involves polymorphic typing allowing deserialization of dangerous logback classes (ch.qos.logback.core.db.JNDIConnectionSource) when Default Typing is enabled. The fix, which adds this class to a deserialization blocklist in SubTypeValidator.java, was implemented by upstream maintainer Tatu Saloranta in commit ad418eeb97 on July 25, 2019. This fix was already present in the upstream jackson-databind release that TuxCare onboarded on September 10, 2026 (commit 9f25905de4), approximately 7 years after the fix was applied. The blocklist entry is confirmed present at line 102 of SubTypeValidator.java, preventing exploitation of this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:48:02.879946+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target version (2.12.6.1) is significantly newer and already contains the upstream vendor's fix. The dangerous classes com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (SubTypeValidator.java lines 105, 107), preventing their polymorphic deserialization. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commits d4983c740f and 73c1c2cc76, both of which were already in the upstream 2.12.6.1 release that TuxCare onboarded (commit 9f25905de4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target version (2.12.6.1) is significantly newer and already contains the upstream vendor's fix. The dangerous classes com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (SubTypeValidator.java lines 105, 107), preventing their polymorphic deserialization. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commits d4983c740f and 73c1c2cc76, both of which were already in the upstream 2.12.6.1 release that TuxCare onboarded (commit 9f25905de4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:56:28.365878+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.12.6.1 is NOT AFFECTED by CVE-2019-14892. The vulnerability allows polymorphic deserialization of malicious objects using commons-configuration JNDI classes to achieve arbitrary code execution. The vendor fix adds two class names (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) to a blocklist in SubTypeValidator.java. This fix is already present in the target at lines 112-114 of SubTypeValidator.java. The fix was authored by the upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 41b7f9b901 and was included in the upstream release 2.12.6.1 before TuxCare onboarded this version. The vulnerable code pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "The target repository jackson-databind version 2.12.6.1 is NOT AFFECTED by CVE-2019-14892. The vulnerability allows polymorphic deserialization of malicious objects using commons-configuration JNDI classes to achieve arbitrary code execution. The vendor fix adds two class names (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) to a blocklist in SubTypeValidator.java. This fix is already present in the target at lines 112-114 of SubTypeValidator.java. The fix was authored by the upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 41b7f9b901 and was included in the upstream release 2.12.6.1 before TuxCare onboarded this version. The vulnerable code pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is not present in jackson-databind 2.12.6.1-tuxcare.3. The upstream fix (commit 998efd7082) blocking the xalan JNDI gadget class was already included in the upstream release 2.12.6.1 that TuxCare onboarded. The vulnerable class \"org.apache.xalan.lib.sql.JNDIConnectionPool\" is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:117, and the validateSubType() method enforces this blocklist during polymorphic deserialization, preventing arbitrary code execution through this gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893 is not present in jackson-databind 2.12.6.1-tuxcare.3. The upstream fix (commit 998efd7082) blocking the xalan JNDI gadget class was already included in the upstream release 2.12.6.1 that TuxCare onboarded. The vulnerable class \"org.apache.xalan.lib.sql.JNDIConnectionPool\" is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:117, and the validateSubType() method enforces this blocklist during polymorphic deserialization, preventing arbitrary code execution through this gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T17:06:50.829153+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic typing vulnerability involving com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.12.6.1-tuxcare.3) is not affected because the fix was already present in the upstream release 2.12.6.1 that TuxCare onboarded. The upstream commit 73c1c2cc76e (authored by Tatu Saloranta on 2019-09-12) added HikariDataSource to the SubTypeValidator blacklist, preventing its use in polymorphic deserialization. This fix is present at line 107 of SubTypeValidator.java in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic typing vulnerability involving com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.12.6.1-tuxcare.3) is not affected because the fix was already present in the upstream release 2.12.6.1 that TuxCare onboarded. The upstream commit 73c1c2cc76e (authored by Tatu Saloranta on 2019-09-12) added HikariDataSource to the SubTypeValidator blacklist, preventing its use in polymorphic deserialization. This fix is present at line 107 of SubTypeValidator.java in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:05:45.890515+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind's polymorphic deserialization when Default Typing is enabled and commons-dbcp classes are in the classpath. The vulnerability allows attackers to execute malicious payloads via gadget classes: org.apache.commons.dbcp.datasources.SharedPoolDataSource, PerUserPoolDataSource, and com.p6spy.engine.spy.P6DataSource. The target repository (version 2.12.6.1-tuxcare.3) is NOT AFFECTED because the upstream vendor (Tatu Saloranta) already applied the fix in commit 9593e16cf5 before release 2.12.6.1 was published. The fix adds these three class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. This is an upstream fix that shipped in the release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 affects jackson-databind's polymorphic deserialization when Default Typing is enabled and commons-dbcp classes are in the classpath. The vulnerability allows attackers to execute malicious payloads via gadget classes: org.apache.commons.dbcp.datasources.SharedPoolDataSource, PerUserPoolDataSource, and com.p6spy.engine.spy.P6DataSource. The target repository (version 2.12.6.1-tuxcare.3) is NOT AFFECTED because the upstream vendor (Tatu Saloranta) already applied the fix in commit 9593e16cf5 before release 2.12.6.1 was published. The fix adds these three class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. This is an upstream fix that shipped in the release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T17:15:39.453186+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.12.6.1. The vulnerability concerns polymorphic deserialization gadgets (com.p6spy.engine.spy.P6DataSource and commons-dbcp DataSource classes) that allow arbitrary code execution when Default Typing is enabled. The upstream fix (commit 9593e16cf5) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in the upstream release 2.12.6.1 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (9f25905de4 \"Onboard version 2.12.6.1\"). The target version 2.12.6.1 is significantly newer than the affected versions (< 2.9.10.1, < 2.8.11.5, < 2.6.7.3), and the blocklist entries are present in SubTypeValidator.java lines 121-127.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.12.6.1. The vulnerability concerns polymorphic deserialization gadgets (com.p6spy.engine.spy.P6DataSource and commons-dbcp DataSource classes) that allow arbitrary code execution when Default Typing is enabled. The upstream fix (commit 9593e16cf5) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in the upstream release 2.12.6.1 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (9f25905de4 \"Onboard version 2.12.6.1\"). The target version 2.12.6.1 is significantly newer than the affected versions (< 2.9.10.1, < 2.8.11.5, < 2.6.7.3), and the blocklist entries are present in SubTypeValidator.java lines 121-127.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:28:54.426721+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.6.1-tuxcare.3 is NOT affected by CVE-2019-17267. The vulnerability involved polymorphic typing allowing deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The fix (adding this class to the SubTypeValidator blocklist) was already present in the upstream release 2.12.6.1 that TuxCare onboarded. The fix commit 191a4cdf87 was authored by upstream FasterXML maintainer Tatu Saloranta and predates TuxCare's onboarding commit 9f25905de4. The blocklist entry is present at line 98 of SubTypeValidator.java, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "The target jackson-databind version 2.12.6.1-tuxcare.3 is NOT affected by CVE-2019-17267. The vulnerability involved polymorphic typing allowing deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The fix (adding this class to the SubTypeValidator blocklist) was already present in the upstream release 2.12.6.1 that TuxCare onboarded. The fix commit 191a4cdf87 was authored by upstream FasterXML maintainer Tatu Saloranta and predates TuxCare's onboarding commit 9f25905de4. The blocklist entry is present at line 98 of SubTypeValidator.java, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:48:52.287276+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.12.6.1. The vulnerability allowed deserialization of dangerous log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource) leading to JNDI injection when Default Typing was enabled. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. This fix was already present in upstream release 2.12.6.1 that TuxCare onboarded (2421 commits before first TuxCare commit 9f25905de4). The blocklist check is enforced on the core deserialization path via BeanDeserializerFactory._validateSubType(), throwing an exception for blocked types. Target version contains the complete defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.12.6.1. The vulnerability allowed deserialization of dangerous log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource) leading to JNDI injection when Default Typing was enabled. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. This fix was already present in upstream release 2.12.6.1 that TuxCare onboarded (2421 commits before first TuxCare commit 9f25905de4). The blocklist check is enforced on the core deserialization path via BeanDeserializerFactory._validateSubType(), throwing an exception for blocked types. Target version contains the complete defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.6.1-tuxcare.3 is not affected by CVE-2019-20330. The vulnerability affects jackson-databind versions before 2.9.10.2 due to missing blocklist entries for two ehcache JNDI selector classes. The fix (adding these classes to the deserialization deny-list) was already present in upstream release 2.12.6.1, which TuxCare onboarded. Git analysis confirms the fix commit fc4214a883d by upstream author tatu.saloranta@iki.fi predates the TuxCare onboarding commit 9f25905de4. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "Target jackson-databind 2.12.6.1-tuxcare.3 is not affected by CVE-2019-20330. The vulnerability affects jackson-databind versions before 2.9.10.2 due to missing blocklist entries for two ehcache JNDI selector classes. The fix (adding these classes to the deserialization deny-list) was already present in upstream release 2.12.6.1, which TuxCare onboarded. Git analysis confirms the fix commit fc4214a883d by upstream author tatu.saloranta@iki.fi predates the TuxCare onboarding commit 9f25905de4. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T17:02:54.812243+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is not present in jackson-databind version 2.12.6.1-tuxcare.3 (SHA 493759f9aabf5d31be936a942a14b0e1f12dfcef). The fix for this vulnerability was already included in the upstream release 2.12.6.1 when TuxCare onboarded it. The SubTypeValidator.java file contains the required blacklist entries for ignite-jta gadget classes (CacheJndiTmLookup, CacheJndiTmFactory) and quartz-core (JNDIConnectionProvider) at lines 157-160. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit a424c038ba, which predates TuxCare's first commit (9f25905de4 \"Onboard version 2.12.6.1\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 is not present in jackson-databind version 2.12.6.1-tuxcare.3 (SHA 493759f9aabf5d31be936a942a14b0e1f12dfcef). The fix for this vulnerability was already included in the upstream release 2.12.6.1 when TuxCare onboarded it. The SubTypeValidator.java file contains the required blacklist entries for ignite-jta gadget classes (CacheJndiTmLookup, CacheJndiTmFactory) and quartz-core (JNDIConnectionProvider) at lines 157-160. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit a424c038ba, which predates TuxCare's first commit (9f25905de4 \"Onboard version 2.12.6.1\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.6.1-tuxcare.3) is not affected by CVE-2020-10672. The fix that blocks deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory was already present in the upstream release 2.12.6.1 when TuxCare onboarded it. The blocklist entries exist at SubTypeValidator.java lines 163-164, and the validation logic actively blocks deserialization attempts for these classes during bean deserialization (BeanDeserializerFactory.java:140 \u2192 SubTypeValidator.validateSubType:269). The vulnerable code pattern was never present in this shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "The target repository (jackson-databind 2.12.6.1-tuxcare.3) is not affected by CVE-2020-10672. The fix that blocks deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory was already present in the upstream release 2.12.6.1 when TuxCare onboarded it. The blocklist entries exist at SubTypeValidator.java lines 163-164, and the validation logic actively blocks deserialization attempts for these classes during bean deserialization (BeanDeserializerFactory.java:140 \u2192 SubTypeValidator.validateSubType:269). The vulnerable code pattern was never present in this shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:27:37.057480+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is not present in jackson-databind 2.12.6.1-tuxcare.3. The fix blocking deserialization of com.caucho.config.types.ResourceRef was already present in the upstream release 2.12.6.1 before TuxCare onboarded it. The blocklist entry exists at line 167 of SubTypeValidator.java and is properly enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 is not present in jackson-databind 2.12.6.1-tuxcare.3. The fix blocking deserialization of com.caucho.config.types.ResourceRef was already present in the upstream release 2.12.6.1 before TuxCare onboarded it. The blocklist entry exists at line 167 of SubTypeValidator.java and is properly enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 is not present in target version 2.12.6.1. The vulnerability, which concerns unsafe deserialization of org.aoju.bus.proxy.provider.remoting.RmiProvider gadget classes, has been mitigated by upstream jackson-databind. The SubTypeValidator.java file contains blocklist entries (lines 169-171) that prevent deserialization of both RmiProvider variants. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.12.6.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 is not present in target version 2.12.6.1. The vulnerability, which concerns unsafe deserialization of org.aoju.bus.proxy.provider.remoting.RmiProvider gadget classes, has been mitigated by upstream jackson-databind. The SubTypeValidator.java file contains blocklist entries (lines 169-171) that prevent deserialization of both RmiProvider variants. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.12.6.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.12.6.1-tuxcare.3 is NOT affected by CVE-2020-10969. The vulnerability involves deserialization of javax.swing.JEditorPane as a gadget chain attack vector. The upstream vendor fix (commit 4d038c9de0) added javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This fix was already present in the upstream jackson-databind 2.12.6.1 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (9f25905de4). The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "The target repository jackson-databind version 2.12.6.1-tuxcare.3 is NOT affected by CVE-2020-10969. The vulnerability involves deserialization of javax.swing.JEditorPane as a gadget chain attack vector. The upstream vendor fix (commit 4d038c9de0) added javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This fix was already present in the upstream jackson-databind 2.12.6.1 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (9f25905de4). The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.6.1-tuxcare.3) is not affected by CVE-2020-11111. The vulnerability concerns deserialization gadgets related to org.apache.activemq.* classes that could enable remote code execution through polymorphic type handling. However, the fix\u2014adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java\u2014was already present in the upstream release that TuxCare onboarded. Fix commit 08fbfacf89 (2020-09-23) is an ancestor of the TuxCare onboarding commit 9f25905de4, confirming the vulnerability was addressed upstream before TuxCare's involvement. All nine activemq classes from the vendor patches are present in the target's blocklist at lines 173-183.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "The target repository (jackson-databind 2.12.6.1-tuxcare.3) is not affected by CVE-2020-11111. The vulnerability concerns deserialization gadgets related to org.apache.activemq.* classes that could enable remote code execution through polymorphic type handling. However, the fix\u2014adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java\u2014was already present in the upstream release that TuxCare onboarded. Fix commit 08fbfacf89 (2020-09-23) is an ancestor of the TuxCare onboarding commit 9f25905de4, confirming the vulnerability was addressed upstream before TuxCare's involvement. All nine activemq classes from the vendor patches are present in the target's blocklist at lines 173-183.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in version 2.9.10.4 (commit 05d7e0e13f) by adding org.apache.commons.proxy.provider.remoting.RmiProvider to the deserialization blocklist. This fix was already included in the upstream 2.12.6.1 release that TuxCare onboarded. The target version is significantly later than the fixed version, and the protective blocklist entry is confirmed present at SubTypeValidator.java:186.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in version 2.9.10.4 (commit 05d7e0e13f) by adding org.apache.commons.proxy.provider.remoting.RmiProvider to the deserialization blocklist. This fix was already included in the upstream 2.12.6.1 release that TuxCare onboarded. The target version is significantly later than the fixed version, and the protective blocklist entry is confirmed present at SubTypeValidator.java:186.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime which could lead to remote code execution. The upstream vendor (Tatu Saloranta) fixed this by adding the class to the deserialization blocklist in SubTypeValidator.java (line 84). This fix was already present in the upstream release 2.12.6.1 before TuxCare onboarded it, making this an upstream fix rather than a TuxCare backport. The target version is not vulnerable because the dangerous class is blocked from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime which could lead to remote code execution. The upstream vendor (Tatu Saloranta) fixed this by adding the class to the deserialization blocklist in SubTypeValidator.java (line 84). This fix was already present in the upstream release 2.12.6.1 before TuxCare onboarded it, making this an upstream fix rather than a TuxCare backport. The target version is not vulnerable because the dangerous class is blocked from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The fix (commit 113e89fb08) that adds blocklist entries for org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean was authored by upstream maintainer Tatu Saloranta and was already included in jackson-databind 2.12.6.1 when TuxCare onboarded it (commit 9f25905de4). The blocklist entries are present in SubTypeValidator.java at lines 53-54, and the validation is mandatory (called at BeanDeserializerFactory line 140) with no bypass mechanism. This is an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The fix (commit 113e89fb08) that adds blocklist entries for org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean was authored by upstream maintainer Tatu Saloranta and was already included in jackson-databind 2.12.6.1 when TuxCare onboarded it (commit 9f25905de4). The blocklist entries are present in SubTypeValidator.java at lines 53-54, and the validation is mandatory (called at BeanDeserializerFactory line 140) with no bypass mechanism. This is an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is NOT present in jackson-databind 2.12.6.1. The vulnerability involves unsafe deserialization of the org.apache.commons.jelly.impl.Embedded gadget class. The upstream vendor (FasterXML) fixed this in commit 77040d85e3 by adding the dangerous class to the deserialization blocklist in SubTypeValidator.java (line 189). This fix was already present in the upstream release 2.12.6.1 that TuxCare onboarded, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 is NOT present in jackson-databind 2.12.6.1. The vulnerability involves unsafe deserialization of the org.apache.commons.jelly.impl.Embedded gadget class. The upstream vendor (FasterXML) fixed this in commit 77040d85e3 by adding the dangerous class to the deserialization blocklist in SubTypeValidator.java (line 189). This fix was already present in the upstream release 2.12.6.1 that TuxCare onboarded, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 does not affect jackson-databind 2.12.6.1-tuxcare.3. The vulnerability relates to unsafe deserialization of the gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` (and related classes) from Apache Drill, which could lead to remote code execution via JNDI injection. The fix was already present in the upstream 2.12.6.1 release that TuxCare onboarded. SubTypeValidator.java contains the required blocklist entries (lines 191-195) that prevent deserialization of these dangerous classes. The fix commit (d1c67a0396) was authored by upstream maintainer Tatu Saloranta and was merged into the upstream release before TuxCare's onboarding commit (9f25905de4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 does not affect jackson-databind 2.12.6.1-tuxcare.3. The vulnerability relates to unsafe deserialization of the gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` (and related classes) from Apache Drill, which could lead to remote code execution via JNDI injection. The fix was already present in the upstream 2.12.6.1 release that TuxCare onboarded. SubTypeValidator.java contains the required blocklist entries (lines 191-195) that prevent deserialization of these dangerous classes. The fix commit (d1c67a0396) was authored by upstream maintainer Tatu Saloranta and was merged into the upstream release before TuxCare's onboarding commit (9f25905de4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 does not affect jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves unsafe deserialization of Oracle JMS connection factory classes (oracle.jms.AQjms*). The upstream vendor (FasterXML) fixed this in commit 5c8642aeae by adding these classes to the SubTypeValidator blacklist. This fix was already present in upstream version 2.12.6.1 when TuxCare onboarded it (commit 9f25905de4). The target contains the complete fix at SubTypeValidator.java lines 200-204, blocking all five Oracle JMS classes. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "CVE-2020-14061 does not affect jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves unsafe deserialization of Oracle JMS connection factory classes (oracle.jms.AQjms*). The upstream vendor (FasterXML) fixed this in commit 5c8642aeae by adding these classes to the SubTypeValidator blacklist. This fix was already present in upstream version 2.12.6.1 when TuxCare onboarded it (commit 9f25905de4). The target contains the complete fix at SubTypeValidator.java lines 200-204, blocking all five Oracle JMS classes. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.6.1-tuxcare.3) is NOT AFFECTED by CVE-2020-14062. The vulnerability required the ability to deserialize com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (xalan2 gadget) for JNDI-based arbitrary code execution. The fix (blacklist entry preventing deserialization of this class) was already present in the upstream release 2.12.6.1 when TuxCare onboarded it. The blacklist entry appears at line 119 of SubTypeValidator.java and was added by upstream maintainer Tatu Saloranta in commit 840eae2ca81 (2020-05-01), which is an ancestor of the first TuxCare commit (9f25905de4 \"Onboard version 2.12.6.1\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "The target repository (jackson-databind 2.12.6.1-tuxcare.3) is NOT AFFECTED by CVE-2020-14062. The vulnerability required the ability to deserialize com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (xalan2 gadget) for JNDI-based arbitrary code execution. The fix (blacklist entry preventing deserialization of this class) was already present in the upstream release 2.12.6.1 when TuxCare onboarded it. The blacklist entry appears at line 119 of SubTypeValidator.java and was added by upstream maintainer Tatu Saloranta in commit 840eae2ca81 (2020-05-01), which is an ancestor of the first TuxCare commit (9f25905de4 \"Onboard version 2.12.6.1\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability concerns deserialization of the org.jsecurity.realm.jndi.JndiRealmFactory gadget class, which could enable JNDI injection attacks. The upstream vendor (FasterXML) fixed this in version 2.9.10.5 (commit f6d9c664f6d, June 2020) by adding the class to the deserialization blocklist in SubTypeValidator.java. The target version 2.12.6.1 was released after this fix and includes it in the upstream release that TuxCare onboarded. The fix is present at SubTypeValidator.java:207.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability concerns deserialization of the org.jsecurity.realm.jndi.JndiRealmFactory gadget class, which could enable JNDI injection attacks. The upstream vendor (FasterXML) fixed this in version 2.9.10.5 (commit f6d9c664f6d, June 2020) by adding the class to the deserialization blocklist in SubTypeValidator.java. The target version 2.12.6.1 was released after this fix and includes it in the upstream release that TuxCare onboarded. The fix is present at SubTypeValidator.java:207.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:20:14.370746+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPDataSource via polymorphic type handling. The fix (adding this class to SubTypeValidator's blocklist) was already included in the upstream release 2.12.6.1 that TuxCare onboarded. The blocklist entry at SubTypeValidator.java:147 prevents instantiation of this dangerous class during deserialization. Fix authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3d97153944, which predates TuxCare's onboarding commit by 1453 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPDataSource via polymorphic type handling. The fix (adding this class to SubTypeValidator's blocklist) was already included in the upstream release 2.12.6.1 that TuxCare onboarded. The blocklist entry at SubTypeValidator.java:147 prevents instantiation of this dangerous class during deserialization. Fix authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3d97153944, which predates TuxCare's onboarding commit by 1453 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:15:59.584312+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 affects jackson-databind versions before 2.6.7.5 and 2.7.x before 2.9.10.6, related to deserialization of com.pastdev.httpcomponents.configuration.JndiConfiguration. The target version 2.12.6.1 is NOT affected because the upstream fix (commit 6cc9f1a1af) was already present in the upstream release that TuxCare onboarded. The fix adds JndiConfiguration to the SubTypeValidator blocklist at line 210, preventing its deserialization. The validateSubType method checks this blocklist and throws an exception for blocked classes, providing effective protection against this gadget-based deserialization attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 affects jackson-databind versions before 2.6.7.5 and 2.7.x before 2.9.10.6, related to deserialization of com.pastdev.httpcomponents.configuration.JndiConfiguration. The target version 2.12.6.1 is NOT affected because the upstream fix (commit 6cc9f1a1af) was already present in the upstream release that TuxCare onboarded. The fix adds JndiConfiguration to the SubTypeValidator blocklist at line 210, preventing its deserialization. The validateSubType method checks this blocklist and throws an exception for blocked classes, providing effective protection against this gadget-based deserialization attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.12.6.1. The fix was already included in the upstream release 2.12.6.1 that TuxCare onboarded. The fix (commit 612f971b by upstream maintainer Tatu Saloranta) adds two XML parser security features that prevent XXE attacks: disallow-doctype-decl=true and load-external-dtd=false. These defenses are present in the target at src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java lines 43-49, and they effectively block the attack chain from XML input containing DOCTYPE/external entity references to external resource access.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.12.6.1. The fix was already included in the upstream release 2.12.6.1 that TuxCare onboarded. The fix (commit 612f971b by upstream maintainer Tatu Saloranta) adds two XML parser security features that prevent XXE attacks: disallow-doctype-decl=true and load-external-dtd=false. These defenses are present in the target at src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java lines 43-49, and they effectively block the attack chain from XML input containing DOCTYPE/external entity references to external resource access.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:21:46.608783+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.6.1-tuxcare.3 is NOT vulnerable to CVE-2020-35490. The fix (blocklist entries for org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource) was already present in the upstream release 2.12.6.1 that TuxCare onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "The target jackson-databind version 2.12.6.1-tuxcare.3 is NOT vulnerable to CVE-2020-35490. The fix (blocklist entries for org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource) was already present in the upstream release 2.12.6.1 that TuxCare onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T12:39:55.396610+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The fix (blocking these classes in SubTypeValidator) was already included in the upstream 2.12.6.1 release that TuxCare onboarded. The target version 2.12.6.1 is newer than the affected range \"2.x before 2.9.10.8\" and contains the upstream fix commit 41b8bdb5cc by Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "CVE-2020-35491 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The fix (blocking these classes in SubTypeValidator) was already included in the upstream 2.12.6.1 release that TuxCare onboarded. The target version 2.12.6.1 is newer than the affected range \"2.x before 2.9.10.8\" and contains the upstream fix commit 41b8bdb5cc by Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:54:25.795223+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves unsafe deserialization of the com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class that could enable remote code execution via JNDI injection. The upstream fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by Tatu Saloranta) added this class to the deserialization blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.12.6.1 when TuxCare onboarded it, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involves unsafe deserialization of the com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class that could enable remote code execution via JNDI injection. The upstream fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by Tatu Saloranta) added this class to the deserialization blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.12.6.1 when TuxCare onboarded it, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:23:58.768798+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involved missing blocklist entries for DriverAdapterCPDS gadget classes that could enable deserialization attacks. The upstream fix (commit 3ded28aece) added all five DriverAdapterCPDS class variants to the SubTypeValidator blocklist. This fix was already included in upstream version 2.12.6.1, which TuxCare onboarded. The target repository contains the complete fix at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, all with [databind#3004] annotations matching the upstream patch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "CVE-2020-36179 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability involved missing blocklist entries for DriverAdapterCPDS gadget classes that could enable deserialization attacks. The upstream fix (commit 3ded28aece) added all five DriverAdapterCPDS class variants to the SubTypeValidator blocklist. This fix was already included in upstream version 2.12.6.1, which TuxCare onboarded. The target repository contains the complete fix at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, all with [databind#3004] annotations matching the upstream patch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:35:29.309896+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.6.1-tuxcare.3 is NOT AFFECTED by CVE-2020-36180. The vulnerability involves deserialization gadgets using DriverAdapterCPDS classes from various DBCP packages. The upstream fix (commit 3ded28aece, Dec 31 2020) added these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was already present in the upstream release 2.12.6.1 that TuxCare onboarded on Sep 10 2026, making it an upstream-shipped fix rather than a TuxCare backport. All five DriverAdapterCPDS variants are blocked in the target code at SubTypeValidator.java lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "The target jackson-databind version 2.12.6.1-tuxcare.3 is NOT AFFECTED by CVE-2020-36180. The vulnerability involves deserialization gadgets using DriverAdapterCPDS classes from various DBCP packages. The upstream fix (commit 3ded28aece, Dec 31 2020) added these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was already present in the upstream release 2.12.6.1 that TuxCare onboarded on Sep 10 2026, making it an upstream-shipped fix rather than a TuxCare backport. All five DriverAdapterCPDS variants are blocked in the target code at SubTypeValidator.java lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:41:53.192155+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is not present in jackson-databind 2.12.6.1-tuxcare.3. The upstream fix (commit 3ded28aece) that adds org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS to the deserialization blocklist was already included in upstream release 2.12.6.1, which predates TuxCare's onboarding. The SubTypeValidator properly enforces the blocklist, preventing deserialization of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 is not present in jackson-databind 2.12.6.1-tuxcare.3. The upstream fix (commit 3ded28aece) that adds org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS to the deserialization blocklist was already included in upstream release 2.12.6.1, which predates TuxCare's onboarding. The SubTypeValidator properly enforces the blocklist, preventing deserialization of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:12:59.877228+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.12.6.1. The vulnerability involves deserialization of dangerous classes (org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP DriverAdapterCPDS variants) that can lead to arbitrary code execution via JNDI injection. The fix was applied in upstream commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b (\"Fixed #3004\") by Tatu Saloranta, which added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.12.6.1 before TuxCare onboarded it (first TuxCare commit 9f25905de4d7540c0df188165b17b8568a91826d). All four DriverAdapterCPDS variants mentioned in the CVE are blocked at lines 123, 219, 228, and 234 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.12.6.1. The vulnerability involves deserialization of dangerous classes (org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP DriverAdapterCPDS variants) that can lead to arbitrary code execution via JNDI injection. The fix was applied in upstream commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b (\"Fixed #3004\") by Tatu Saloranta, which added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.12.6.1 before TuxCare onboarded it (first TuxCare commit 9f25905de4d7540c0df188165b17b8568a91826d). All four DriverAdapterCPDS variants mentioned in the CVE are blocked at lines 123, 219, 228, and 234 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:21:12.185577+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not present in jackson-databind 2.12.6.1. The fix blocking deserialization gadget class 'org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool' was already included in the upstream 2.12.6.1 release before TuxCare onboarded this version. The blocklist entry is present at SubTypeValidator.java:243 and actively enforced during polymorphic deserialization, preventing instantiation of this dangerous JNDI-related class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "CVE-2020-36183 is not present in jackson-databind 2.12.6.1. The fix blocking deserialization gadget class 'org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool' was already included in the upstream 2.12.6.1 release before TuxCare onboarded this version. The blocklist entry is present at SubTypeValidator.java:243 and actively enforced during polymorphic deserialization, preventing instantiation of this dangerous JNDI-related class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T12:25:11.887724+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability affects versions before 2.9.10.8, and the fix was already included in the upstream 2.12.6.1 release. The fix (commit 567194c53a by Tatu Saloranta) adds org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java, preventing the serialization gadget exploitation described in the CVE. These blocklist entries are present in the target at lines 235-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The vulnerability affects versions before 2.9.10.8, and the fix was already included in the upstream 2.12.6.1 release. The fix (commit 567194c53a by Tatu Saloranta) adds org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java, preventing the serialization gadget exploitation described in the CVE. These blocklist entries are present in the target at lines 235-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:06:01.860590+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource` and `org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource`. The target repository at version 2.12.6.1 already contains the upstream fix (commit 567194c53a by Tatu Saloranta) which was shipped in jackson-databind 2.12.1. The blocklist entries are present in SubTypeValidator.java at lines 232-236 and are actively enforced during deserialization validation. This is an upstream fix that shipped in the release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource` and `org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource`. The target repository at version 2.12.6.1 already contains the upstream fix (commit 567194c53a by Tatu Saloranta) which was shipped in jackson-databind 2.12.1. The blocklist entries are present in SubTypeValidator.java at lines 232-236 and are actively enforced during deserialization validation. This is an upstream fix that shipped in the release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:31:31.792596+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.6.1-tuxcare.3 is not affected by CVE-2020-36186. The vulnerability involves deserialization of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource) in jackson-databind versions before 2.9.10.8. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in upstream release 2.12.6.1 before TuxCare onboarded it. The blocklist defense is actively enforced during deserialization via BeanDeserializerFactory._validateSubType(), blocking instantiation of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "Target version 2.12.6.1-tuxcare.3 is not affected by CVE-2020-36186. The vulnerability involves deserialization of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource) in jackson-databind versions before 2.9.10.8. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in upstream release 2.12.6.1 before TuxCare onboarded it. The blocklist defense is actively enforced during deserialization via BeanDeserializerFactory._validateSubType(), blocking instantiation of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:45:27.175080+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository version 2.12.6.1-tuxcare.3 is NOT AFFECTED by CVE-2020-36187. The upstream fix (commit 3e8fa3beea by Tatu Saloranta, dated Dec 26, 2020) was already present in the upstream release 2.12.6.1 before TuxCare onboarded it on commit 9f25905de. The dangerous classes org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource are already blocklisted in SubTypeValidator.java (lines 229-230), and this validation is actively enforced during bean deserialization via BeanDeserializerFactory line 140. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "The target repository version 2.12.6.1-tuxcare.3 is NOT AFFECTED by CVE-2020-36187. The upstream fix (commit 3e8fa3beea by Tatu Saloranta, dated Dec 26, 2020) was already present in the upstream release 2.12.6.1 before TuxCare onboarded it on commit 9f25905de. The dangerous classes org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource are already blocklisted in SubTypeValidator.java (lines 229-230), and this validation is actively enforced during bean deserialization via BeanDeserializerFactory line 140. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:51:12.642270+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5 due to deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource. The target version 2.12.6.1 is well beyond the fixed versions and contains the upstream fix (commit 33d96c13fe from Dec 26, 2020) that adds these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. The fix was already present in the upstream release 2.12.6.1 when TuxCare onboarded it, authored by upstream maintainer Tatu Saloranta. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5 due to deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource. The target version 2.12.6.1 is well beyond the fixed versions and contains the upstream fix (commit 33d96c13fe from Dec 26, 2020) that adds these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. The fix was already present in the upstream release 2.12.6.1 when TuxCare onboarded it, authored by upstream maintainer Tatu Saloranta. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:01:12.948527+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.6.1 is NOT vulnerable to CVE-2020-36189. The fix for this deserialization gadget vulnerability was already present in the upstream 2.12.6.1 release when TuxCare onboarded it. The vulnerable code pattern does not exist because the two New Relic agent classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) are already blacklisted in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta (commit 33d96c13, Dec 26 2020) and shipped in upstream release 2.12.6.1, which predates the TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "The target jackson-databind version 2.12.6.1 is NOT vulnerable to CVE-2020-36189. The fix for this deserialization gadget vulnerability was already present in the upstream 2.12.6.1 release when TuxCare onboarded it. The vulnerable code pattern does not exist because the two New Relic agent classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) are already blacklisted in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta (commit 33d96c13, Dec 26 2020) and shipped in upstream release 2.12.6.1, which predates the TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:28:55.544954+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.12.6.1. The vulnerability (unbounded recursion causing StackOverflowError) was fixed by upstream vendor (FasterXML) in commit 83b928dab as part of the 2.12.6.1 release. The fix adds a MAX_DEPTH limit (1000) and depth tracking to prevent deeply nested JSON from causing stack exhaustion.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.12.6.1. The vulnerability (unbounded recursion causing StackOverflowError) was fixed by upstream vendor (FasterXML) in commit 83b928dab as part of the 2.12.6.1 release. The fix adds a MAX_DEPTH limit (1000) and depth tracking to prevent deeply nested JSON from causing stack exhaustion." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:11:03.643431+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.12.6.1 is NOT AFFECTED by CVE-2020-8840. The vulnerability involves missing JNDI blocking for the gadget class org.apache.xbean.propertyeditor.JndiConverter, which could enable arbitrary code execution via polymorphic deserialization. The fix adds this class to a deserialization blacklist in SubTypeValidator.java. This fix is present in the target at line 138 of SubTypeValidator.java and was authored by upstream maintainer Tatu Saloranta on February 9, 2020 (commit 914e7c9f). The fix was already included in the upstream release 2.12.6.1 when TuxCare onboarded it, so this is an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "The target repository jackson-databind version 2.12.6.1 is NOT AFFECTED by CVE-2020-8840. The vulnerability involves missing JNDI blocking for the gadget class org.apache.xbean.propertyeditor.JndiConverter, which could enable arbitrary code execution via polymorphic deserialization. The fix adds this class to a deserialization blacklist in SubTypeValidator.java. This fix is present in the target at line 138 of SubTypeValidator.java and was authored by upstream maintainer Tatu Saloranta on February 9, 2020 (commit 914e7c9f). The fix was already included in the upstream release 2.12.6.1 when TuxCare onboarded it, so this is an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget involving org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target version 2.12.6.1-tuxcare.3 is NOT vulnerable. The fix (blacklisting HikariConfig in SubTypeValidator.java line 141) was already present in the upstream jackson-databind 2.12.6.1 release before TuxCare onboarded it. The fix commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by upstream author tatu.saloranta@iki.fi is an ancestor of HEAD and was IN_UPSTREAM_RELEASE (before the first TuxCare commit 9f25905de4). The blacklist defense is actively used by BeanDeserializerFactory to block deserialization of dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget involving org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target version 2.12.6.1-tuxcare.3 is NOT vulnerable. The fix (blacklisting HikariConfig in SubTypeValidator.java line 141) was already present in the upstream jackson-databind 2.12.6.1 release before TuxCare onboarded it. The fix commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by upstream author tatu.saloranta@iki.fi is an ancestor of HEAD and was IN_UPSTREAM_RELEASE (before the first TuxCare commit 9f25905de4). The blacklist defense is actively used by BeanDeserializerFactory to block deserialization of dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:41:15.361284+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The fix blocking deserialization of com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig was already included in the upstream FasterXML jackson-databind 2.12.6.1 release. The blocklist entry is present at SubTypeValidator.java:144, preventing the gadget-based deserialization attack. This is an upstream fix (commit 9f4e97019fb0dd836533d0b6198c88787e235ae2 by tatu.saloranta@iki.fi) that shipped in the upstream release before TuxCare onboarded version 2.12.6.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 is NOT present in jackson-databind 2.12.6.1-tuxcare.3. The fix blocking deserialization of com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig was already included in the upstream FasterXML jackson-databind 2.12.6.1 release. The blocklist entry is present at SubTypeValidator.java:144, preventing the gadget-based deserialization attack. This is an upstream fix (commit 9f4e97019fb0dd836533d0b6198c88787e235ae2 by tatu.saloranta@iki.fi) that shipped in the upstream release before TuxCare onboarded version 2.12.6.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:15:06.348166+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class. The target repository (jackson-databind 2.12.6.1-tuxcare.3) is NOT affected because the upstream fix was already present in the 2.12.6.1 release. The dangerous class br.com.anteros.dbcp.AnterosDBCPConfig is blocklisted in SubTypeValidator.java (line 145), preventing its deserialization. This fix was introduced by upstream author Tatu Saloranta in commit 9f4e97019fb (databind#2634) on Feb 29, 2020, and was included in the upstream 2.12.6.1 release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class. The target repository (jackson-databind 2.12.6.1-tuxcare.3) is NOT affected because the upstream fix was already present in the 2.12.6.1 release. The dangerous class br.com.anteros.dbcp.AnterosDBCPConfig is blocklisted in SubTypeValidator.java (line 145), preventing its deserialization. This fix was introduced by upstream author Tatu Saloranta in commit 9f4e97019fb (databind#2634) on Feb 29, 2020, and was included in the upstream 2.12.6.1 release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:13:50.465041+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 does not affect jackson-databind version 2.12.6.1-tuxcare.3. The vulnerability involves unsafe deserialization of javax.swing.JTextPane gadget class. The fix (adding JTextPane to the SubTypeValidator blocklist) was already present in upstream version 2.12.6.1 when TuxCare onboarded it. The fixing commit 7dbf51bf78d157098074a20bd9da39bd48c18e4a by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of TuxCare's onboarding commit 9f25905de4. The target version is newer than the affected versions (before 2.9.10.7 and 2.6.7.5) and contains the complete fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 does not affect jackson-databind version 2.12.6.1-tuxcare.3. The vulnerability involves unsafe deserialization of javax.swing.JTextPane gadget class. The fix (adding JTextPane to the SubTypeValidator blocklist) was already present in upstream version 2.12.6.1 when TuxCare onboarded it. The fixing commit 7dbf51bf78d157098074a20bd9da39bd48c18e4a by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of TuxCare's onboarding commit 9f25905de4. The target version is newer than the affected versions (before 2.9.10.7 and 2.6.7.5) and contains the complete fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:28:55.544954+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.12.6.1 is not vulnerable as it is higher than upstream fix version - 2.12.6", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "Jackson Databind 2.12.6.1 is not vulnerable as it is higher than upstream fix version - 2.12.6" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:28:55.544954+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:29:00.163330+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:28:55.544954+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:28:55.544954+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:28:55.544954+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:28:55.544954+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:29:54.870087+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:28:55.544954+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:29:54.870087+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:30:09.004653+00:00", "status_notes": "Vulnerability CVE-2026-54515 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3.", "vulnerability": { "name": "CVE-2026-54515" }, "action_statement": "Vulnerability CVE-2026-54515 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-05T09:58:52.142537+00:00", "status_notes": "Vulnerability CVE-2026-54518 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-54518" }, "action_statement": "Vulnerability CVE-2026-54518 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-11-05T09:58:52.142537+00:00", "status_notes": "Vulnerability CVE-2026-59888 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-59888" }, "action_statement": "Vulnerability CVE-2026-59888 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:30:09.004653+00:00", "status_notes": "Vulnerability CVE-2026-59889 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3.", "vulnerability": { "name": "CVE-2026-59889" }, "action_statement": "Vulnerability CVE-2026-59889 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:30:09.004653+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:30:09.004653+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:30:09.004653+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:30:09.004653+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-29T11:30:09.004653+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.6.1-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:28:55.544954+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.12.6.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6.1-tuxcare.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.12.6.1-tuxcare.2.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }