{ "@id": "urn:uuid:1047776a-eb15-4184-ab52-e4736ea6a041", "role": "Document Creator", "author": "https://tuxcare.com", "version": 65, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T10:01:09.466662+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:11:20.672019+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.7.1 is NOT affected by CVE-2017-15095. This vulnerability allowed arbitrary code execution through polymorphic deserialization of dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring framework classes, and C3P0 connection pool classes). The upstream vendor fixed this in August 2017 by adding these classes to a deserialization blacklist (issue #1737). The fix was already present in the upstream jackson-databind 2.12.7.1 release that TuxCare onboarded. The blacklist is implemented in SubTypeValidator.java and is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "The target jackson-databind version 2.12.7.1 is NOT affected by CVE-2017-15095. This vulnerability allowed arbitrary code execution through polymorphic deserialization of dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring framework classes, and C3P0 connection pool classes). The upstream vendor fixed this in August 2017 by adding these classes to a deserialization blacklist (issue #1737). The fix was already present in the upstream jackson-databind 2.12.7.1 release that TuxCare onboarded. The blacklist is implemented in SubTypeValidator.java and is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:45:35.958455+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.12.7.1-tuxcare.4 is significantly newer and contains the upstream fixes from December 2017. The vulnerability involved incomplete blacklist validation allowing RCE via polymorphic deserialization of dangerous classes (Spring framework types, c3p0 DataSources, etc.). The target contains SubTypeValidator.java with comprehensive blacklist validation including all classes from the CVE patches (FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, BasicDataSource, ClassLoader) plus sophisticated pattern matching for Spring and c3p0 types. The fixes were authored by upstream maintainer Tatu Saloranta and shipped in version 2.10.0+, well before TuxCare onboarded version 2.12.7.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.12.7.1-tuxcare.4 is significantly newer and contains the upstream fixes from December 2017. The vulnerability involved incomplete blacklist validation allowing RCE via polymorphic deserialization of dangerous classes (Spring framework types, c3p0 DataSources, etc.). The target contains SubTypeValidator.java with comprehensive blacklist validation including all classes from the CVE patches (FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, BasicDataSource, ClassLoader) plus sophisticated pattern matching for Spring and c3p0 types. The fixes were authored by upstream maintainer Tatu Saloranta and shipped in version 2.10.0+, well before TuxCare onboarded version 2.12.7.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:29:58.600651+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9, allowing arbitrary code execution via polymorphic deserialization when default typing is enabled. The target repository (jackson-databind 2.12.7.1-tuxcare.4) is NOT vulnerable. The upstream fix, originally introduced in commit 60d459cedc by Tatu Saloranta for version 2.8.9, is present in this version. In 2.12.7.1, the protection is implemented via SubTypeValidator class which maintains a blacklist of dangerous classes (TemplatesImpl, InvokerTransformer, InstantiateTransformer, etc.) and validates all deserialization targets. The fix was shipped in the upstream jackson-databind 2.12.7.1 release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9, allowing arbitrary code execution via polymorphic deserialization when default typing is enabled. The target repository (jackson-databind 2.12.7.1-tuxcare.4) is NOT vulnerable. The upstream fix, originally introduced in commit 60d459cedc by Tatu Saloranta for version 2.8.9, is present in this version. In 2.12.7.1, the protection is implemented via SubTypeValidator class which maintains a blacklist of dangerous classes (TemplatesImpl, InvokerTransformer, InstantiateTransformer, etc.) and validates all deserialization targets. The fix was shipped in the upstream jackson-databind 2.12.7.1 release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:21:23.269302+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 does not affect this target. The vulnerability required the absence of a blacklist entry for org.apache.ibatis.parsing.XPathParser in SubTypeValidator.java. The upstream vendor (FasterXML) added this blacklist entry in commit 27b4defc27 (May 2018, authored by tatu.saloranta@iki.fi). This fix was already present in the upstream jackson-databind 2.12.7.1 release that TuxCare onboarded in September 2026. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 does not affect this target. The vulnerability required the absence of a blacklist entry for org.apache.ibatis.parsing.XPathParser in SubTypeValidator.java. The upstream vendor (FasterXML) added this blacklist entry in commit 27b4defc27 (May 2018, authored by tatu.saloranta@iki.fi). This fix was already present in the upstream jackson-databind 2.12.7.1 release that TuxCare onboarded in September 2026. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T17:20:54.241430+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves polymorphic deserialization of dangerous gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that enable JNDI/LDAP exploitation. The upstream fix adds these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 28badf7ef6 and was already present in upstream release 2.12.7.1 when TuxCare onboarded it (first TuxCare commit: c7e6f711f5 by amoniatovskiy@cloudlinux.com). The target version contains the complete blacklist entries and the validation is actively enforced in the deserialization path via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves polymorphic deserialization of dangerous gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that enable JNDI/LDAP exploitation. The upstream fix adds these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 28badf7ef6 and was already present in upstream release 2.12.7.1 when TuxCare onboarded it (first TuxCare commit: c7e6f711f5 by amoniatovskiy@cloudlinux.com). The target version contains the complete blacklist entries and the validation is actively enforced in the deserialization path via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:21:53.187202+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves JNDI/LDAP deserialization gadgets (oracle.jdbc.rowset.OracleJDBCRowSet, oracle.jdbc.connector.OracleManagedConnectionFactory, jodd.db.connection.DataSourceConnectionProvider) that allow remote code execution when Default Typing is enabled. The upstream fix (commit 7487cf7eb1 by Tatu Saloranta, 2018-05-31) added these classes to SubTypeValidator's deserialization blocklist, and was already included in version 2.12.7.1 when TuxCare onboarded it in 2026-09-15.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves JNDI/LDAP deserialization gadgets (oracle.jdbc.rowset.OracleJDBCRowSet, oracle.jdbc.connector.OracleManagedConnectionFactory, jodd.db.connection.DataSourceConnectionProvider) that allow remote code execution when Default Typing is enabled. The upstream fix (commit 7487cf7eb1 by Tatu Saloranta, 2018-05-31) added these classes to SubTypeValidator's deserialization blocklist, and was already included in version 2.12.7.1 when TuxCare onboarded it in 2026-09-15.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:58:06.230787+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.7.1-tuxcare.4) is NOT affected by CVE-2018-14718. The vulnerability concerns polymorphic deserialization of the slf4j-ext class (org.slf4j.ext.EventData) allowing arbitrary code execution. The fix, which adds org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist, was already present in the upstream jackson-databind 2.12.7.1 release that TuxCare onboarded. This is an upstream vendor fix by FasterXML, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "The target repository (jackson-databind 2.12.7.1-tuxcare.4) is NOT affected by CVE-2018-14718. The vulnerability concerns polymorphic deserialization of the slf4j-ext class (org.slf4j.ext.EventData) allowing arbitrary code execution. The fix, which adds org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist, was already present in the upstream jackson-databind 2.12.7.1 release that TuxCare onboarded. This is an upstream vendor fix by FasterXML, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:01:48.562174+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.12.7.1-tuxcare.4 is NOT affected by CVE-2018-14719. The vulnerability involves polymorphic deserialization of the BlazeDS class `flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor`, which could lead to arbitrary code execution. The fix that blocks this class from deserialization was already present in the upstream jackson-databind 2.12.7.1 release when TuxCare onboarded it. The class is properly blacklisted in SubTypeValidator.java at line 76, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "The target repository jackson-databind version 2.12.7.1-tuxcare.4 is NOT affected by CVE-2018-14719. The vulnerability involves polymorphic deserialization of the BlazeDS class `flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor`, which could lead to arbitrary code execution. The fix that blocks this class from deserialization was already present in the upstream jackson-databind 2.12.7.1 release when TuxCare onboarded it. The class is properly blacklisted in SubTypeValidator.java at line 76, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:09:29.528523+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.7.1-tuxcare.4) is not affected by CVE-2018-14720. The four classes that enable polymorphic deserialization gadget attacks (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocked in SubTypeValidator.java lines 74-78. This fix was authored by upstream FasterXML maintainer Tatu Saloranta (commit 87d29af25e) and was already present in the upstream release 2.12.7.1 that TuxCare onboarded. The target version (2.12.7.1) is also beyond the CVE's affected range (\"before 2.9.7\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "The target repository (jackson-databind 2.12.7.1-tuxcare.4) is not affected by CVE-2018-14720. The four classes that enable polymorphic deserialization gadget attacks (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocked in SubTypeValidator.java lines 74-78. This fix was authored by upstream FasterXML maintainer Tatu Saloranta (commit 87d29af25e) and was already present in the upstream release 2.12.7.1 that TuxCare onboarded. The target version (2.12.7.1) is also beyond the CVE's affected range (\"before 2.9.7\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:40:05.423100+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.12.7.1-tuxcare.4 is NOT AFFECTED by CVE-2018-14721. The vulnerability concerns polymorphic deserialization of the org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl class that could enable SSRF attacks. The upstream vendor (FasterXML) fixed this in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by adding the dangerous class to a blocklist. This fix was already present in the upstream release 2.12.7.1 that TuxCare onboarded, as confirmed by verifying the fix commit is an ancestor of the first TuxCare commit (c7e6f711f536829912152091bf850a1a7e110b30 \"Onboard version 2.12.7.1\"). The CVE affects versions \"before 2.9.7\" and the target version 2.12.7.1 is well beyond this threshold. The blocklist enforcement is active in SubTypeValidator.java lines 74-78 and is called during bean deserialization via BeanDeserializerFactory._validateSubType at line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "The target repository jackson-databind 2.12.7.1-tuxcare.4 is NOT AFFECTED by CVE-2018-14721. The vulnerability concerns polymorphic deserialization of the org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl class that could enable SSRF attacks. The upstream vendor (FasterXML) fixed this in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by adding the dangerous class to a blocklist. This fix was already present in the upstream release 2.12.7.1 that TuxCare onboarded, as confirmed by verifying the fix commit is an ancestor of the first TuxCare commit (c7e6f711f536829912152091bf850a1a7e110b30 \"Onboard version 2.12.7.1\"). The CVE affects versions \"before 2.9.7\" and the target version 2.12.7.1 is well beyond this threshold. The blocklist enforcement is active in SubTypeValidator.java lines 74-78 and is called during bean deserialization via BeanDeserializerFactory._validateSubType at line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T12:52:53.936815+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.7.1 contains the upstream vendor's fix for CVE-2018-19360. The fix (adding org.apache.axis2.transport.jms.JMSOutTransportInfo to the deserialization blocklist) was already present in upstream release 2.12.7.1 when TuxCare onboarded it. The vulnerable code pattern (absence of blocklist entry for the axis2-transport-jms class) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "Target version 2.12.7.1 contains the upstream vendor's fix for CVE-2018-19360. The fix (adding org.apache.axis2.transport.jms.JMSOutTransportInfo to the deserialization blocklist) was already present in upstream release 2.12.7.1 when TuxCare onboarded it. The vulnerable code pattern (absence of blocklist entry for the axis2-transport-jms class) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:58:57.863833+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to unblocked OpenJPA classes in polymorphic deserialization. The target (jackson-databind 2.12.7.1-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream release. The dangerous OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) are properly blocked in SubTypeValidator.java lines 82-83. The fix was introduced by upstream commit 72cd4025a2 (author: tatu.saloranta@iki.fi, date: 2018-11-19) which predates the first TuxCare commit in this branch's history (d3e245d364, setup 2.9.10.5). This is an upstream fix that shipped in the original release version, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to unblocked OpenJPA classes in polymorphic deserialization. The target (jackson-databind 2.12.7.1-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream release. The dangerous OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) are properly blocked in SubTypeValidator.java lines 82-83. The fix was introduced by upstream commit 72cd4025a2 (author: tatu.saloranta@iki.fi, date: 2018-11-19) which predates the first TuxCare commit in this branch's history (d3e245d364, setup 2.9.10.5). This is an upstream fix that shipped in the original release version, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:26:10.977883+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target is NOT vulnerable to CVE-2018-19362. The fix blocking the jboss-common-core class (org.jboss.util.propertyeditor.DocumentEditor) from polymorphic deserialization is present in SubTypeValidator.java. This fix was shipped in upstream jackson-databind 2.9.8 (November 2018) and is present in the target version 2.12.7.1-tuxcare.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "The target is NOT vulnerable to CVE-2018-19362. The fix blocking the jboss-common-core class (org.jboss.util.propertyeditor.DocumentEditor) from polymorphic deserialization is present in SubTypeValidator.java. This fix was shipped in upstream jackson-databind 2.9.8 (November 2018) and is present in the target version 2.12.7.1-tuxcare.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.12.7.1. The vulnerability allowed RCE via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed the blacklist. The upstream fix adding these classes to DEFAULT_NO_DESER_CLASS_NAMES was applied by Tatu Saloranta in commit 038b471e2ef on 2018-01-21 and shipped in upstream release 2.12.7.1, which TuxCare later onboarded. The target is not affected because the vulnerable pattern was already eliminated in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.12.7.1. The vulnerability allowed RCE via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed the blacklist. The upstream fix adding these classes to DEFAULT_NO_DESER_CLASS_NAMES was applied by Tatu Saloranta in commit 038b471e2ef on 2018-01-21 and shipped in upstream release 2.12.7.1, which TuxCare later onboarded. The target is not affected because the vulnerable pattern was already eliminated in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:55:21.996343+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.7.1-tuxcare.4 is NOT AFFECTED by CVE-2018-7489. The vulnerability involves insecure deserialization of c3p0 DataSource classes via Jackson's polymorphic type handling. The upstream fix (commit 6799f8f10cc78e9af6d443ed6982d00a13f2e7d2 by Tatu Saloranta) was already present in jackson-databind 2.12.7.1 when TuxCare onboarded the version. The fix adds pattern-based validation in SubTypeValidator that rejects any class name starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\". This defense is active by default and called during bean deserializer creation, preventing exploitation. The target version 2.12.7.1 is much newer than the affected versions (< 2.9.5 per CVE).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "The target jackson-databind version 2.12.7.1-tuxcare.4 is NOT AFFECTED by CVE-2018-7489. The vulnerability involves insecure deserialization of c3p0 DataSource classes via Jackson's polymorphic type handling. The upstream fix (commit 6799f8f10cc78e9af6d443ed6982d00a13f2e7d2 by Tatu Saloranta) was already present in jackson-databind 2.12.7.1 when TuxCare onboarded the version. The fix adds pattern-based validation in SubTypeValidator that rejects any class name starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\". This defense is active by default and called during bean deserializer creation, preventing exploitation. The target version 2.12.7.1 is much newer than the affected versions (< 2.9.5 per CVE).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:35:21.882986+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind versions before 2.9.9. The target version 2.12.7.1 already contains the upstream fix (commit dda513bd by Tatu Saloranta, May 2019) that adds \"com.mysql.cj.jdbc.admin.MiniAdmin\" to the deserialization blocklist. The fix was shipped in the upstream release and was already present when TuxCare onboarded this version in September 2026. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 affects jackson-databind versions before 2.9.9. The target version 2.12.7.1 already contains the upstream fix (commit dda513bd by Tatu Saloranta, May 2019) that adds \"com.mysql.cj.jdbc.admin.MiniAdmin\" to the deserialization blocklist. The fix was shipped in the upstream release and was already present when TuxCare onboarded this version in September 2026. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T18:40:43.006683+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository (jackson-databind 2.12.7.1-tuxcare.4) is NOT AFFECTED by CVE-2019-12384. The vulnerability requires the absence of a blocklist entry for the logback-core gadget class (ch.qos.logback.core.db.DriverManagerConnectionSource). The target contains this blocklist entry at SubTypeValidator.java:91, which prevents polymorphic deserialization of the dangerous class. This fix was in...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 The target repository (jackson-databind 2.12.7.1-tuxcare.4) is NOT AFFECTED by CVE-2019-12384. The vulnerability requires the absence of a blocklist entry for the logback-core gadget class (ch.qos.logback.core.db.DriverManagerConnectionSource). The target contains this blocklist entry at SubTypeValidator.java:91, which prevents polymorphic deserialization of the dangerous class. This fix was in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-02T07:22:00.114320+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves arbitrary file read via JDOM XSLTransformer deserialization when polymorphic typing is enabled. The upstream vendor fix (commit 5f7c69bba0 by tatu.saloranta@iki.fi) blocking org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer is present in SubTypeValidator.java lines 94-95. This...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves arbitrary file read via JDOM XSLTransformer deserialization when polymorphic typing is enabled. The upstream vendor fix (commit 5f7c69bba0 by tatu.saloranta@iki.fi) blocking org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer is present in SubTypeValidator.java lines 94-95. This..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T12:14:20.152420+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.7.1-tuxcare.3) is NOT affected by CVE-2019-14379. The vulnerability was fixed by upstream maintainer Tatu Saloranta in commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b, which added the dangerous class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.12.7.1 when TuxCare onboarded it, as verified by the fix being an ancestor of the first TuxCare commit c7e6f711f5 (\"Onboard version 2.12.7.1\" by amoniatovskiy@cloudlinux.com). The CVE affects versions before 2.9.9.2, 2.8.11.4, and 2.7.9.6; the target version 2.12.7.1 is much newer and ships with the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "The target repository (jackson-databind 2.12.7.1-tuxcare.3) is NOT affected by CVE-2019-14379. The vulnerability was fixed by upstream maintainer Tatu Saloranta in commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b, which added the dangerous class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.12.7.1 when TuxCare onboarded it, as verified by the fix being an ancestor of the first TuxCare commit c7e6f711f5 (\"Onboard version 2.12.7.1\" by amoniatovskiy@cloudlinux.com). The CVE affects versions before 2.9.9.2, 2.8.11.4, and 2.7.9.6; the target version 2.12.7.1 is much newer and ships with the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:36:00.176667+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is not present in jackson-databind 2.12.7.1. The fix for this vulnerability (blacklisting ch.qos.logback.core.db.JNDIConnectionSource in SubTypeValidator) was already included in upstream version 2.9.9.2, and the target version 2.12.7.1 is significantly later. The fix was shipped by upstream maintainer Tatu Saloranta and was already present when TuxCare onboarded this version. The SubTypeValidator properly blocks deserialization of the dangerous logback class at line 102, preventing the polymorphic typing vulnerability described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 is not present in jackson-databind 2.12.7.1. The fix for this vulnerability (blacklisting ch.qos.logback.core.db.JNDIConnectionSource in SubTypeValidator) was already included in upstream version 2.9.9.2, and the target version 2.12.7.1 is significantly later. The fix was shipped by upstream maintainer Tatu Saloranta and was already present when TuxCare onboarded this version. The SubTypeValidator properly blocks deserialization of the dangerous logback class at line 102, preventing the polymorphic typing vulnerability described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:49:36.466974+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to polymorphic deserialization gadgets (HikariConfig and HikariDataSource). The target version 2.12.7.1 already contains the upstream fix from commits d4983c740f and 73c1c2cc76, which add both com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the SubTypeValidator blocklist. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.12.7.1 when TuxCare onboarded it (commit c7e6f711f5). The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to polymorphic deserialization gadgets (HikariConfig and HikariDataSource). The target version 2.12.7.1 already contains the upstream fix from commits d4983c740f and 73c1c2cc76, which add both com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the SubTypeValidator blocklist. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.12.7.1 when TuxCare onboarded it (commit c7e6f711f5). The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:58:22.317135+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is not present in jackson-databind 2.12.7.1. The vulnerability involved polymorphic deserialization of malicious commons-configuration JNDI classes leading to arbitrary code execution. The upstream vendor fix (commit 41b7f9b901) added org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blacklist in SubTypeValidator.java. This fix was already present in upstream release 2.12.7.1 before TuxCare onboarded the version, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 is not present in jackson-databind 2.12.7.1. The vulnerability involved polymorphic deserialization of malicious commons-configuration JNDI classes leading to arbitrary code execution. The upstream vendor fix (commit 41b7f9b901) added org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blacklist in SubTypeValidator.java. This fix was already present in upstream release 2.12.7.1 before TuxCare onboarded the version, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) that enables arbitrary code execution. The upstream fix blacklisted this class in SubTypeValidator.java, and this fix was already present in upstream release 2.12.7.1 when TuxCare onboarded it. The fix commit (998efd708284778f29d83d7962a9bd935c228317) authored by tatu.saloranta@iki.fi is an ancestor of both the TuxCare onboarding commit and current HEAD, confirming the vulnerable pattern was never present in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) that enables arbitrary code execution. The upstream fix blacklisted this class in SubTypeValidator.java, and this fix was already present in upstream release 2.12.7.1 when TuxCare onboarded it. The fix commit (998efd708284778f29d83d7962a9bd935c228317) authored by tatu.saloranta@iki.fi is an ancestor of both the TuxCare onboarding commit and current HEAD, confirming the vulnerable pattern was never present in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T17:08:31.778572+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is NOT present in jackson-databind version 2.12.7.1. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to arbitrary code execution. The fix (adding HikariDataSource to the SubTypeValidator blocklist) was already present in the upstream release 2.12.7.1 that TuxCare onboarded. The fix commit (73c1c2cc76) by upstream author Tatu Saloranta is an ancestor of both HEAD and the first TuxCare onboarding commit, confirming this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 is NOT present in jackson-databind version 2.12.7.1. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to arbitrary code execution. The fix (adding HikariDataSource to the SubTypeValidator blocklist) was already present in the upstream release 2.12.7.1 that TuxCare onboarded. The fix commit (73c1c2cc76) by upstream author Tatu Saloranta is an ancestor of both HEAD and the first TuxCare onboarding commit, confirming this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:07:22.154174+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The fix for this CVE (blocking deserialization of commons-dbcp dangerous classes) was already included in the upstream release 2.12.7.1 that TuxCare onboarded. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The fix for this CVE (blocking deserialization of commons-dbcp dangerous classes) was already included in the upstream release 2.12.7.1 that TuxCare onboarded. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T17:17:09.184138+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability concerns polymorphic deserialization gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp classes) that were blacklisted in upstream commit 9593e16cf5 (issue #2478). This fix was already included in the upstream 2.12.7.1 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit c7e6f711f5. The target's SubTypeValidator.java contains all three blacklisted classes at lines 124-127, preventing their deserialization when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability concerns polymorphic deserialization gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp classes) that were blacklisted in upstream commit 9593e16cf5 (issue #2478). This fix was already included in the upstream 2.12.7.1 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit c7e6f711f5. The target's SubTypeValidator.java contains all three blacklisted classes at lines 124-127, preventing their deserialization when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:30:13.587550+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5. The target repository is jackson-databind version 2.12.7.1-tuxcare.4, which already contains the upstream fix (commit 191a4cdf87) that blocks \"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\" from polymorphic deserialization. This fix was shipped in the upstream Jackson 2.12.7.1 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta. The vulnerable class is present in the SubTypeValidator blocklist at line 99, preventing instantiation during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5. The target repository is jackson-databind version 2.12.7.1-tuxcare.4, which already contains the upstream fix (commit 191a4cdf87) that blocks \"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\" from polymorphic deserialization. This fix was shipped in the upstream Jackson 2.12.7.1 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta. The vulnerable class is present in the SubTypeValidator blocklist at line 99, preventing instantiation during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:49:46.568438+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involved missing blocklist entries for apache-log4j-extra gadget classes (JNDIConnectionSource and DriverManagerConnectionSource) that could enable JNDI injection attacks when polymorphic typing is enabled. The fix was already included in upstream version 2.12.7.1, which added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. The target version (2.12.7.1) is newer than all affected versions (prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3) and contains the upstream fix committed by Tatu Saloranta on 2019-10-12.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involved missing blocklist entries for apache-log4j-extra gadget classes (JNDIConnectionSource and DriverManagerConnectionSource) that could enable JNDI injection attacks when polymorphic typing is enabled. The fix was already included in upstream version 2.12.7.1, which added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. The target version (2.12.7.1) is newer than all affected versions (prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3) and contains the upstream fix committed by Tatu Saloranta on 2019-10-12.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.12.7.1-tuxcare.4 is NOT affected by CVE-2019-20330. The vulnerability requires the absence of blocking for two ehcache classes (GenericJndiSelector and GlassfishSelector) that can trigger JNDI lookups during polymorphic deserialization, leading to arbitrary code execution. However, the fix blocking these classes was already present in the upstream 2.12.7.1 release that TuxCare onboarded. The fix was committed by upstream maintainer Tatu Saloranta on November 1, 2019 (commit fc4214a883). The CVE affects versions before 2.9.10.2, and the target version 2.12.7.1 is well beyond that threshold, confirming the fix is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "The target repository jackson-databind version 2.12.7.1-tuxcare.4 is NOT affected by CVE-2019-20330. The vulnerability requires the absence of blocking for two ehcache classes (GenericJndiSelector and GlassfishSelector) that can trigger JNDI lookups during polymorphic deserialization, leading to arbitrary code execution. However, the fix blocking these classes was already present in the upstream 2.12.7.1 release that TuxCare onboarded. The fix was committed by upstream maintainer Tatu Saloranta on November 1, 2019 (commit fc4214a883). The CVE affects versions before 2.9.10.2, and the target version 2.12.7.1 is well beyond that threshold, confirming the fix is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T17:05:23.635575+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.7.1-tuxcare.4 is NOT AFFECTED by CVE-2020-10650. The vulnerability was fixed in upstream version 2.9.10.4 (commit a424c038ba by Tatu Saloranta on March 15, 2020), which added ignite-jta and quartz JNDI classes to the deserialization blocklist. Since the target version 2.12.7.1 is much later than 2.9.10.4, the fix was already present in the upstream release that TuxCare onboarded. The blocklist entries for org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider are present at lines 157-160 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "The target jackson-databind version 2.12.7.1-tuxcare.4 is NOT AFFECTED by CVE-2020-10650. The vulnerability was fixed in upstream version 2.9.10.4 (commit a424c038ba by Tatu Saloranta on March 15, 2020), which added ignite-jta and quartz JNDI classes to the deserialization blocklist. Since the target version 2.12.7.1 is much later than 2.9.10.4, the fix was already present in the upstream release that TuxCare onboarded. The blocklist entries for org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider are present at lines 157-160 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves unsafe deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The fix (adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator) was already present in the upstream release 2.12.7.1 that TuxCare onboarded on 2026-09-15. The fix commit (592872f423) was authored by upstream maintainer Tatu Saloranta on 2020-03-15, six years before TuxCare's onboarding. The target repository inherits this upstream fix, so the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "CVE-2020-10672 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves unsafe deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The fix (adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator) was already present in the upstream release 2.12.7.1 that TuxCare onboarded on 2026-09-15. The fix commit (592872f423) was authored by upstream maintainer Tatu Saloranta on 2020-03-15, six years before TuxCare's onboarding. The target repository inherits this upstream fix, so the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:30:36.061493+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The fix blocking deserialization of com.caucho.config.types.ResourceRef was already included in the upstream release 2.12.7.1, which TuxCare onboarded. The blocklist entry is present at SubTypeValidator.java line 167 and is enforced by default during deserialization, preventing the gadget chain exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The fix blocking deserialization of com.caucho.config.types.ResourceRef was already included in the upstream release 2.12.7.1, which TuxCare onboarded. The blocklist entry is present at SubTypeValidator.java line 167 and is enforced by default during deserialization, preventing the gadget chain exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerable gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider is blocklisted in SubTypeValidator (line 171), preventing deserialization exploitation. This fix was already present in the upstream release 2.12.7.1 when TuxCare onboarded the project.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerable gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider is blocklisted in SubTypeValidator (line 171), preventing deserialization exploitation. This fix was already present in the upstream release 2.12.7.1 when TuxCare onboarded the project.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 is not present in target version 2.12.7.1. The fix blocking javax.swing.JEditorPane from deserialization was already included in the upstream release 2.12.7.1 (commit 4d038c9de0 by Tatu Saloranta on March 3, 2020) before TuxCare onboarded this version. The SubTypeValidator blocklist at line 150 contains \"javax.swing.JEditorPane\" which prevents the deserialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "CVE-2020-10969 is not present in target version 2.12.7.1. The fix blocking javax.swing.JEditorPane from deserialization was already included in the upstream release 2.12.7.1 (commit 4d038c9de0 by Tatu Saloranta on March 3, 2020) before TuxCare onboarded this version. The SubTypeValidator blocklist at line 150 contains \"javax.swing.JEditorPane\" which prevents the deserialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability concerns deserialization gadgets in org.apache.activemq.* classes that could lead to arbitrary code execution or JNDI injection. The upstream vendor (FasterXML) fixed this in version 2.9.10.4 by adding 9 activemq class names to the SubTypeValidator blacklist. The target version 2.12.7.1 already contains this fix as it was shipped in the upstream 2.12.x release line, which is much newer than the affected versions (2.x before 2.9.10.4). The fix commit (08fbfacf89) was authored by qxo (49526356@qq.com) and was already present when TuxCare onboarded version 2.12.7.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability concerns deserialization gadgets in org.apache.activemq.* classes that could lead to arbitrary code execution or JNDI injection. The upstream vendor (FasterXML) fixed this in version 2.9.10.4 by adding 9 activemq class names to the SubTypeValidator blacklist. The target version 2.12.7.1 already contains this fix as it was shipped in the upstream 2.12.x release line, which is much newer than the affected versions (2.x before 2.9.10.4). The fix commit (08fbfacf89) was authored by qxo (49526356@qq.com) and was already present when TuxCare onboarded version 2.12.7.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.7.1-tuxcare.4 is not affected by CVE-2020-11112. The upstream vendor fix (commit 05d7e0e13f by Tatu Saloranta, March 25, 2020) was already present in the upstream release 2.12.7.1 (October 12, 2022) that TuxCare onboarded. The fix adds org.apache.commons.proxy.provider.remoting.RmiProvider to the SubTypeValidator blocklist, preventing deserialization of this gadget class. The blocklist entry is present at line 186 of SubTypeValidator.java and is actively enforced during all bean deserializations via BeanDeserializerFactory line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "Target version 2.12.7.1-tuxcare.4 is not affected by CVE-2020-11112. The upstream vendor fix (commit 05d7e0e13f by Tatu Saloranta, March 25, 2020) was already present in the upstream release 2.12.7.1 (October 12, 2022) that TuxCare onboarded. The fix adds org.apache.commons.proxy.provider.remoting.RmiProvider to the SubTypeValidator blocklist, preventing deserialization of this gadget class. The blocklist entry is present at line 186 of SubTypeValidator.java and is actively enforced during all bean deserializations via BeanDeserializerFactory line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.7.1-tuxcare.4 is NOT AFFECTED by CVE-2020-11113. The vulnerability involves deserialization of the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix (blacklisting this class in SubTypeValidator.java) was already present in the upstream 2.12.7.1 release that TuxCare onboarded. The dangerous class is blacklisted at line 84 of SubTypeValidator.java, preventing its deserialization. This is an upstream fix by Tatu Saloranta (tatu.saloranta@iki.fi), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "Target jackson-databind 2.12.7.1-tuxcare.4 is NOT AFFECTED by CVE-2020-11113. The vulnerability involves deserialization of the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix (blacklisting this class in SubTypeValidator.java) was already present in the upstream 2.12.7.1 release that TuxCare onboarded. The dangerous class is blacklisted at line 84 of SubTypeValidator.java, preventing its deserialization. This is an upstream fix by Tatu Saloranta (tatu.saloranta@iki.fi), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is NOT PRESENT in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability concerns deserialization gadgets org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean that could enable arbitrary code execution. The fix (commit 113e89fb08 \"Fix #2680\") added these classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was already present in the upstream jackson-databind 2.12.7.1 release that TuxCare onboarded (first TuxCare commit: c7e6f711f5 \"Onboard version 2.12.7.1\"). The fix author is Tatu Saloranta (tatu.saloranta@iki.fi), the upstream maintainer, not a TuxCare/CloudLinux engineer. The target version is well after the affected version range (< 2.9.10.4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 is NOT PRESENT in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability concerns deserialization gadgets org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean that could enable arbitrary code execution. The fix (commit 113e89fb08 \"Fix #2680\") added these classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was already present in the upstream jackson-databind 2.12.7.1 release that TuxCare onboarded (first TuxCare commit: c7e6f711f5 \"Onboard version 2.12.7.1\"). The fix author is Tatu Saloranta (tatu.saloranta@iki.fi), the upstream maintainer, not a TuxCare/CloudLinux engineer. The target version is well after the affected version range (< 2.9.10.4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 does not affect this version. The vulnerability involves deserialization of the org.apache.commons.jelly.impl.Embedded gadget class through Jackson's polymorphic type handling. The upstream fix (adding this class to the deserialization blocklist) was authored by Tatu Saloranta on 2020-04-07 and shipped in upstream release 2.12.7.1. TuxCare onboarded this already-fixed version on commit c7e6f711f5. The blocklist entry exists at SubTypeValidator.java:189 and is enforced before deserialization, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 does not affect this version. The vulnerability involves deserialization of the org.apache.commons.jelly.impl.Embedded gadget class through Jackson's polymorphic type handling. The upstream fix (adding this class to the deserialization blocklist) was authored by Tatu Saloranta on 2020-04-07 and shipped in upstream release 2.12.7.1. TuxCare onboarded this already-fixed version on commit c7e6f711f5. The blocklist entry exists at SubTypeValidator.java:189 and is enforced before deserialization, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not present in jackson-databind 2.12.7.1. The vulnerability involves deserialization gadgets related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The fix (blacklisting these classes in SubTypeValidator) was added by upstream commit d1c67a0396e84c08d0558fbb843b5bd1f26e1921 and shipped in the upstream 2.12.7.1 release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 is not present in jackson-databind 2.12.7.1. The vulnerability involves deserialization gadgets related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The fix (blacklisting these classes in SubTypeValidator) was added by upstream commit d1c67a0396e84c08d0558fbb843b5bd1f26e1921 and shipped in the upstream 2.12.7.1 release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.7.1-tuxcare.4 is NOT affected by CVE-2020-14061. The upstream fix that blocks deserialization of the five oracle.jms AQjms connection factory classes was already included in the upstream release 2.12.7.1. The vulnerable pattern (unblocked oracle.jms classes) is not present in this version. The fix commit (5c8642aeae) by Tatu Saloranta was merged into the upstream codebase before version 2.9.10.5, and the target version 2.12.7.1 is significantly later. SubTypeValidator.java lines 200-204 contain all five blocked class names, and the validation is enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "Target version 2.12.7.1-tuxcare.4 is NOT affected by CVE-2020-14061. The upstream fix that blocks deserialization of the five oracle.jms AQjms connection factory classes was already included in the upstream release 2.12.7.1. The vulnerable pattern (unblocked oracle.jms classes) is not present in this version. The fix commit (5c8642aeae) by Tatu Saloranta was merged into the upstream codebase before version 2.9.10.5, and the target version 2.12.7.1 is significantly later. SubTypeValidator.java lines 200-204 contain all five blocked class names, and the validation is enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves deserialization of the gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool which can lead to RCE via JNDI injection. The fix (blocking this class in SubTypeValidator) was already included in the upstream 2.12.7.1 release before TuxCare onboarded it. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves deserialization of the gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool which can lead to RCE via JNDI injection. The fix (blocking this class in SubTypeValidator) was already included in the upstream 2.12.7.1 release before TuxCare onboarded it. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability relates to unsafe deserialization of org.jsecurity.realm.jndi.JndiRealmFactory, which could lead to JNDI injection attacks. The upstream vendor (FasterXML) added this class to the SubTypeValidator blocklist in commit f6d9c664f6 (June 2020). This fix was already present in the upstream 2.12.7.1 release that TuxCare onboarded, so the vulnerable pattern does not exist in the target code at the specified commit (37cc8aadb9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability relates to unsafe deserialization of org.jsecurity.realm.jndi.JndiRealmFactory, which could lead to JNDI injection attacks. The upstream vendor (FasterXML) added this class to the SubTypeValidator blocklist in commit f6d9c664f6 (June 2020). This fix was already present in the upstream 2.12.7.1 release that TuxCare onboarded, so the vulnerable pattern does not exist in the target code at the specified commit (37cc8aadb9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:21:16.269542+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves deserialization gadgets via polymorphic typing for br.com.anteros.dbcp.AnterosDBCPDataSource. The upstream vendor (FasterXML) fixed this in commit 3d97153944f7 by adding the class to SubTypeValidator's blocklist. This fix was included in upstream version 2.12.7.1, which TuxCare later onboarded. The target contains the blocklist entry at SubTypeValidator.java:147, preventing deserialization of the malicious gadget class. The fix shipped in the upstream release, not as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves deserialization gadgets via polymorphic typing for br.com.anteros.dbcp.AnterosDBCPDataSource. The upstream vendor (FasterXML) fixed this in commit 3d97153944f7 by adding the class to SubTypeValidator's blocklist. This fix was included in upstream version 2.12.7.1, which TuxCare later onboarded. The target contains the blocklist entry at SubTypeValidator.java:147, preventing deserialization of the malicious gadget class. The fix shipped in the upstream release, not as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:16:30.596459+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 affects jackson-databind versions before 2.6.7.5 and 2.7.x-2.9.x before 2.9.10.6 due to a deserialization gadget (com.pastdev.httpcomponents.configuration.JndiConfiguration) that enables JNDI injection attacks. The target repository version 2.12.7.1-tuxcare.4 is NOT AFFECTED because the fix was already present in the upstream 2.12.7.1 release before TuxCare onboarded it. The dangerous gadget class is blocked in SubTypeValidator.java:210, preventing its deserialization. The fix was authored by upstream maintainer Tatu Saloranta (commit 6cc9f1a1af) and shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 affects jackson-databind versions before 2.6.7.5 and 2.7.x-2.9.x before 2.9.10.6 due to a deserialization gadget (com.pastdev.httpcomponents.configuration.JndiConfiguration) that enables JNDI injection attacks. The target repository version 2.12.7.1-tuxcare.4 is NOT AFFECTED because the fix was already present in the upstream 2.12.7.1 release before TuxCare onboarded it. The dangerous gadget class is blocked in SubTypeValidator.java:210, preventing its deserialization. The fix was authored by upstream maintainer Tatu Saloranta (commit 6cc9f1a1af) and shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The fix was already included in the upstream release 2.12.7.1 that TuxCare onboarded. The vulnerable pattern (unsecured XML parsing allowing DOCTYPE/external DTD) has been removed by upstream commit 612f971b78 authored by Tatu Saloranta on 2020-01-09, which added two XML security features: disallow-doctype-decl=true and load-external-dtd=false. These protections are present in DOMDeserializer.java lines 43-49 and prevent XXE attacks by blocking DOCTYPE declarations and external DTD loading.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The fix was already included in the upstream release 2.12.7.1 that TuxCare onboarded. The vulnerable pattern (unsecured XML parsing allowing DOCTYPE/external DTD) has been removed by upstream commit 612f971b78 authored by Tatu Saloranta on 2020-01-09, which added two XML security features: disallow-doctype-decl=true and load-external-dtd=false. These protections are present in DOMDeserializer.java lines 43-49 and prevent XXE attacks by blocking DOCTYPE declarations and external DTD loading.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:22:15.181090+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability concerns deserialization gadget chains exploiting org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource classes. The upstream fix (commit 41b8bdb5cc) adds these classes to the deserialization blocklist in SubTypeValidator.java, preventing exploitation. This fix was already present in upstream version 2.12.7.1 when TuxCare onboarded it (first TuxCare commit c7e6f711f5 \"Onboard version 2.12.7.1\"), so the target has never been vulnerable at this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "CVE-2020-35490 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability concerns deserialization gadget chains exploiting org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource classes. The upstream fix (commit 41b8bdb5cc) adds these classes to the deserialization blocklist in SubTypeValidator.java, preventing exploitation. This fix was already present in upstream version 2.12.7.1 when TuxCare onboarded it (first TuxCare commit c7e6f711f5 \"Onboard version 2.12.7.1\"), so the target has never been vulnerable at this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T12:45:34.333226+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target version 2.12.7.1-tuxcare.3 is not affected by CVE-2020-35491. The vulnerability involves deserialization gadgets org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource that allow arbitrary code execution. The fix (blacklisting these classes in SubTypeValidator) was already present in the upstream 2.12.7.1 release that TuxCare onboarded, applied by upstream developer Tatu Saloranta in commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d on December 15, 2020. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "The target version 2.12.7.1-tuxcare.3 is not affected by CVE-2020-35491. The vulnerability involves deserialization gadgets org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource that allow arbitrary code execution. The fix (blacklisting these classes in SubTypeValidator) was already present in the upstream 2.12.7.1 release that TuxCare onboarded, applied by upstream developer Tatu Saloranta in commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d on December 15, 2020. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:55:19.903675+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.7.1-tuxcare.4 is not affected by CVE-2020-35728. The dangerous class `com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool` is blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java (line 240). This fix was introduced by upstream FasterXML in commit 1ca0388c2fb by Tatu Saloranta on 2020-12-26, and was already present in upstream version 2.12.7.1 when TuxCare onboarded it (first TuxCare commit c7e6f711f5 \"Onboard version 2.12.7.1\"). The blocklist is actively enforced during deserialization, preventing instantiation of the malicious gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "The target jackson-databind 2.12.7.1-tuxcare.4 is not affected by CVE-2020-35728. The dangerous class `com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool` is blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java (line 240). This fix was introduced by upstream FasterXML in commit 1ca0388c2fb by Tatu Saloranta on 2020-12-26, and was already present in upstream version 2.12.7.1 when TuxCare onboarded it (first TuxCare commit c7e6f711f5 \"Onboard version 2.12.7.1\"). The blocklist is actively enforced during deserialization, preventing instantiation of the malicious gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:24:51.671524+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is NOT present in jackson-databind 2.12.7.1. The vulnerability involves deserialization of the DriverAdapterCPDS gadget class variants that can lead to arbitrary code execution. The fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b) that adds all five DriverAdapterCPDS class name variants to the deserialization blacklist was already present in the upstream jackson-databind 2.12.7.1 release that TuxCare onboarded. The target's SubTypeValidator.java contains all required blacklist entries at lines 123, 193, 219, 228, and 234, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "CVE-2020-36179 is NOT present in jackson-databind 2.12.7.1. The vulnerability involves deserialization of the DriverAdapterCPDS gadget class variants that can lead to arbitrary code execution. The fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b) that adds all five DriverAdapterCPDS class name variants to the deserialization blacklist was already present in the upstream jackson-databind 2.12.7.1 release that TuxCare onboarded. The target's SubTypeValidator.java contains all required blacklist entries at lines 123, 193, 219, 228, and 234, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:37:21.976714+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.7.1-tuxcare.4 is not affected by CVE-2020-36180. The fix that blocks deserialization of DriverAdapterCPDS gadget classes was already present in upstream release 2.12.1 (committed 3ded28aece by Tatu Saloranta on 2020-12-31), which predates the 2.12.7.1 release that TuxCare onboarded. All five DriverAdapterCPDS class variants from the patch are present in the SubTypeValidator blocklist (lines 123, 193, 219, 228, 234), and the validation mechanism correctly blocks their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "The target jackson-databind 2.12.7.1-tuxcare.4 is not affected by CVE-2020-36180. The fix that blocks deserialization of DriverAdapterCPDS gadget classes was already present in upstream release 2.12.1 (committed 3ded28aece by Tatu Saloranta on 2020-12-31), which predates the 2.12.7.1 release that TuxCare onboarded. All five DriverAdapterCPDS class variants from the patch are present in the SubTypeValidator blocklist (lines 123, 193, 219, 228, 234), and the validation mechanism correctly blocks their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:42:20.075693+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability concerns deserialization of the gadget class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS` which could lead to remote code execution. The upstream vendor (FasterXML) fixed this in commit 3ded28aece6 by adding the class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was included in upstream release 2.12.1 (2020-12-31), well before the target's base version 2.12.7.1. The target contains all 5 package variations of DriverAdapterCPDS in the blocklist, and enforcement is verified through the validateSubType() check at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability concerns deserialization of the gadget class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS` which could lead to remote code execution. The upstream vendor (FasterXML) fixed this in commit 3ded28aece6 by adding the class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was included in upstream release 2.12.1 (2020-12-31), well before the target's base version 2.12.7.1. The target contains all 5 package variations of DriverAdapterCPDS in the blocklist, and enforcement is verified through the validateSubType() check at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:13:29.562378+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.7.1 is not affected by CVE-2020-36182. The vulnerability involves deserialization of malicious DriverAdapterCPDS gadget classes. The upstream vendor (Tatu Saloranta) applied a fix in commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b on Dec 31, 2020, adding all 5 DriverAdapterCPDS class variants to the SubTypeValidator blocklist. This fix was already present in the upstream 2.12.7.1 release before TuxCare onboarded it (first TuxCare commit c7e6f711f5 on the branch). The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "The target jackson-databind 2.12.7.1 is not affected by CVE-2020-36182. The vulnerability involves deserialization of malicious DriverAdapterCPDS gadget classes. The upstream vendor (Tatu Saloranta) applied a fix in commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b on Dec 31, 2020, adding all 5 DriverAdapterCPDS class variants to the SubTypeValidator blocklist. This fix was already present in the upstream 2.12.7.1 release before TuxCare onboarded it (first TuxCare commit c7e6f711f5 on the branch). The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:21:27.770551+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves deserialization gadgets related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool enabling JNDI injection attacks. The upstream fix (adding this class to the deserialization blacklist in SubTypeValidator.java) was already present in the upstream release 2.12.7.1 when TuxCare onboarded it. The fix is at line 243 of SubTypeValidator.java, committed by upstream author Tatu Saloranta on 2020-12-31 (commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29), predating the TuxCare onboarding commit c7e6f711f536829912152091bf850a1a7e110b30.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "CVE-2020-36183 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves deserialization gadgets related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool enabling JNDI injection attacks. The upstream fix (adding this class to the deserialization blacklist in SubTypeValidator.java) was already present in the upstream release 2.12.7.1 when TuxCare onboarded it. The fix is at line 243 of SubTypeValidator.java, committed by upstream author Tatu Saloranta on 2020-12-31 (commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29), predating the TuxCare onboarding commit c7e6f711f536829912152091bf850a1a7e110b30.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T12:27:39.447287+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is not present in jackson-databind 2.12.7.1-tuxcare.3. The fix (commit 567194c53a) was shipped in the upstream 2.12.7.1 release by FasterXML maintainer Tatu Saloranta on 2020-12-26, adding org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist. TuxCare onboarded this already-patched version on 2022+ via commit c7e6f711f5. The vulnerable gadget classes are blocked in SubTypeValidator.java lines 234-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 is not present in jackson-databind 2.12.7.1-tuxcare.3. The fix (commit 567194c53a) was shipped in the upstream 2.12.7.1 release by FasterXML maintainer Tatu Saloranta on 2020-12-26, adding org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist. TuxCare onboarded this already-patched version on 2022+ via commit c7e6f711f5. The vulnerable gadget classes are blocked in SubTypeValidator.java lines 234-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:06:30.945793+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability relates to deserialization gadgets `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource` and `PerUserPoolDataSource`. The upstream fix (commit 567194c53a by Tatu Saloranta, Dec 26, 2020) adds these classes to the deserialization blacklist in SubTypeValidator.java. This fix was already included in upstream release 2.12.7.1 (Oct 2022), which TuxCare subsequently onboarded. The vulnerable code pattern was never present in the version being maintained.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability relates to deserialization gadgets `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource` and `PerUserPoolDataSource`. The upstream fix (commit 567194c53a by Tatu Saloranta, Dec 26, 2020) adds these classes to the deserialization blacklist in SubTypeValidator.java. This fix was already included in upstream release 2.12.7.1 (Oct 2022), which TuxCare subsequently onboarded. The vulnerable code pattern was never present in the version being maintained.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:33:43.598820+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.7.1 is NOT AFFECTED by CVE-2020-36186. The upstream fix (commit 3e8fa3beea by Tatu Saloranta, \"Fixed #2997\") shipped in the 2.12.7.1 release before TuxCare onboarding. The fix adds blocklist entries for org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource to SubTypeValidator.java (lines 229-230), preventing their deserialization. The validation logic at line 269 actively checks this blocklist and throws a security exception at line 302-303 when these classes are encountered during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "Target version 2.12.7.1 is NOT AFFECTED by CVE-2020-36186. The upstream fix (commit 3e8fa3beea by Tatu Saloranta, \"Fixed #2997\") shipped in the 2.12.7.1 release before TuxCare onboarding. The fix adds blocklist entries for org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource to SubTypeValidator.java (lines 229-230), preventing their deserialization. The validation logic at line 269 actively checks this blocklist and throws a security exception at line 302-303 when these classes are encountered during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:46:48.486669+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability concerns deserialization gadget classes org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource that could enable arbitrary code execution. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in upstream release 2.12.7.1 before TuxCare's onboarding, confirmed by the fix commit being an ancestor of the first TuxCare commit (c7e6f711f536829912152091bf850a1a7e110b30).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "CVE-2020-36187 is not present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability concerns deserialization gadget classes org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource that could enable arbitrary code execution. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in upstream release 2.12.7.1 before TuxCare's onboarding, confirmed by the fix commit being an ancestor of the first TuxCare commit (c7e6f711f536829912152091bf850a1a7e110b30).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:52:30.603754+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5, allowing deserialization of malicious gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) that enable remote code execution via JNDI injection. The target repository is jackson-databind version 2.12.7.1-tuxcare.4, which already contains the upstream fix. The fix was applied in upstream commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 by Tatu Saloranta (upstream maintainer) and shipped in the upstream release 2.12.7.1 before TuxCare onboarded it. The fix adds both gadget class names to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 223-224), which is enforced during polymorphic deserialization by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5, allowing deserialization of malicious gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) that enable remote code execution via JNDI injection. The target repository is jackson-databind version 2.12.7.1-tuxcare.4, which already contains the upstream fix. The fix was applied in upstream commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 by Tatu Saloranta (upstream maintainer) and shipped in the upstream release 2.12.7.1 before TuxCare onboarded it. The fix adds both gadget class names to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 223-224), which is enforced during polymorphic deserialization by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:03:12.649222+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is not present in jackson-databind 2.12.7.1-tuxcare.3. The vulnerable gadget class com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource is blocked by the denylist in SubTypeValidator.java (line 224). This fix was added by upstream Jackson maintainer Tatu Saloranta in commit 33d96c13fe on Dec 26, 2020, and was already present in the upstream 2.12.7.1 release that TuxCare onboarded. The CVE affects versions before 2.9.10.8; version 2.12.7.1 is well beyond that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 is not present in jackson-databind 2.12.7.1-tuxcare.3. The vulnerable gadget class com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource is blocked by the denylist in SubTypeValidator.java (line 224). This fix was added by upstream Jackson maintainer Tatu Saloranta in commit 33d96c13fe on Dec 26, 2020, and was already present in the upstream 2.12.7.1 release that TuxCare onboarded. The CVE affects versions before 2.9.10.8; version 2.12.7.1 is well beyond that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:51:42.944049+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2020-36518: unbounded recursion in jackson-databind's untyped deserializer lets deeply nested JSON exhaust the JVM stack (StackOverflowError \u2192 DoS) for versions before 2.13.0. Target is jackson-databind 2.12.7.1 (TuxCare ELS fork). The canonical upstream fix \u2014 a MAX_DEPTH=1000 nesting-depth limit in UntypedObjectDeserializer.Vanilla \u2014 is PRESENT and functionally complete in the target. deserialize() checks `depth > MAX_DEPTH` and throws JsonParseException(\"JSON is too deeply nested.\") before recursing (lines 714-715, 730-731); depth is incremented once per nesting level via `++depth` at the top of mapArray (879), mapArrayToArray (918), and mapObject (938). This matches upstream commit fcfc4998 exactly. The fix was introduced by upstream commit 83b928dab9 \"Prepare for 2.12.6.1 release\" (upstream's dedicated security release for CVE-2020-36518), authored and committed by upstream maintainer Tatu Saloranta . That commit is an ancestor of the TuxCare onboard commit c7e6f711f, so the fix is part of the onboarded upstream baseline \u2014 NOT a TuxCare backport. Because an upstream/vendor-authored fix is already applied in the shipped version, the vulnerable pattern is not present in HEAD \u2192 not_affected, justification code_not_present. (Note: TuxCare's own CVE-2020-36518 backport exists only on the older 2.12.1 branch (ea53359db), which predated the upstream fix; 2.12.7.1 needed no such backport.) [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "not_affected \u2014 CVE-2020-36518: unbounded recursion in jackson-databind's untyped deserializer lets deeply nested JSON exhaust the JVM stack (StackOverflowError \u2192 DoS) for versions before 2.13.0. Target is jackson-databind 2.12.7.1 (TuxCare ELS fork). The canonical upstream fix \u2014 a MAX_DEPTH=1000 nesting-depth limit in UntypedObjectDeserializer.Vanilla \u2014 is PRESENT and functionally complete in the target. deserialize() checks `depth > MAX_DEPTH` and throws JsonParseException(\"JSON is too deeply nested.\") before recursing (lines 714-715, 730-731); depth is incremented once per nesting level via `++depth` at the top of mapArray (879), mapArrayToArray (918), and mapObject (938). This matches upstream commit fcfc4998 exactly. The fix was introduced by upstream commit 83b928dab9 \"Prepare for 2.12.6.1 release\" (upstream's dedicated security release for CVE-2020-36518), authored and committed by upstream maintainer Tatu Saloranta . That commit is an ancestor of the TuxCare onboard commit c7e6f711f, so the fix is part of the onboarded upstream baseline \u2014 NOT a TuxCare backport. Because an upstream/vendor-authored fix is already applied in the shipped version, the vulnerable pattern is not present in HEAD \u2192 not_affected, justification code_not_present. (Note: TuxCare's own CVE-2020-36518 backport exists only on the older 2.12.1 branch (ea53359db), which predated the upstream fix; 2.12.7.1 needed no such backport.) [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:12:27.199890+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is not present in jackson-databind 2.12.7.1. The upstream fix (commit 9bb52c7122 by tatu.saloranta@iki.fi) adding \"org.apache.xbean.propertyeditor.JndiConverter\" to the deserialization blocklist was shipped in jackson-databind 2.10.4 (February 2020). The target version 2.12.7.1 (April 2021) already contained this fix when TuxCare onboarded it via commit c7e6f711f5. The blocklist entry is present at SubTypeValidator.java:138 and actively enforced via BeanDeserializerFactory.java:1000, blocking polymorphic deserialization of the JNDI gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 is not present in jackson-databind 2.12.7.1. The upstream fix (commit 9bb52c7122 by tatu.saloranta@iki.fi) adding \"org.apache.xbean.propertyeditor.JndiConverter\" to the deserialization blocklist was shipped in jackson-databind 2.10.4 (February 2020). The target version 2.12.7.1 (April 2021) already contained this fix when TuxCare onboarded it via commit c7e6f711f5. The blocklist entry is present at SubTypeValidator.java:138 and actively enforced via BeanDeserializerFactory.java:1000, blocking polymorphic deserialization of the JNDI gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves Jackson deserialization gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig that can be exploited for remote code execution through malicious JSON payloads with polymorphic type information. The upstream vendor (Tatu Saloranta) fixed this in commit 1e64db6a2f by adding the gadget class to the deserialization blacklist in SubTypeValidator.java. This fix was included in upstream version 2.9.10.4 (Feb 2020) and all subsequent releases. The target version 2.12.7.1 (released much later) already contains this fix as it shipped in the upstream release that TuxCare onboarded. The blacklist entry is present at line 141 of SubTypeValidator.java, preventing deserialization of the malicious gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability involves Jackson deserialization gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig that can be exploited for remote code execution through malicious JSON payloads with polymorphic type information. The upstream vendor (Tatu Saloranta) fixed this in commit 1e64db6a2f by adding the gadget class to the deserialization blacklist in SubTypeValidator.java. This fix was included in upstream version 2.9.10.4 (Feb 2020) and all subsequent releases. The target version 2.12.7.1 (released much later) already contains this fix as it shipped in the upstream release that TuxCare onboarded. The blacklist entry is present at line 141 of SubTypeValidator.java, preventing deserialization of the malicious gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:43:13.146994+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 does not affect this target. The upstream vendor (FasterXML) fixed this vulnerability by adding com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig to the deserialization blocklist in SubTypeValidator.java. This fix (commit 9f4e97019f by Tatu Saloranta) was already present in upstream release 2.12.7.1 when TuxCare onboarded it. The blocklist prevents Jackson from deserializing JSON into this dangerous gadget class, blocking the attack chain before arbitrary code execution can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 does not affect this target. The upstream vendor (FasterXML) fixed this vulnerability by adding com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig to the deserialization blocklist in SubTypeValidator.java. This fix (commit 9f4e97019f by Tatu Saloranta) was already present in upstream release 2.12.7.1 when TuxCare onboarded it. The blocklist prevents Jackson from deserializing JSON into this dangerous gadget class, blocking the attack chain before arbitrary code execution can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:17:04.637381+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.7.1-tuxcare.4 is not affected by CVE-2020-9548. The vulnerability (unsafe deserialization of br.com.anteros.dbcp.AnterosDBCPConfig gadget class) was fixed in upstream jackson-databind before version 2.12.7.1 was released. The fix commit 9f4e97019fb (2020-02-29) added the gadget class to SubTypeValidator's denylist, preventing its deserialization. This fix was already present when TuxCare onboarded version 2.12.7.1 on 2026-09-15. CVE-2020-9548 affected jackson-databind 2.x before 2.9.10.4, but version 2.12.7.1 (released years later) shipped with the fix included.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "Target jackson-databind 2.12.7.1-tuxcare.4 is not affected by CVE-2020-9548. The vulnerability (unsafe deserialization of br.com.anteros.dbcp.AnterosDBCPConfig gadget class) was fixed in upstream jackson-databind before version 2.12.7.1 was released. The fix commit 9f4e97019fb (2020-02-29) added the gadget class to SubTypeValidator's denylist, preventing its deserialization. This fix was already present when TuxCare onboarded version 2.12.7.1 on 2026-09-15. CVE-2020-9548 affected jackson-databind 2.x before 2.9.10.4, but version 2.12.7.1 (released years later) shipped with the fix included.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:15:32.499277+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.7.1-tuxcare.4) is not affected by CVE-2021-20190. The vulnerability involves deserialization gadgets that allow execution of attacker-controlled operations through instantiation of dangerous classes. The upstream vendor (FasterXML) fixed this by adding multiple classes to the SubTypeValidator blocklist before version 2.12.7.1 was released. Both fix commits (7dbf51bf78 and 08fbfacf89) are ancestors of the first TuxCare commit (c7e6f711f5 \"Onboard version 2.12.7.1\"), confirming the fixes were already present in the upstream release that TuxCare onboarded. The blocklist defense is active in SubTypeValidator.java at lines 149-214 and is invoked during deserialization at BeanDeserializerFactory.java:1000.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "The target repository (jackson-databind 2.12.7.1-tuxcare.4) is not affected by CVE-2021-20190. The vulnerability involves deserialization gadgets that allow execution of attacker-controlled operations through instantiation of dangerous classes. The upstream vendor (FasterXML) fixed this by adding multiple classes to the SubTypeValidator blocklist before version 2.12.7.1 was released. Both fix commits (7dbf51bf78 and 08fbfacf89) are ancestors of the first TuxCare commit (c7e6f711f5 \"Onboard version 2.12.7.1\"), confirming the fixes were already present in the upstream release that TuxCare onboarded. The blocklist defense is active in SubTypeValidator.java at lines 149-214 and is invoked during deserialization at BeanDeserializerFactory.java:1000.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.7.1 is not affected by CVE-2021-46877. The upstream vendor fix (commit 3ccde7d938 by Tatu Saloranta) was already present in the release when TuxCare onboarded it. The fix implements chunked reading in NodeSerialization.readExternal() with a 100k eager allocation limit, preventing excessive transient heap allocation from malicious deserialization length values.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "Target version 2.12.7.1 is not affected by CVE-2021-46877. The upstream vendor fix (commit 3ccde7d938 by Tatu Saloranta) was already present in the release when TuxCare onboarded it. The fix implements chunked reading in NodeSerialization.readExternal() with a 100k eager allocation limit, preventing excessive transient heap allocation from malicious deserialization length values.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:46:18.460067+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.7.1) is not affected by CVE-2022-42003. The upstream fix for this vulnerability (commit cd090979b7) was already included in the upstream 2.12.7.1 release that TuxCare onboarded. The defense code that prevents deep wrapper array nesting during UNWRAP_SINGLE_VALUE_ARRAYS deserialization is present in both StdDeserializer.java and BeanDeserializer.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "The target repository (jackson-databind 2.12.7.1) is not affected by CVE-2022-42003. The upstream fix for this vulnerability (commit cd090979b7) was already included in the upstream 2.12.7.1 release that TuxCare onboarded. The defense code that prevents deep wrapper array nesting during UNWRAP_SINGLE_VALUE_ARRAYS deserialization is present in both StdDeserializer.java and BeanDeserializer.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:58:37.746578+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in the upstream 2.12.7.1 release. The fix commit cd090979b7ea78c75e4de8a4aed04f7e9fa8deea, authored by upstream contributor Cesar Hernandez, was included in the upstream release that TuxCare onboarded at commit c7e6f711f536829912152091bf850a1a7e110b30. The defense code at BeanDeserializer.java:634-642 checks for a second START_ARRAY token after unwrapping the first array layer and rejects deeply-nested input with an appropriate error message, preventing unbounded recursion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "CVE-2022-42004 is NOT present in jackson-databind 2.12.7.1-tuxcare.4. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in the upstream 2.12.7.1 release. The fix commit cd090979b7ea78c75e4de8a4aed04f7e9fa8deea, authored by upstream contributor Cesar Hernandez, was included in the upstream release that TuxCare onboarded at commit c7e6f711f536829912152091bf850a1a7e110b30. The defense code at BeanDeserializer.java:634-642 checks for a second START_ARRAY token after unwrapping the first array layer and rejects deeply-nested input with an appropriate error message, preventing unbounded recursion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:51:42.944049+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:51:42.944049+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:51:42.944049+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:51:42.944049+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:51:42.944049+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:51:42.944049+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:51:42.944049+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:51:42.944049+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:51:42.944049+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:51:42.944049+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-03T02:09:25.645620+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54518 affects UnwrappedPropertyHandler.processUnwrappedCreatorProperties(), which does not exist in target version 2.12.7.1. The feature enabling @JsonUnwrapped on creator parameters was added in version 2.19 (commit 502fe888da, not in HEAD). The target explicitly rejects this combination during bean introspection with error \"Cannot define Creator parameter %d as `@JsonUnwrapped`: comb...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 CVE-2026-54518 affects UnwrappedPropertyHandler.processUnwrappedCreatorProperties(), which does not exist in target version 2.12.7.1. The feature enabling @JsonUnwrapped on creator parameters was added in version 2.19 (commit 502fe888da, not in HEAD). The target explicitly rejects this combination during bean introspection with error \"Cannot define Creator parameter %d as `@JsonUnwrapped`: comb..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-05T10:01:09.466662+00:00", "status_notes": "Vulnerability CVE-2026-59888 affects version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.7.1-tuxcare.5.", "vulnerability": { "name": "CVE-2026-59888" }, "action_statement": "Vulnerability CVE-2026-59888 affects version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.7.1-tuxcare.5." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:52:00.139283+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-05T10:00:47.215514+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.7.1-tuxcare.5.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.7.1-tuxcare.5." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:52:00.139283+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:52:00.139283+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:53:00.133994+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:53:00.133994+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:51:42.944049+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.12.7.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.4" } } ], "timestamp": "2026-11-01T15:51:42.944049+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.12.7.1-tuxcare.4.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }