{ "@id": "urn:uuid:317f2c1f-00b7-4ad8-82d3-61b7a9c65eaf", "role": "Document Creator", "author": "https://tuxcare.com", "version": 62, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T11:02:56.280755+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:04:07.366670+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability affects versions prior to 2.8.11 and 2.9.4, allowing polymorphic deserialization of dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and Spring/C3P0 classes). The target contains the upstream fix: all required classes are blacklisted in SubTypeValidator.java (lines 47-48, 51, and 288-297 for Spring/C3P0 prefix matching). The validation is active on the deserialization code path (BeanDeserializerFactory:140 \u2192 SubTypeValidator:259-304). Fix authored by Derek Straka (derek@asterius.io) in commit a054585e, shipped in upstream jackson-databind 2.13.2.2 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability affects versions prior to 2.8.11 and 2.9.4, allowing polymorphic deserialization of dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and Spring/C3P0 classes). The target contains the upstream fix: all required classes are blacklisted in SubTypeValidator.java (lines 47-48, 51, and 288-297 for Spring/C3P0 prefix matching). The validation is active on the deserialization code path (BeanDeserializerFactory:140 \u2192 SubTypeValidator:259-304). Fix authored by Derek Straka (derek@asterius.io) in commit a054585e, shipped in upstream jackson-databind 2.13.2.2 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:39:34.721796+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.13.2.2 contains the complete upstream fix that was released in December 2017. The SubTypeValidator class includes all required blacklist entries (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring classes, C3P0 classes, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader) and implements sophisticated hierarchy-checking logic for Spring framework classes to prevent bypasses. The fix was authored by upstream maintainers (andrew.tolbert@datastax.com, committed by tsaloranta@gmail.com) and shipped in the upstream release before TuxCare onboarded version 2.13.2.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.13.2.2 contains the complete upstream fix that was released in December 2017. The SubTypeValidator class includes all required blacklist entries (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring classes, C3P0 classes, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader) and implements sophisticated hierarchy-checking logic for Spring framework classes to prevent bypasses. The fix was authored by upstream maintainers (andrew.tolbert@datastax.com, committed by tsaloranta@gmail.com) and shipped in the upstream release before TuxCare onboarded version 2.13.2.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:24:51.161829+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability allowed arbitrary code execution through polymorphic deserialization of dangerous classes (TemplatesImpl, InvokerTransformer, etc.). The target contains the upstream fix via SubTypeValidator, which validates all bean deserializations against a comprehensive blacklist of dangerous classes. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.13.2.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability allowed arbitrary code execution through polymorphic deserialization of dangerous classes (TemplatesImpl, InvokerTransformer, etc.). The target contains the upstream fix via SubTypeValidator, which validates all bean deserializations against a comprehensive blacklist of dangerous classes. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.13.2.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:13:11.896857+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves deserialization of org.apache.ibatis.parsing.XPathParser as a gadget class for data exfiltration via XML external entities. The fix (blacklisting this class) was applied by upstream maintainer Tatu Saloranta in commit 27b4defc270454dea6842bd9279f17387eceb737 (May 2018) and was already present in upstream release 2.13.2.2 before TuxCare onboarded it. The target contains the required blacklist entry at SubTypeValidator.java:65, preventing exploitation of this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves deserialization of org.apache.ibatis.parsing.XPathParser as a gadget class for data exfiltration via XML external entities. The fix (blacklisting this class) was applied by upstream maintainer Tatu Saloranta in commit 27b4defc270454dea6842bd9279f17387eceb737 (May 2018) and was already present in upstream release 2.13.2.2 before TuxCare onboarded it. The target contains the required blacklist entry at SubTypeValidator.java:65, preventing exploitation of this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T17:14:22.639496+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.2.2-tuxcare.3 is not affected by CVE-2018-12022. The vulnerability was fixed in upstream commit 28badf7ef6 which added blacklist entries to SubTypeValidator.java to prevent polymorphic deserialization of dangerous classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet). This fix was already present in upstream release 2.13.2.2 when TuxCare onboarded it (first TuxCare commit 5daf400db1), preventing the JNDI/LDAP injection attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "The target jackson-databind version 2.13.2.2-tuxcare.3 is not affected by CVE-2018-12022. The vulnerability was fixed in upstream commit 28badf7ef6 which added blacklist entries to SubTypeValidator.java to prevent polymorphic deserialization of dangerous classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet). This fix was already present in upstream release 2.13.2.2 when TuxCare onboarded it (first TuxCare commit 5daf400db1), preventing the JNDI/LDAP injection attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:16:13.062310+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.13.2.2-tuxcare.3 is NOT AFFECTED by CVE-2018-12023. The vulnerability, which allowed remote code execution via polymorphic deserialization of Oracle JDBC classes when Default Typing is enabled, was fixed in the upstream release before TuxCare onboarded version 2.13.2.2. The fix (commit 28badf7ef6 by upstream maintainer Tatu Saloranta) adds oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet to the SubTypeValidator blacklist, preventing their deserialization. This upstream fix is present in the target at SubTypeValidator.java lines 70-72.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "The target repository jackson-databind 2.13.2.2-tuxcare.3 is NOT AFFECTED by CVE-2018-12023. The vulnerability, which allowed remote code execution via polymorphic deserialization of Oracle JDBC classes when Default Typing is enabled, was fixed in the upstream release before TuxCare onboarded version 2.13.2.2. The fix (commit 28badf7ef6 by upstream maintainer Tatu Saloranta) adds oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet to the SubTypeValidator blacklist, preventing their deserialization. This upstream fix is present in the target at SubTypeValidator.java lines 70-72.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:39:52.216680+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in commit 87d29af25e by adding org.slf4j.ext.EventData and three other gadget classes to the deserialization blacklist. This fix was already included in the upstream release 2.13.2.2 before TuxCare's onboarding (commit 5daf400db1), so the vulnerable pattern has never been present in this TuxCare-maintained version. The blacklist is enforced via SubTypeValidator.validateSubType() which is called during bean deserialization and blocks instantiation of dangerous classes with a security error.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in commit 87d29af25e by adding org.slf4j.ext.EventData and three other gadget classes to the deserialization blacklist. This fix was already included in the upstream release 2.13.2.2 before TuxCare's onboarding (commit 5daf400db1), so the vulnerable pattern has never been present in this TuxCare-maintained version. The blacklist is enforced via SubTypeValidator.validateSubType() which is called during bean deserialization and blocks instantiation of dangerous classes with a security error.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:55:45.566943+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 addresses polymorphic deserialization vulnerability with blaze-ds classes. The target repository jackson-databind 2.13.2.2-tuxcare.3 is NOT AFFECTED because the fix was already present in the upstream version 2.13.2.2 when TuxCare onboarded it. The dangerous class `flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor` (from Adobe BlazeDS framework) is blacklisted in SubTypeValidator.java:76, preventing its deserialization. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e, which predates the first TuxCare commit on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 addresses polymorphic deserialization vulnerability with blaze-ds classes. The target repository jackson-databind 2.13.2.2-tuxcare.3 is NOT AFFECTED because the fix was already present in the upstream version 2.13.2.2 when TuxCare onboarded it. The dangerous class `flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor` (from Adobe BlazeDS framework) is blacklisted in SubTypeValidator.java:76, preventing its deserialization. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e, which predates the first TuxCare commit on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:03:03.714600+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.2.2-tuxcare.3 is not affected by CVE-2018-14720. The upstream fix (commit 87d29af25e) blocking 4 dangerous classes from polymorphic deserialization was already present in upstream release 2.13.2.2 when TuxCare onboarded it. All 4 classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are in the SubTypeValidator blocklist and will be rejected during deserialization with a security exception. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "Target jackson-databind 2.13.2.2-tuxcare.3 is not affected by CVE-2018-14720. The upstream fix (commit 87d29af25e) blocking 4 dangerous classes from polymorphic deserialization was already present in upstream release 2.13.2.2 when TuxCare onboarded it. All 4 classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are in the SubTypeValidator blocklist and will be rejected during deserialization with a security exception. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:31:31.792596+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl enabling SSRF attacks. The fix (blacklisting this class) was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e and was already included in upstream release 2.13.2.2 before TuxCare onboarded it. The blacklist entry is present at SubTypeValidator.java:78 and enforced by validateSubType() which throws \"Illegal type to deserialize: prevented for security reasons\" when the class is detected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability concerns polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl enabling SSRF attacks. The fix (blacklisting this class) was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e and was already included in upstream release 2.13.2.2 before TuxCare onboarded it. The blacklist entry is present at SubTypeValidator.java:78 and enforced by validateSubType() which throws \"Illegal type to deserialize: prevented for security reasons\" when the class is detected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:34:10.404462+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is not present in jackson-databind 2.13.2.2-tuxcare.2. The vulnerability concerns unsafe polymorphic deserialization of the class org.apache.axis2.transport.jms.JMSOutTransportInfo. The upstream fix (commit 72cd4025a2 by Tatu Saloranta) added this class to the blocklist in SubTypeValidator.java, and this fix was already present in the upstream release 2.13.2.2 that TuxCare onboarded. The target repository contains the fix at line 85 of SubTypeValidator.java, preventing deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 is not present in jackson-databind 2.13.2.2-tuxcare.2. The vulnerability concerns unsafe polymorphic deserialization of the class org.apache.axis2.transport.jms.JMSOutTransportInfo. The upstream fix (commit 72cd4025a2 by Tatu Saloranta) added this class to the blocklist in SubTypeValidator.java, and this fix was already present in the upstream release 2.13.2.2 that TuxCare onboarded. The target repository contains the fix at line 85 of SubTypeValidator.java, preventing deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:52:51.215173+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind 2.x before 2.9.8 due to failure to block OpenJPA classes from polymorphic deserialization. The target version 2.13.2.2-tuxcare.3 is not affected because the upstream fix (commit 72cd4025a2) was already included in the upstream release 2.13.2.2 that TuxCare onboarded. The SubTypeValidator.java blacklist contains both org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime (lines 82-83), preventing their deserialization. This is an upstream fix authored by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 affects jackson-databind 2.x before 2.9.8 due to failure to block OpenJPA classes from polymorphic deserialization. The target version 2.13.2.2-tuxcare.3 is not affected because the upstream fix (commit 72cd4025a2) was already included in the upstream release 2.13.2.2 that TuxCare onboarded. The SubTypeValidator.java blacklist contains both org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime (lines 82-83), preventing their deserialization. This is an upstream fix authored by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:22:50.869254+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind versions before 2.9.8 due to failure to block org.jboss.util.propertyeditor.DocumentEditor (jboss-common-core) from polymorphic deserialization. The target version 2.13.2.2-tuxcare.3 contains the upstream fix that was shipped in release 2.9.8 and inherited through version 2.13.2.2. The fix adds DocumentEditor and other gadget classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, which is enforced during deserialization via BeanDeserializerFactory. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 affects jackson-databind versions before 2.9.8 due to failure to block org.jboss.util.propertyeditor.DocumentEditor (jboss-common-core) from polymorphic deserialization. The target version 2.13.2.2-tuxcare.3 contains the upstream fix that was shipped in release 2.9.8 and inherited through version 2.13.2.2. The fix adds DocumentEditor and other gadget classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, which is enforced during deserialization via BeanDeserializerFactory. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3, allowing remote code execution via two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the deserialization blacklist. The target version 2.13.2.2-tuxcare.3 is NOT vulnerable because the upstream fix (commit 038b471e2e from jackson-databind-2.8.11.1, January 2018) was already included in the upstream release that TuxCare onboarded. The blacklist entries blocking these two gadget classes are present in SubTypeValidator.java lines 62-63.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3, allowing remote code execution via two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the deserialization blacklist. The target version 2.13.2.2-tuxcare.3 is NOT vulnerable because the upstream fix (commit 038b471e2e from jackson-databind-2.8.11.1, January 2018) was already included in the upstream release that TuxCare onboarded. The blacklist entries blocking these two gadget classes are present in SubTypeValidator.java lines 62-63.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:33:56.225785+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.2.2-tuxcare.3 is not affected by CVE-2018-7489. The c3p0 deserialization vulnerability fix was already present in the upstream jackson-databind 2.13.2.2 release that TuxCare onboarded. The fix (commit 6799f8f10c by upstream maintainer Tatu Saloranta) blocks deserialization of c3p0 DataSource classes in SubTypeValidator.java lines 288-298, implementing the exact defense required to prevent this RCE attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "Target version 2.13.2.2-tuxcare.3 is not affected by CVE-2018-7489. The c3p0 deserialization vulnerability fix was already present in the upstream jackson-databind 2.13.2.2 release that TuxCare onboarded. The fix (commit 6799f8f10c by upstream maintainer Tatu Saloranta) blocks deserialization of c3p0 DataSource classes in SubTypeValidator.java lines 288-298, implementing the exact defense required to prevent this RCE attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:28:57.615729+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves polymorphic deserialization of com.mysql.cj.jdbc.admin.MiniAdmin when Default Typing is enabled, which could allow arbitrary file access. The fix (adding MiniAdmin to the deserialization blacklist) was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.13.2.2, before TuxCare onboarding. The defense is present at SubTypeValidator.java:88 and fully integrated into the deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves polymorphic deserialization of com.mysql.cj.jdbc.admin.MiniAdmin when Default Typing is enabled, which could allow arbitrary file access. The fix (adding MiniAdmin to the deserialization blacklist) was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.13.2.2, before TuxCare onboarding. The defense is present at SubTypeValidator.java:88 and fully integrated into the deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T18:22:45.256819+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind version 2.13.2.2-tuxcare.3 is NOT AFFECTED by CVE-2019-12384. The vulnerability involves failure to block ch.qos.logback.core.db.DriverManagerConnectionSource from polymorphic deserialization, which could lead to RCE. However, the fix for this CVE was already present in the upstream release that TuxCare onboarded. The blocklist entry for the dangerous logback class i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 The target jackson-databind version 2.13.2.2-tuxcare.3 is NOT AFFECTED by CVE-2019-12384. The vulnerability involves failure to block ch.qos.logback.core.db.DriverManagerConnectionSource from polymorphic deserialization, which could lead to RCE. However, the fix for this CVE was already present in the upstream release that TuxCare onboarded. The blocklist entry for the dangerous logback class i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-02T07:05:03.933459+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves deserialization of JDOM XSLTransformer classes that can read arbitrary files when polymorphic typing is enabled. The upstream vendor (FasterXML) fixed this in commit 5f7c69bba0 (June 2019) by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the SubTypeValidator bloc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves deserialization of JDOM XSLTransformer classes that can read arbitrary files when polymorphic typing is enabled. The upstream vendor (FasterXML) fixed this in commit 5f7c69bba0 (June 2019) by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the SubTypeValidator bloc..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T11:59:19.723998+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.13.2.2. The upstream vendor fix (commit ad418eeb97 by Tatu Saloranta) that blacklists the dangerous classes `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` and `ch.qos.logback.core.db.JNDIConnectionSource` was already included in the upstream release 2.13.2.2 that TuxCare onboarded. Both classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 98, 102), preventing their deserialization and blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.13.2.2. The upstream vendor fix (commit ad418eeb97 by Tatu Saloranta) that blacklists the dangerous classes `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` and `ch.qos.logback.core.db.JNDIConnectionSource` was already included in the upstream release 2.13.2.2 that TuxCare onboarded. Both classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 98, 102), preventing their deserialization and blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:28:16.907403+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The upstream fix (commit ad418eeb97) that adds `ch.qos.logback.core.db.JNDIConnectionSource` and `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` to the deserialization blacklist was already included in the upstream 2.13.2.2 release that TuxCare onboarded. The fix is present in SubTypeValidator.java lines 98 and 102, blocking deserialization of these dangerous classes when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The upstream fix (commit ad418eeb97) that adds `ch.qos.logback.core.db.JNDIConnectionSource` and `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` to the deserialization blacklist was already included in the upstream 2.13.2.2 release that TuxCare onboarded. The fix is present in SubTypeValidator.java lines 98 and 102, blocking deserialization of these dangerous classes when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:43:30.480251+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The fix (adding com.zaxxer.hikari.HikariConfig and HikariDataSource to the deserialization blocklist) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java lines 104-107, and the validation logic properly checks the blocklist at line 269. The vulnerable pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The fix (adding com.zaxxer.hikari.HikariConfig and HikariDataSource to the deserialization blocklist) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java lines 104-107, and the validation logic properly checks the blocklist at line 269. The vulnerable pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:52:11.742351+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves polymorphic deserialization of malicious commons-configuration JNDI classes that can lead to arbitrary code execution via JNDI injection. The upstream fix, which adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist in SubTypeValidator.java, was already present in the upstream release 2.13.2.2 when TuxCare onboarded it. The fix was authored by Tatu Saloranta (upstream maintainer) in September 2019, well before the 2.13.2.2 release in March 2022. The target repository inherited this protection from upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves polymorphic deserialization of malicious commons-configuration JNDI classes that can lead to arbitrary code execution via JNDI injection. The upstream fix, which adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist in SubTypeValidator.java, was already present in the upstream release 2.13.2.2 when TuxCare onboarded it. The fix was authored by Tatu Saloranta (upstream maintainer) in September 2019, well before the 2.13.2.2 release in March 2022. The target repository inherited this protection from upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893: Target version 2.13.2.2 is not affected. The upstream vendor fix (commit 998efd7082) that blocks deserialization of org.apache.xalan.lib.sql.JNDIConnectionPool was already present in version 2.13.2.2 when TuxCare onboarded it. The blocklist entry at SubTypeValidator.java:117 prevents the polymorphic deserialization attack, breaking the chain from malicious JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893: Target version 2.13.2.2 is not affected. The upstream vendor fix (commit 998efd7082) that blocks deserialization of org.apache.xalan.lib.sql.JNDIConnectionPool was already present in version 2.13.2.2 when TuxCare onboarded it. The blocklist entry at SubTypeValidator.java:117 prevents the polymorphic deserialization attack, breaking the chain from malicious JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T17:01:04.850496+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to arbitrary code execution. The fix (adding HikariDataSource to the SubTypeValidator blacklist) was already present in the upstream release 2.13.2.2 that TuxCare onboarded. The target is not affected because the vulnerable pattern was removed by the upstream vendor (FasterXML) before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to arbitrary code execution. The fix (adding HikariDataSource to the SubTypeValidator blacklist) was already present in the upstream release 2.13.2.2 that TuxCare onboarded. The target is not affected because the vulnerable pattern was removed by the upstream vendor (FasterXML) before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:00:13.288450+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind 2.0.0 through 2.9.10 due to polymorphic typing issues with commons-dbcp classes. The target version 2.13.2.2-tuxcare.3 already contains the upstream fix that adds org.apache.commons.dbcp.datasources.PerUserPoolDataSource and org.apache.commons.dbcp.datasources.SharedPoolDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta in commit 9593e16cf5 and was included in the upstream release 2.13.2.2 that TuxCare onboarded, well before any TuxCare-specific modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 affects jackson-databind 2.0.0 through 2.9.10 due to polymorphic typing issues with commons-dbcp classes. The target version 2.13.2.2-tuxcare.3 already contains the upstream fix that adds org.apache.commons.dbcp.datasources.PerUserPoolDataSource and org.apache.commons.dbcp.datasources.SharedPoolDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta in commit 9593e16cf5 and was included in the upstream release 2.13.2.2 that TuxCare onboarded, well before any TuxCare-specific modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T17:11:18.856766+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.13.2.2. The vulnerability involved deserialization of dangerous classes (com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes) when polymorphic typing is enabled. The upstream fix (commit 9593e16cf5) added these classes to a blocklist in SubTypeValidator.java, preventing their deserialization. This fix was already included in the upstream version 2.13.2.2 that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.13.2.2. The vulnerability involved deserialization of dangerous classes (com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes) when polymorphic typing is enabled. The upstream fix (commit 9593e16cf5) added these classes to a blocklist in SubTypeValidator.java, preventing their deserialization. This fix was already included in the upstream version 2.13.2.2 that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:26:10.977883+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.2.2-tuxcare.3 is NOT AFFECTED by CVE-2019-17267. The vulnerability relates to polymorphic deserialization of the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup, which could enable JNDI injection attacks. The upstream fix (commit 191a4cdf87) that adds this class to the deserialization blocklist was already present in the upstream release 2.13.2.2 that TuxCare onboarded. The vulnerable pattern (ability to deserialize this dangerous class) is not present in the target because SubTypeValidator rejects it at line 99 before any deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "The target jackson-databind version 2.13.2.2-tuxcare.3 is NOT AFFECTED by CVE-2019-17267. The vulnerability relates to polymorphic deserialization of the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup, which could enable JNDI injection attacks. The upstream fix (commit 191a4cdf87) that adds this class to the deserialization blocklist was already present in the upstream release 2.13.2.2 that TuxCare onboarded. The vulnerable pattern (ability to deserialize this dangerous class) is not present in the target because SubTypeValidator rejects it at line 99 before any deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:44:46.412412+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves polymorphic deserialization of attacker-controlled class names leading to arbitrary code execution via log4j-extras JNDI classes. The fix (blocking org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource in SubTypeValidator) was already present in the upstream release 2.13.2.2 when TuxCare onboarded it. The fix commit (b5a304a985, Oct 12, 2019) by upstream author Tatu Saloranta is an ancestor of the first TuxCare onboarding commit (5daf400db1), confirming this is an upstream fix shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves polymorphic deserialization of attacker-controlled class names leading to arbitrary code execution via log4j-extras JNDI classes. The fix (blocking org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource in SubTypeValidator) was already present in the upstream release 2.13.2.2 when TuxCare onboarded it. The fix commit (b5a304a985, Oct 12, 2019) by upstream author Tatu Saloranta is an ancestor of the first TuxCare onboarding commit (5daf400db1), confirming this is an upstream fix shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target version 2.13.2.2 is NOT affected by CVE-2019-20330. The vulnerability involves polymorphic deserialization of ehcache JNDI selector gadget classes that can lead to remote code execution. The upstream fix (commit fc4214a883) added two class names to the deserialization blocklist in SubTypeValidator.java: net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and net.sf.ehcache.transaction.manager.selector.GlassfishSelector. This fix was already present in upstream release 2.13.2.2 before TuxCare onboarded it (first TuxCare commit 5daf400db1). The blocklist is enforced at runtime during bean deserialization and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "The target version 2.13.2.2 is NOT affected by CVE-2019-20330. The vulnerability involves polymorphic deserialization of ehcache JNDI selector gadget classes that can lead to remote code execution. The upstream fix (commit fc4214a883) added two class names to the deserialization blocklist in SubTypeValidator.java: net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and net.sf.ehcache.transaction.manager.selector.GlassfishSelector. This fix was already present in upstream release 2.13.2.2 before TuxCare onboarded it (first TuxCare commit 5daf400db1). The blocklist is enforced at runtime during bean deserialization and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:57:30.465792+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.2.2-tuxcare.3) is NOT affected by CVE-2020-10650. The vulnerability involves unsafe deserialization of ignite-jta gadget classes that enable arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit a424c038ba0c0d65e579e22001dec925902ac0ef (March 15, 2020) by adding three class names to the deserialization blocklist in SubTypeValidator.java: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This fix was already present in the upstream release 2.13.2.2 that TuxCare onboarded, as confirmed by tracing the git history. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "The target repository (jackson-databind 2.13.2.2-tuxcare.3) is NOT affected by CVE-2020-10650. The vulnerability involves unsafe deserialization of ignite-jta gadget classes that enable arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit a424c038ba0c0d65e579e22001dec925902ac0ef (March 15, 2020) by adding three class names to the deserialization blocklist in SubTypeValidator.java: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This fix was already present in the upstream release 2.13.2.2 that TuxCare onboarded, as confirmed by tracing the git history. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 via deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory gadget class. The target version 2.13.2.2-tuxcare.3 contains the upstream fix that blocklists both XaPooledConnectionFactory and RecoverablePooledConnectionFactory in SubTypeValidator.java (lines 162-164). This fix was authored by upstream maintainer Tatu Saloranta in commit 592872f4 (March 2020) and was already present in the upstream 2.13.2.2 release that TuxCare onboarded. The vulnerable deserialization pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 via deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory gadget class. The target version 2.13.2.2-tuxcare.3 contains the upstream fix that blocklists both XaPooledConnectionFactory and RecoverablePooledConnectionFactory in SubTypeValidator.java (lines 162-164). This fix was authored by upstream maintainer Tatu Saloranta in commit 592872f4 (March 2020) and was already present in the upstream 2.13.2.2 release that TuxCare onboarded. The vulnerable deserialization pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:22:27.344203+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entry for com.caucho.config.types.ResourceRef deserialization gadget. The target version 2.13.2.2-tuxcare.3 is not affected because the upstream fix (commit 1645efbd39 by Tatu Saloranta) was already present in the upstream release 2.13.2.2 that TuxCare onboarded. The fix adds the gadget class to DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java line 167, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entry for com.caucho.config.types.ResourceRef deserialization gadget. The target version 2.13.2.2-tuxcare.3 is not affected because the upstream fix (commit 1645efbd39 by Tatu Saloranta) was already present in the upstream release 2.13.2.2 that TuxCare onboarded. The fix adds the gadget class to DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java line 167, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.2.2-tuxcare.3 is not affected by CVE-2020-10968. The vulnerability, which allows deserialization of dangerous gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider, was fixed by upstream vendor Tatu Saloranta in commit 05d7e0e13f (March 25, 2020). This fix was already present in the upstream jackson-databind 2.13.2.2 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the TuxCare onboarding commit. The blocklist entries are present at SubTypeValidator.java:169-171 and actively enforced at runtime by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "The target jackson-databind version 2.13.2.2-tuxcare.3 is not affected by CVE-2020-10968. The vulnerability, which allows deserialization of dangerous gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider, was fixed by upstream vendor Tatu Saloranta in commit 05d7e0e13f (March 25, 2020). This fix was already present in the upstream jackson-databind 2.13.2.2 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the TuxCare onboarding commit. The blocklist entries are present at SubTypeValidator.java:169-171 and actively enforced at runtime by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves unsafe deserialization of javax.swing.JEditorPane via polymorphic typing. The fix, which adds javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 149-151), was included in the upstream jackson-databind 2.13.2.2 release and is present in the target. The blocklist is enforced during bean deserialization through BeanDeserializerFactory._validateSubType(), preventing instantiation of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "CVE-2020-10969 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves unsafe deserialization of javax.swing.JEditorPane via polymorphic typing. The fix, which adds javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 149-151), was included in the upstream jackson-databind 2.13.2.2 release and is present in the target. The blocklist is enforced during bean deserialization through BeanDeserializerFactory._validateSubType(), preventing instantiation of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability concerns deserialization gadgets using org.apache.activemq.* classes. The upstream vendor (FasterXML) already fixed this by adding these classes to the SubTypeValidator blocklist in commits c14c9f99 and 05d7e0e1, which shipped in upstream release 2.13.2.2 before TuxCare onboarded this version. The fix is present at SubTypeValidator.java lines 173-183, blocking all nine activemq classes identified in the patches.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability concerns deserialization gadgets using org.apache.activemq.* classes. The upstream vendor (FasterXML) already fixed this by adding these classes to the SubTypeValidator blocklist in commits c14c9f99 and 05d7e0e1, which shipped in upstream release 2.13.2.2 before TuxCare onboarded this version. The fix is present at SubTypeValidator.java lines 173-183, blocking all nine activemq classes identified in the patches.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability concerns deserialization gadgets related to org.apache.commons.proxy.provider.remoting.RmiProvider. The upstream fix (commit 05d7e0e13f by Tatu Saloranta, dated March 25, 2020) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.13.2.2 when TuxCare onboarded it (commit 5daf400db1 by amoniatovskiy@cloudlinux.com). The target contains the complete fix at line 186 of SubTypeValidator.java, blocking the RmiProvider gadget from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability concerns deserialization gadgets related to org.apache.commons.proxy.provider.remoting.RmiProvider. The upstream fix (commit 05d7e0e13f by Tatu Saloranta, dated March 25, 2020) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.13.2.2 when TuxCare onboarded it (commit 5daf400db1 by amoniatovskiy@cloudlinux.com). The target contains the complete fix at line 186 of SubTypeValidator.java, blocking the RmiProvider gadget from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 affects jackson-databind versions before 2.9.10.4, where the class org.apache.openjpa.ee.WASRegistryManagedRuntime was not blocked from polymorphic deserialization, enabling serialization gadget attacks. The target version 2.13.2.2-tuxcare.3 already contains the upstream fix (commit e2ba12d5d6 by Tatu Saloranta, March 28, 2020) which added WASRegistryManagedRuntime to the deserialization blocklist in SubTypeValidator.java. This fix was included in upstream release 2.9.10.4 and was already present when TuxCare onboarded version 2.13.2.2, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 affects jackson-databind versions before 2.9.10.4, where the class org.apache.openjpa.ee.WASRegistryManagedRuntime was not blocked from polymorphic deserialization, enabling serialization gadget attacks. The target version 2.13.2.2-tuxcare.3 already contains the upstream fix (commit e2ba12d5d6 by Tatu Saloranta, March 28, 2020) which added WASRegistryManagedRuntime to the deserialization blocklist in SubTypeValidator.java. This fix was included in upstream release 2.9.10.4 and was already present when TuxCare onboarded version 2.13.2.2, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.2.2-tuxcare.3 is NOT AFFECTED by CVE-2020-11619. The vulnerability involves deserialization gadgets using org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The upstream fix (commit 113e89fb08) that blocks these classes was already included in the upstream release 2.13.2.2 that TuxCare onboarded. The fix is present in SubTypeValidator.java lines 52-54, which adds both dangerous classes to the deserialization blocklist. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "The target jackson-databind version 2.13.2.2-tuxcare.3 is NOT AFFECTED by CVE-2020-11619. The vulnerability involves deserialization gadgets using org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The upstream fix (commit 113e89fb08) that blocks these classes was already included in the upstream release 2.13.2.2 that TuxCare onboarded. The fix is present in SubTypeValidator.java lines 52-54, which adds both dangerous classes to the deserialization blocklist. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 concerns jackson-databind's deserialization gadget vulnerability with org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind version 2.13.2.2-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.13.2.2 when TuxCare onboarded it. The fix (commit 77040d85e3, authored by upstream maintainer Tatu Saloranta on 2020-04-07) added org.apache.commons.jelly.impl.Embedded to the SubTypeValidator blocklist, preventing its deserialization. This blocklist entry exists at line 189 of SubTypeValidator.java and is enforced at runtime through validation logic that throws an exception when dangerous classes are detected. Since the fix shipped with the upstream release and was not applied by TuxCare, the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 concerns jackson-databind's deserialization gadget vulnerability with org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind version 2.13.2.2-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.13.2.2 when TuxCare onboarded it. The fix (commit 77040d85e3, authored by upstream maintainer Tatu Saloranta on 2020-04-07) added org.apache.commons.jelly.impl.Embedded to the SubTypeValidator blocklist, preventing its deserialization. This blocklist entry exists at line 189 of SubTypeValidator.java and is enforced at runtime through validation logic that throws an exception when dangerous classes are detected. Since the fix shipped with the upstream release and was not applied by TuxCare, the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5. The target version 2.13.2.2-tuxcare.3 already contains the upstream fix that blocks deserialization of the vulnerable gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool`. The fix (commit d1c67a0396e by Tatu Saloranta, April 2020) was shipped in upstream release 2.9.10.5 and is present in all subsequent versions including 2.13.2.2. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5. The target version 2.13.2.2-tuxcare.3 already contains the upstream fix that blocks deserialization of the vulnerable gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool`. The fix (commit d1c67a0396e by Tatu Saloranta, April 2020) was shipped in upstream release 2.9.10.5 and is present in all subsequent versions including 2.13.2.2. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.2.2-tuxcare.3 is not vulnerable to CVE-2020-14061. The upstream fix (commit 5c8642aeae) that blacklists the five oracle.jms serialization gadget classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) was already present in upstream version 2.13.2.2 when TuxCare onboarded it. The blacklist is actively enforced during JSON deserialization via SubTypeValidator, blocking the attack chain from malicious JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "Target version 2.13.2.2-tuxcare.3 is not vulnerable to CVE-2020-14061. The upstream fix (commit 5c8642aeae) that blacklists the five oracle.jms serialization gadget classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) was already present in upstream version 2.13.2.2 when TuxCare onboarded it. The blacklist is actively enforced during JSON deserialization via SubTypeValidator, blocking the attack chain from malicious JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 does not affect this target. The vulnerability involves deserialization of the dangerous class `com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool` which enables JNDI injection attacks. The fix (adding this class to the SubTypeValidator blocklist) was already present in upstream version 2.13.2.2, which was onboarded into this repository. The target version 2.13.2.2-tuxcare.3 inherits this upstream fix. The CVE affects \"2.x before 2.9.10.5\" and version 2.13.2.2 is significantly newer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 does not affect this target. The vulnerability involves deserialization of the dangerous class `com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool` which enables JNDI injection attacks. The fix (adding this class to the SubTypeValidator blocklist) was already present in upstream version 2.13.2.2, which was onboarded into this repository. The target version 2.13.2.2-tuxcare.3 inherits this upstream fix. The CVE affects \"2.x before 2.9.10.5\" and version 2.13.2.2 is significantly newer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target (jackson-databind 2.13.2.2-tuxcare.3) is not affected by CVE-2020-14195. The vulnerability involves deserialization of the malicious gadget class org.jsecurity.realm.jndi.JndiRealmFactory which could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit f6d9c664 by adding org.jsecurity.realm.jndi.JndiRealmFactory to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.2.2 release that TuxCare onboarded (commit 5daf400d \"Onboard version 2.13.2.2\"), making the target immune to this attack. The blocklist is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType() which calls SubTypeValidator.instance().validateSubType(), throwing an exception when blocked classes are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "The target (jackson-databind 2.13.2.2-tuxcare.3) is not affected by CVE-2020-14195. The vulnerability involves deserialization of the malicious gadget class org.jsecurity.realm.jndi.JndiRealmFactory which could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit f6d9c664 by adding org.jsecurity.realm.jndi.JndiRealmFactory to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.2.2 release that TuxCare onboarded (commit 5daf400d \"Onboard version 2.13.2.2\"), making the target immune to this attack. The blocklist is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType() which calls SubTypeValidator.instance().validateSubType(), throwing an exception when blocked classes are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:16:58.934480+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability relates to missing blocklist entry for br.com.anteros.dbcp.AnterosDBCPDataSource, which enables deserialization gadget chain exploitation. The fix (adding AnterosDBCPDataSource to the blocklist) was already present in the upstream release 2.13.2.2 that TuxCare onboarded, applied by upstream commit 3d97153944 authored by Tatu Saloranta. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability relates to missing blocklist entry for br.com.anteros.dbcp.AnterosDBCPDataSource, which enables deserialization gadget chain exploitation. The fix (adding AnterosDBCPDataSource to the blocklist) was already present in the upstream release 2.13.2.2 that TuxCare onboarded, applied by upstream commit 3d97153944 authored by Tatu Saloranta. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:11:26.566722+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is not present in jackson-databind 2.13.2.2-tuxcare.3. The fix (adding com.pastdev.httpcomponents.configuration.JndiConfiguration to the deserialization blocklist) was already shipped in upstream version 2.13.2.2 before TuxCare onboarded it. The fix commit 7dbf51bf78d157098074a20bd9da39bd48c18e4a by upstream author Tatu Saloranta is an ancestor of the TuxCare onboarding commit 5daf400db19da5c06f16200ac9daa4ae4c996cde.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 is not present in jackson-databind 2.13.2.2-tuxcare.3. The fix (adding com.pastdev.httpcomponents.configuration.JndiConfiguration to the deserialization blocklist) was already shipped in upstream version 2.13.2.2 before TuxCare onboarded it. The fix commit 7dbf51bf78d157098074a20bd9da39bd48c18e4a by upstream author Tatu Saloranta is an ancestor of the TuxCare onboarding commit 5daf400db19da5c06f16200ac9daa4ae4c996cde.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in Jackson Databind's DOMDeserializer) is NOT present in version 2.13.2.2-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in commit 612f971b78 on January 9, 2020, which was already included in the upstream release 2.13.2.2 before TuxCare onboarded it on September 10, 2026. The fix configures the XML parser to disable DOCTYPE declarations and external DTD loading, preventing XXE attacks. No TuxCare backport is needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE vulnerability in Jackson Databind's DOMDeserializer) is NOT present in version 2.13.2.2-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in commit 612f971b78 on January 9, 2020, which was already included in the upstream release 2.13.2.2 before TuxCare onboarded it on September 10, 2026. The fix configures the XML parser to disable DOCTYPE declarations and external DTD loading, preventing XXE attacks. No TuxCare backport is needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:18:25.927574+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind version 2.13.2.2-tuxcare.3) is NOT affected by CVE-2020-35490. The vulnerability was fixed in upstream release 2.13.2.2 before TuxCare onboarded it. The fix (commit 41b8bdb5cc by upstream maintainer Tatu Saloranta) adds org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blacklist in SubTypeValidator.java, preventing exploitation through serialization gadgets. The blacklist is enforced by default in the core bean deserialization flow via BeanDeserializerFactory._validateSubType(), blocking any attempt to deserialize these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "The target repository (jackson-databind version 2.13.2.2-tuxcare.3) is NOT affected by CVE-2020-35490. The vulnerability was fixed in upstream release 2.13.2.2 before TuxCare onboarded it. The fix (commit 41b8bdb5cc by upstream maintainer Tatu Saloranta) adds org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blacklist in SubTypeValidator.java, preventing exploitation through serialization gadgets. The blacklist is enforced by default in the core bean deserialization flow via BeanDeserializerFactory._validateSubType(), blocking any attempt to deserialize these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:27:39.447287+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target version 2.13.2.2 is not affected by CVE-2020-35491. The vulnerability, which allows arbitrary code execution via deserialization of org.apache.commons.dbcp2.datasources.SharedPoolDataSource, was fixed by the upstream vendor (FasterXML) in commit 41b8bdb5cc and included in the upstream release 2.13.2.2 before TuxCare onboarded it. The fix adds the vulnerable dbcp2 datasource classes to the deserialization blacklist in SubTypeValidator.java (lines 217-218).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "The target version 2.13.2.2 is not affected by CVE-2020-35491. The vulnerability, which allows arbitrary code execution via deserialization of org.apache.commons.dbcp2.datasources.SharedPoolDataSource, was fixed by the upstream vendor (FasterXML) in commit 41b8bdb5cc and included in the upstream release 2.13.2.2 before TuxCare onboarded it. The fix adds the vulnerable dbcp2 datasource classes to the deserialization blacklist in SubTypeValidator.java (lines 217-218).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:52:27.107929+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability affects jackson-databind 2.x before 2.9.10.8 and involves a deserialization gadget using com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by tatu.saloranta@iki.fi) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing the gadget from being deserialized. This fix was already present in the upstream 2.13.2.2 release that TuxCare onboarded, as verified by git ancestry analysis showing the fix commit is an ancestor of the first TuxCare commit (5daf400db1 \"Onboard version 2.13.2.2\"). The blocklist entry exists at line 240 of SubTypeValidator.java and is enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability affects jackson-databind 2.x before 2.9.10.8 and involves a deserialization gadget using com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by tatu.saloranta@iki.fi) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing the gadget from being deserialized. This fix was already present in the upstream 2.13.2.2 release that TuxCare onboarded, as verified by git ancestry analysis showing the fix commit is an ancestor of the first TuxCare commit (5daf400db1 \"Onboard version 2.13.2.2\"). The blocklist entry exists at line 240 of SubTypeValidator.java and is enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:20:11.775734+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.2.2-tuxcare.3) is NOT affected by CVE-2020-36179. The vulnerability involves deserialization of malicious DriverAdapterCPDS gadget classes that can lead to arbitrary code execution. The upstream fix (commit 3ded28aece) adds these gadget classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was already present in upstream version 2.13.2.2 before TuxCare onboarded it, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (5daf400db1). The defense is implemented at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, blocking all DriverAdapterCPDS variants mentioned in the CVE including the specifically-named oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "The target repository (jackson-databind 2.13.2.2-tuxcare.3) is NOT affected by CVE-2020-36179. The vulnerability involves deserialization of malicious DriverAdapterCPDS gadget classes that can lead to arbitrary code execution. The upstream fix (commit 3ded28aece) adds these gadget classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was already present in upstream version 2.13.2.2 before TuxCare onboarded it, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (5daf400db1). The defense is implemented at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, blocking all DriverAdapterCPDS variants mentioned in the CVE including the specifically-named oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:32:29.747187+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involved dangerous gadget classes (DriverAdapterCPDS variants) that could enable arbitrary code execution through Jackson polymorphic deserialization. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) added all five DriverAdapterCPDS class variants to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in the upstream 2.13.2.2 release that TuxCare onboarded, so the vulnerable code pattern has never been present in any TuxCare build of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "CVE-2020-36180 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involved dangerous gadget classes (DriverAdapterCPDS variants) that could enable arbitrary code execution through Jackson polymorphic deserialization. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) added all five DriverAdapterCPDS class variants to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in the upstream 2.13.2.2 release that TuxCare onboarded, so the vulnerable code pattern has never been present in any TuxCare build of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:39:17.536668+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The target version 2.13.2.2-tuxcare.3 contains the upstream fix (commit 3ded28aece) which adds DriverAdapterCPDS and related classes to SubTypeValidator's blocklist. This fix was already present in the upstream 2.13.2.2 release that TuxCare onboarded, not added by TuxCare backporting. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The target version 2.13.2.2-tuxcare.3 contains the upstream fix (commit 3ded28aece) which adds DriverAdapterCPDS and related classes to SubTypeValidator's blocklist. This fix was already present in the upstream 2.13.2.2 release that TuxCare onboarded, not added by TuxCare backporting. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:10:29.791973+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target (jackson-databind 2.13.2.2-tuxcare.3) is NOT affected by CVE-2020-36182. The vulnerability pattern - missing blacklist entries for DriverAdapterCPDS deserialization gadget classes - is not present. All five DriverAdapterCPDS variants mentioned in the upstream patches are properly blacklisted in SubTypeValidator.java (lines 123, 193, 219, 228, 234), including the CVE-specific org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The fix was already present in upstream jackson-databind 2.13.2.2 when TuxCare onboarded it (commit 5daf400d \"Onboard version 2.13.2.2\"). Version 2.13.2.2 is much newer than 2.9.10.8 where the upstream fix was released (Dec 2020, issue #3004), so the vulnerable code never existed in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "The target (jackson-databind 2.13.2.2-tuxcare.3) is NOT affected by CVE-2020-36182. The vulnerability pattern - missing blacklist entries for DriverAdapterCPDS deserialization gadget classes - is not present. All five DriverAdapterCPDS variants mentioned in the upstream patches are properly blacklisted in SubTypeValidator.java (lines 123, 193, 219, 228, 234), including the CVE-specific org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The fix was already present in upstream jackson-databind 2.13.2.2 when TuxCare onboarded it (commit 5daf400d \"Onboard version 2.13.2.2\"). Version 2.13.2.2 is much newer than 2.9.10.8 where the upstream fix was released (Dec 2020, issue #3004), so the vulnerable code never existed in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:19:24.597800+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.13.2.2-tuxcare.3 is NOT affected by CVE-2020-36183. The vulnerability involved a deserialization gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool that could enable remote code execution via JNDI injection. The upstream fix added this class to the deserialization blocklist in SubTypeValidator.java. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 12e23c962ff and was already present in the upstream jackson-databind 2.13.2.2 release that TuxCare onboarded. The blocklist entry is confirmed present at SubTypeValidator.java:243 in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "The target repository jackson-databind version 2.13.2.2-tuxcare.3 is NOT affected by CVE-2020-36183. The vulnerability involved a deserialization gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool that could enable remote code execution via JNDI injection. The upstream fix added this class to the deserialization blocklist in SubTypeValidator.java. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 12e23c962ff and was already present in the upstream jackson-databind 2.13.2.2 release that TuxCare onboarded. The blocklist entry is confirmed present at SubTypeValidator.java:243 in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:19:18.164920+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.13.2.2-tuxcare.2. The upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta, December 26, 2020) that blocks deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource was already included in the upstream 2.13.2.2 release that TuxCare onboarded. The vulnerable classes are blocked in SubTypeValidator.java at lines 235-236. This is an upstream fix that shipped before TuxCare's onboarding commit (5daf400db19da5c06f16200ac9daa4ae4c996cde).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.13.2.2-tuxcare.2. The upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta, December 26, 2020) that blocks deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource was already included in the upstream 2.13.2.2 release that TuxCare onboarded. The vulnerable classes are blocked in SubTypeValidator.java at lines 235-236. This is an upstream fix that shipped before TuxCare's onboarding commit (5daf400db19da5c06f16200ac9daa4ae4c996cde).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:02:25.196465+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.2.2-tuxcare.3 is NOT affected by CVE-2020-36185. The vulnerability requires the absence of blocklist entries for the gadget classes org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource in SubTypeValidator.java. These blocklist entries are already present in the target (lines 235-236), preventing deserialization of these dangerous gadget classes. The fix was introduced by upstream FasterXML in commit 567194c53a on Dec 26, 2020 and was already included in the upstream 2.13.2.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "The target jackson-databind version 2.13.2.2-tuxcare.3 is NOT affected by CVE-2020-36185. The vulnerability requires the absence of blocklist entries for the gadget classes org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource in SubTypeValidator.java. These blocklist entries are already present in the target (lines 235-236), preventing deserialization of these dangerous gadget classes. The fix was introduced by upstream FasterXML in commit 567194c53a on Dec 26, 2020 and was already included in the upstream 2.13.2.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:26:58.411173+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 3e8fa3beea) that blocks these classes in SubTypeValidator was already included in upstream version 2.13.2.2 before TuxCare onboarded it. The blocklist entries are present at lines 229-230 of SubTypeValidator.java, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "CVE-2020-36186 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 3e8fa3beea) that blocks these classes in SubTypeValidator was already included in upstream version 2.13.2.2 before TuxCare onboarded it. The blocklist entries are present at lines 229-230 of SubTypeValidator.java, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:42:30.151541+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 affects jackson-databind versions before 2.9.10.8. The target version 2.13.2.2-tuxcare.3 already contains the upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta) that was shipped in the upstream release. The fix adds org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist in SubTypeValidator.java (lines 226-230), preventing the exploitation of these gadget classes. The fix was present in the upstream 2.13.2.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "CVE-2020-36187 affects jackson-databind versions before 2.9.10.8. The target version 2.13.2.2-tuxcare.3 already contains the upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta) that was shipped in the upstream release. The fix adds org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist in SubTypeValidator.java (lines 226-230), preventing the exploitation of these gadget classes. The fix was present in the upstream 2.13.2.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:47:47.688279+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 does not affect jackson-databind 2.13.2.2-tuxcare.3. The vulnerability was fixed by upstream maintainer Tatu Saloranta in commit 33d96c13fe, which was already present in the upstream jackson-databind 2.13.2.2 release before TuxCare onboarded it. The fix adds com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java (lines 223-224), preventing arbitrary code execution via Jackson deserialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188 does not affect jackson-databind 2.13.2.2-tuxcare.3. The vulnerability was fixed by upstream maintainer Tatu Saloranta in commit 33d96c13fe, which was already present in the upstream jackson-databind 2.13.2.2 release before TuxCare onboarded it. The fix adds com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java (lines 223-224), preventing arbitrary code execution via Jackson deserialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:55:53.618169+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is not present in jackson-databind 2.13.2.2-tuxcare.2. The fix was included in the upstream release 2.13.2.2 before TuxCare onboarded it. The two dangerous classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource) are blacklisted in SubTypeValidator.java, preventing their deserialization and blocking the gadget chain attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 is not present in jackson-databind 2.13.2.2-tuxcare.2. The fix was included in the upstream release 2.13.2.2 before TuxCare onboarded it. The two dangerous classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource) are blacklisted in SubTypeValidator.java, preventing their deserialization and blocking the gadget chain attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:14:47.812204+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.13.2.2-tuxcare.3. The fix for stack overflow via deeply nested JSON was already included in the upstream release 2.13.2.2 that TuxCare onboarded. The Vanilla deserializer (default for untyped Object deserialization) contains depth tracking that throws JsonParseException when nesting exceeds MAX_DEPTH (1000). Fix commit fcfc4998ec by upstream author Taylor S. Marks (taylor@marksfam.com) is an ancestor of the first TuxCare commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.13.2.2-tuxcare.3. The fix for stack overflow via deeply nested JSON was already included in the upstream release 2.13.2.2 that TuxCare onboarded. The Vanilla deserializer (default for untyped Object deserialization) contains depth tracking that throws JsonParseException when nesting exceeds MAX_DEPTH (1000). Fix commit fcfc4998ec by upstream author Taylor S. Marks (taylor@marksfam.com) is an ancestor of the first TuxCare commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:07:58.117916+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 does not affect jackson-databind 2.13.2.2. The vulnerability involved deserialization of org.apache.xbean.propertyeditor.JndiConverter enabling JNDI injection attacks. The fix (blacklisting this class) was already present in the upstream 2.13.2.2 release that TuxCare onboarded. Target version 2.13.2.2 is significantly newer than the highest affected version (2.9.10.2). The fix commit 914e7c9f2cb was authored by the upstream maintainer Tatu Saloranta and was included in the upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 does not affect jackson-databind 2.13.2.2. The vulnerability involved deserialization of org.apache.xbean.propertyeditor.JndiConverter enabling JNDI injection attacks. The fix (blacklisting this class) was already present in the upstream 2.13.2.2 release that TuxCare onboarded. Target version 2.13.2.2 is significantly newer than the highest affected version (2.9.10.2). The fix commit 914e7c9f2cb was authored by the upstream maintainer Tatu Saloranta and was included in the upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The target contains the upstream vendor fix (commit 1e64db6a2f by Tatu Saloranta) that adds \"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig\" to the SubTypeValidator deny list (line 141 of SubTypeValidator.java). This fix was already present in upstream release 2.13.2.2 when TuxCare onboarded it (commit 5daf400db1 \"Onboard version 2.13.2.2\"). The deny list check is properly integrated into BeanDeserializerFactory.createBeanDeserializer() at line 140, blocking deserialization of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 is NOT present in jackson-databind 2.13.2.2-tuxcare.3. The target contains the upstream vendor fix (commit 1e64db6a2f by Tatu Saloranta) that adds \"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig\" to the SubTypeValidator deny list (line 141 of SubTypeValidator.java). This fix was already present in upstream release 2.13.2.2 when TuxCare onboarded it (commit 5daf400db1 \"Onboard version 2.13.2.2\"). The deny list check is properly integrated into BeanDeserializerFactory.createBeanDeserializer() at line 140, blocking deserialization of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:36:25.287060+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7. The target repository is jackson-databind 2.13.2.2-tuxcare.3, which is significantly newer than the affected versions. The upstream fix (commit 1e64db6a2f from February 2020) added `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.13.2.2 that TuxCare onboarded in September 2026, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7. The target repository is jackson-databind 2.13.2.2-tuxcare.3, which is significantly newer than the affected versions. The upstream fix (commit 1e64db6a2f from February 2020) added `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.13.2.2 that TuxCare onboarded in September 2026, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:11:47.660203+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability concerns deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class. The fix (adding this class to the deny-list in SubTypeValidator.java) was already present in the upstream jackson-databind 2.13.2.2 release that TuxCare onboarded, as confirmed by commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb authored by upstream maintainer Tatu Saloranta on 2020-02-29.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 is not present in jackson-databind 2.13.2.2-tuxcare.3. The vulnerability concerns deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class. The fix (adding this class to the deny-list in SubTypeValidator.java) was already present in the upstream jackson-databind 2.13.2.2 release that TuxCare onboarded, as confirmed by commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb authored by upstream maintainer Tatu Saloranta on 2020-02-29.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:08:01.045470+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 concerns the javax.swing.JTextPane deserialization gadget. The fix (adding JTextPane to SubTypeValidator's blacklist) was already present in upstream jackson-databind version 2.13.2.2, which TuxCare onboarded. The vulnerable code pattern does not exist in this version because the upstream fix was included in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 concerns the javax.swing.JTextPane deserialization gadget. The fix (adding JTextPane to SubTypeValidator's blacklist) was already present in upstream jackson-databind version 2.13.2.2, which TuxCare onboarded. The vulnerable code pattern does not exist in this version because the upstream fix was included in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:31:15.270922+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.2.2 is NOT AFFECTED by CVE-2021-46877. The vulnerability (excessive heap allocation from trusting untrusted length fields in JDK deserialization) was fixed by upstream commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb authored by Tatu Saloranta (tatu.saloranta@iki.fi). This fix was already present in the upstream 2.13.2.2 release that TuxCare onboarded (verified: fix commit is ancestor of first TuxCare onboarding commit 5daf400db19da5c06f16200ac9daa4ae4c996cde). The vulnerable code pattern (immediate byte array allocation based on declared length) is not present in the target; the defense (LONGEST_EAGER_ALLOC=100KB limit with incremental reading via ByteArrayBuilder) is fully implemented in NodeSerialization.java lines 17-84. CVE version range confirms: affects \"2.13.x before 2.13.1\"; target 2.13.2.2 is beyond the affected range.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "The target jackson-databind version 2.13.2.2 is NOT AFFECTED by CVE-2021-46877. The vulnerability (excessive heap allocation from trusting untrusted length fields in JDK deserialization) was fixed by upstream commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb authored by Tatu Saloranta (tatu.saloranta@iki.fi). This fix was already present in the upstream 2.13.2.2 release that TuxCare onboarded (verified: fix commit is ancestor of first TuxCare onboarding commit 5daf400db19da5c06f16200ac9daa4ae4c996cde). The vulnerable code pattern (immediate byte array allocation based on declared length) is not present in the target; the defense (LONGEST_EAGER_ALLOC=100KB limit with incremental reading via ByteArrayBuilder) is fully implemented in NodeSerialization.java lines 17-84. CVE version range confirms: affects \"2.13.x before 2.13.1\"; target 2.13.2.2 is beyond the affected range." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2026-54512 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" }, "action_statement": "Vulnerability CVE-2026-54512 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2026-54514 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" }, "action_statement": "Vulnerability CVE-2026-54514 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-05T11:02:56.280755+00:00", "status_notes": "Vulnerability CVE-2026-54518 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.2.2-tuxcare.4.", "vulnerability": { "name": "CVE-2026-54518" }, "action_statement": "Vulnerability CVE-2026-54518 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.2.2-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-03T01:36:00.121742+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.13.2.2 is not affected by CVE-2026-59888. The vulnerability requires that @JsonIgnore-annotated Record components survive removal in POJOPropertiesCollector._removeUnwantedProperties() and reach _renameUsing() where renamed property names bypass ignore checks. In 2.13.2.2, Record components with @JsonIgnore but no explicit @JsonProperty name have isExplicitlyIncluded()=false, causing ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 Version 2.13.2.2 is not affected by CVE-2026-59888. The vulnerability requires that @JsonIgnore-annotated Record components survive removal in POJOPropertiesCollector._removeUnwantedProperties() and reach _renameUsing() where renamed property names bypass ignore checks. In 2.13.2.2, Record components with @JsonIgnore but no explicit @JsonProperty name have isExplicitlyIncluded()=false, causing ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2026-59889 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" }, "action_statement": "Vulnerability CVE-2026-59889 affects version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:40:03.780096+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:40:03.780096+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.13.2.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2-tuxcare.3" } } ], "timestamp": "2026-11-01T12:39:07.681583+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.13.2.2-tuxcare.3.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }