{ "@id": "urn:uuid:bb88b650-dff3-4367-a173-4d25d8de436a", "role": "Document Creator", "author": "https://tuxcare.com", "version": 81, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:17:00.447062+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T13:07:28.836714+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.13.4-tuxcare.2, which is based on upstream jackson-databind 2.13.4. The fix for CVE-2017-15095 (issue #1737) was committed by upstream maintainer Tatu Saloranta (ddfddfba64) and shipped in upstream releases 2.8.11 and 2.9.4. This fix is present in the upstream 2.13.4 release that TuxCare onboarded. The target's SubTypeValidator.java contains all required blacklist entries to prevent deserialization of the dangerous classes identified in CVE-2017-15095, and the validation is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.13.4-tuxcare.2, which is based on upstream jackson-databind 2.13.4. The fix for CVE-2017-15095 (issue #1737) was committed by upstream maintainer Tatu Saloranta (ddfddfba64) and shipped in upstream releases 2.8.11 and 2.9.4. This fix is present in the upstream 2.13.4 release that TuxCare onboarded. The target's SubTypeValidator.java contains all required blacklist entries to prevent deserialization of the dangerous classes identified in CVE-2017-15095, and the validation is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T15:42:44.997491+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 does not affect target version 2.13.4-tuxcare.2. The vulnerability affected jackson-databind through 2.8.10 and 2.9.x through 2.9.3, requiring blacklist additions for Spring, c3p0, and other dangerous classes exploitable via polymorphic deserialization. Upstream fixes (issues #1737 and #1855) were committed in December 2017, creating SubTypeValidator with comprehensive blacklist and prefix-based checks. These fixes shipped in upstream jackson-databind 2.13.4 (released 2022), which TuxCare onboarded. Target contains the complete fix at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java with all necessary defensive code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 does not affect target version 2.13.4-tuxcare.2. The vulnerability affected jackson-databind through 2.8.10 and 2.9.x through 2.9.3, requiring blacklist additions for Spring, c3p0, and other dangerous classes exploitable via polymorphic deserialization. Upstream fixes (issues #1737 and #1855) were committed in December 2017, creating SubTypeValidator with comprehensive blacklist and prefix-based checks. These fixes shipped in upstream jackson-databind 2.13.4 (released 2022), which TuxCare onboarded. Target contains the complete fix at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java with all necessary defensive code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T14:25:56.437477+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.4 is not affected by CVE-2017-7525. The vulnerability (unsafe polymorphic deserialization allowing arbitrary code execution via dangerous gadget classes) was fixed in upstream versions 2.6.7.1, 2.7.9.1, and 2.8.9 (April-July 2017). The fix evolved from checkIllegalTypes() to SubTypeValidator, both authored by upstream maintainer Tatu Saloranta. Version 2.13.4 (released years later) ships with the complete fix including all blacklisted classes from the original CVE plus extensive additions. The fix was in the upstream release before TuxCare onboarding (Sept 2026).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "Target jackson-databind 2.13.4 is not affected by CVE-2017-7525. The vulnerability (unsafe polymorphic deserialization allowing arbitrary code execution via dangerous gadget classes) was fixed in upstream versions 2.6.7.1, 2.7.9.1, and 2.8.9 (April-July 2017). The fix evolved from checkIllegalTypes() to SubTypeValidator, both authored by upstream maintainer Tatu Saloranta. Version 2.13.4 (released years later) ships with the complete fix including all blacklisted classes from the original CVE plus extensive additions. The fix was in the upstream release before TuxCare onboarding (Sept 2026).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T13:16:19.686333+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.13.4. The fix (blacklisting org.apache.ibatis.parsing.XPathParser) was included in upstream releases 2.7.9.4, 2.8.11.2, and 2.9.6 (June 2018). Target version 2.13.4, released years later, inherited this fix from upstream. The blacklist entry is present at SubTypeValidator.java:65 and actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.13.4. The fix (blacklisting org.apache.ibatis.parsing.XPathParser) was included in upstream releases 2.7.9.4, 2.8.11.2, and 2.9.6 (June 2018). Target version 2.13.4, released years later, inherited this fix from upstream. The blacklist entry is present at SubTypeValidator.java:65 and actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T17:17:09.184138+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.4-tuxcare.2 is NOT affected by CVE-2018-12022. The vulnerability concerns polymorphic deserialization gadgets (Jodd-db and Oracle JDBC classes) that can trigger JNDI/LDAP lookups to attacker-controlled servers when Default Typing is enabled. The fix (blacklisting jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator) was already present in upstream release 2.13.4, which TuxCare onboarded. The fix commit 7487cf7eb1 was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit 3420829a84 (Onboard version 2.13.4). The vulnerable code pattern never existed in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "Target jackson-databind 2.13.4-tuxcare.2 is NOT affected by CVE-2018-12022. The vulnerability concerns polymorphic deserialization gadgets (Jodd-db and Oracle JDBC classes) that can trigger JNDI/LDAP lookups to attacker-controlled servers when Default Typing is enabled. The fix (blacklisting jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator) was already present in upstream release 2.13.4, which TuxCare onboarded. The fix commit 7487cf7eb1 was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit 3420829a84 (Onboard version 2.13.4). The vulnerable code pattern never existed in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T16:19:28.543087+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involved polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that could enable arbitrary code execution via LDAP connections. The upstream fix, which blacklists these gadget classes in SubTypeValidator, was authored by Tatu Saloranta and shipped in upstream version 2.7.9.4 (June 2018). Version 2.13.4, released years later, inherently includes this fix. The target has never contained the vulnerable pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involved polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that could enable arbitrary code execution via LDAP connections. The upstream fix, which blacklists these gadget classes in SubTypeValidator, was authored by Tatu Saloranta and shipped in upstream version 2.7.9.4 (June 2018). Version 2.13.4, released years later, inherently includes this fix. The target has never contained the vulnerable pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T13:46:05.554172+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 affects jackson-databind versions before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 due to missing blocklist entries for org.slf4j.ext.EventData and three other classes that enable arbitrary code execution via polymorphic deserialization. The target version 2.13.4-tuxcare.2 contains the upstream fix committed by Tatu Saloranta on 2018-08-16, which added these four classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.13.4 before TuxCare onboarded the version. The defense is always active with no configuration to disable it, blocking deserialization of the dangerous classes and throwing a security exception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 affects jackson-databind versions before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 due to missing blocklist entries for org.slf4j.ext.EventData and three other classes that enable arbitrary code execution via polymorphic deserialization. The target version 2.13.4-tuxcare.2 contains the upstream fix committed by Tatu Saloranta on 2018-08-16, which added these four classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.13.4 before TuxCare onboarded the version. The defense is always active with no configuration to disable it, blocking deserialization of the dangerous classes and throwing a security exception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T15:58:22.317135+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5. The target version 2.13.4-tuxcare.2 already contains the upstream fix that blocks the dangerous blaze-ds class \"flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor\" from polymorphic deserialization. The vulnerable pattern (unblocked blaze-ds classes) is not present because the fix was shipped in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5. The target version 2.13.4-tuxcare.2 already contains the upstream fix that blocks the dangerous blaze-ds class \"flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor\" from polymorphic deserialization. The vulnerable pattern (unblocked blaze-ds classes) is not present because the fix was shipped in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T14:06:55.509750+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not present in jackson-databind 2.13.4. The vulnerability allowed XXE attacks via polymorphic deserialization of dangerous JDK and third-party classes. The upstream vendor (FasterXML) applied the fix in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 on 2018-08-16 for version 2.6.7.2, adding four dangerous classes to the deserialization blacklist: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. This fix was already present in upstream version 2.13.4 when TuxCare onboarded it (first TuxCare commit 3420829a84 by amoniatovskiy@cloudlinux.com), predating TuxCare's work by 3914 commits. The blacklist is now maintained in SubTypeValidator.java lines 74-78, blocking polymorphic deserialization of these classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 is not present in jackson-databind 2.13.4. The vulnerability allowed XXE attacks via polymorphic deserialization of dangerous JDK and third-party classes. The upstream vendor (FasterXML) applied the fix in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 on 2018-08-16 for version 2.6.7.2, adding four dangerous classes to the deserialization blacklist: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. This fix was already present in upstream version 2.13.4 when TuxCare onboarded it (first TuxCare commit 3420829a84 by amoniatovskiy@cloudlinux.com), predating TuxCare's work by 3914 commits. The blacklist is now maintained in SubTypeValidator.java lines 74-78, blocking polymorphic deserialization of these classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T14:35:16.615188+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.4-tuxcare.2 is not affected by CVE-2018-14721. The vulnerability, which allowed SSRF attacks via polymorphic deserialization of the axis2-jaxws class, was fixed in the upstream release. The dangerous class `org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl` is present in the blocklist (SubTypeValidator.java line 78) which prevents its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e and was already included in the upstream 2.13.4 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "The target jackson-databind 2.13.4-tuxcare.2 is not affected by CVE-2018-14721. The vulnerability, which allowed SSRF attacks via polymorphic deserialization of the axis2-jaxws class, was fixed in the upstream release. The dangerous class `org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl` is present in the blocklist (SubTypeValidator.java line 78) which prevents its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e and was already included in the upstream 2.13.4 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T12:44:53.933368+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.4-tuxcare.2 is not affected by CVE-2018-19360. The vulnerability concerns the absence of `org.apache.axis2.transport.jms.JMSOutTransportInfo` in the polymorphic deserialization blocklist. The fix was added by upstream author Tatu Saloranta in commit 72cd4025a2 (November 2018) for version 2.9.8. Since the target version 2.13.4 is much later than the fixed version 2.9.8, the fix was already present in the upstream release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:85 and is actively enforced at runtime.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "The target jackson-databind 2.13.4-tuxcare.2 is not affected by CVE-2018-19360. The vulnerability concerns the absence of `org.apache.axis2.transport.jms.JMSOutTransportInfo` in the polymorphic deserialization blocklist. The fix was added by upstream author Tatu Saloranta in commit 72cd4025a2 (November 2018) for version 2.9.8. Since the target version 2.13.4 is much later than the fixed version 2.9.8, the fix was already present in the upstream release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:85 and is actively enforced at runtime.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T16:55:18.943377+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability concerns the ability to deserialize dangerous openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) through polymorphic deserialization. The upstream vendor (FasterXML) fixed this in commit 72cd4025a2 (November 2018) by adding these classes to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.13.4 release when TuxCare onboarded it. The target repository contains the fix at SubTypeValidator.java lines 82-84, blocking all three openjpa runtime classes from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability concerns the ability to deserialize dangerous openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) through polymorphic deserialization. The upstream vendor (FasterXML) fixed this in commit 72cd4025a2 (November 2018) by adding these classes to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.13.4 release when TuxCare onboarded it. The target repository contains the fix at SubTypeValidator.java lines 82-84, blocking all three openjpa runtime classes from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T15:24:04.222754+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for jboss-common-core gadget classes in polymorphic deserialization. The target (jackson-databind 2.13.4-tuxcare.2) is NOT AFFECTED because the fix was already included in the upstream 2.13.4 release. The blocklist entry for `org.jboss.util.propertyeditor.DocumentEditor` is present at SubTypeValidator.java:81, added by upstream commit 72cd4025a2 (Fix #2186, author: Tatu Saloranta, 2018-11-19). This commit predates the TuxCare onboarding commit (3420829a84), confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for jboss-common-core gadget classes in polymorphic deserialization. The target (jackson-databind 2.13.4-tuxcare.2) is NOT AFFECTED because the fix was already included in the upstream 2.13.4 release. The blocklist entry for `org.jboss.util.propertyeditor.DocumentEditor` is present at SubTypeValidator.java:81, added by upstream commit 72cd4025a2 (Fix #2186, author: Tatu Saloranta, 2018-11-19). This commit predates the TuxCare onboarding commit (3420829a84), confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the default typing blacklist. The fix, which adds these two classes to the blacklist in SubTypeValidator.java, was already present in the upstream 2.13.4 release when TuxCare onboarded it. The fix commit (038b471e2efde2e8f96b4e0be958d3e5a1ff1d05) was authored by upstream maintainer Tatu Saloranta in January 2018, long before the 2.13.4 release. The vulnerable code pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the default typing blacklist. The fix, which adds these two classes to the blacklist in SubTypeValidator.java, was already present in the upstream 2.13.4 release when TuxCare onboarded it. The fix commit (038b471e2efde2e8f96b4e0be958d3e5a1ff1d05) was authored by upstream maintainer Tatu Saloranta in January 2018, long before the 2.13.4 release. The vulnerable code pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T13:42:24.827100+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involved incomplete blacklisting of c3p0 gadget classes that could enable remote code execution via malicious JSON deserialization. The upstream fix (commit 6799f8f10c by Tatu Saloranta) was already included in the upstream release 2.13.4 that TuxCare onboarded. The fix adds validation in SubTypeValidator.java to block deserialization of c3p0 classes matching the pattern \"com.mchange.v2.c3p0.*DataSource\" (lines 288-298), preventing exploitation of classes like ComboPooledDataSource and AfterCloseLoggingComboPooledDataSource. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involved incomplete blacklisting of c3p0 gadget classes that could enable remote code execution via malicious JSON deserialization. The upstream fix (commit 6799f8f10c by Tatu Saloranta) was already included in the upstream release 2.13.4 that TuxCare onboarded. The fix adds validation in SubTypeValidator.java to block deserialization of c3p0 classes matching the pattern \"com.mchange.v2.c3p0.*DataSource\" (lines 288-298), preventing exploitation of classes like ComboPooledDataSource and AfterCloseLoggingComboPooledDataSource. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T16:31:30.745035+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086: Target jackson-databind 2.13.4-tuxcare.2 is NOT AFFECTED. The vulnerability requires missing validation of com.mysql.cj.jdbc.admin.MiniAdmin during polymorphic deserialization, enabling arbitrary file access. The upstream vendor fix (commit dda513bd725 by Tatu Saloranta, 2019-05-14) adding MiniAdmin to the SubTypeValidator blocklist was already present in upstream release 2.13.4 when TuxCare onboarded it (first TuxCare commit 3420829a8 on 2024-01-18). The defense is active at SubTypeValidator.java:88 and blocks the attack chain per Rule 4 verification. Verdict: not_affected with justification code_not_present (upstream fix removed vulnerable pattern before TuxCare maintenance began).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086: Target jackson-databind 2.13.4-tuxcare.2 is NOT AFFECTED. The vulnerability requires missing validation of com.mysql.cj.jdbc.admin.MiniAdmin during polymorphic deserialization, enabling arbitrary file access. The upstream vendor fix (commit dda513bd725 by Tatu Saloranta, 2019-05-14) adding MiniAdmin to the SubTypeValidator blocklist was already present in upstream release 2.13.4 when TuxCare onboarded it (first TuxCare commit 3420829a8 on 2024-01-18). The defense is active at SubTypeValidator.java:88 and blocks the attack chain per Rule 4 verification. Verdict: not_affected with justification code_not_present (upstream fix removed vulnerable pattern before TuxCare maintenance began).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-01T18:32:00.220852+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target repository jackson-databind version 2.13.4-tuxcare.2 is NOT AFFECTED by CVE-2019-12384. The vulnerability (missing blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource enabling unsafe polymorphic deserialization) was fixed in upstream release 2.13.4. The fix commit c9ef4a10d6f6633cf470d6a469514b68fa2be234 by upstream maintainer Tatu Saloranta added the dangerous class...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 Target repository jackson-databind version 2.13.4-tuxcare.2 is NOT AFFECTED by CVE-2019-12384. The vulnerability (missing blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource enabling unsafe polymorphic deserialization) was fixed in upstream release 2.13.4. The fix commit c9ef4a10d6f6633cf470d6a469514b68fa2be234 by upstream maintainer Tatu Saloranta added the dangerous class..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-02T07:12:00.167059+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.13.4-tuxcare.2 is not affected by CVE-2019-12814. The upstream vendor (FasterXML) shipped the fix in version 2.13.4 via commit 5f7c69bba0 (authored by Tatu Saloranta), which added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. TuxCare onboarded this already-fixed upstream release via commit 342...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 Target version 2.13.4-tuxcare.2 is not affected by CVE-2019-12814. The upstream vendor (FasterXML) shipped the fix in version 2.13.4 via commit 5f7c69bba0 (authored by Tatu Saloranta), which added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. TuxCare onboarded this already-fixed upstream release via commit 342..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T12:06:46.571739+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 does not affect jackson-databind 2.13.4-tuxcare.2. The vulnerability, which allows remote code execution via deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled, was fixed by upstream in commit ad418eeb97 (July 2019). This fix was already present in the upstream 2.13.4 release that TuxCare onboarded. The target code at SubTypeValidator.java lines 97-98 contains the blacklist entry that prevents deserialization of the dangerous ehcache class, blocking the attack chain from INPUT (malicious JSON payload with polymorphic type indicator) to GOAL (remote code execution via deserialization).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 does not affect jackson-databind 2.13.4-tuxcare.2. The vulnerability, which allows remote code execution via deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled, was fixed by upstream in commit ad418eeb97 (July 2019). This fix was already present in the upstream 2.13.4 release that TuxCare onboarded. The target code at SubTypeValidator.java lines 97-98 contains the blacklist entry that prevents deserialization of the dangerous ehcache class, blocking the attack chain from INPUT (malicious JSON payload with polymorphic type indicator) to GOAL (remote code execution via deserialization).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T13:29:29.992370+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 when Default Typing is enabled and logback is in the classpath, allowing polymorphic deserialization of ch.qos.logback.core.db.JNDIConnectionSource for JNDI injection attacks. The target version 2.13.4-tuxcare.2 is NOT affected because the fix (adding JNDIConnectionSource to the SubTypeValidator blacklist) was already present in the upstream 2.13.4 release that TuxCare onboarded. The fix commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b was authored by upstream maintainer Tatu Saloranta in July 2019, years before TuxCare onboarded version 2.13.4 in September 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 when Default Typing is enabled and logback is in the classpath, allowing polymorphic deserialization of ch.qos.logback.core.db.JNDIConnectionSource for JNDI injection attacks. The target version 2.13.4-tuxcare.2 is NOT affected because the fix (adding JNDIConnectionSource to the SubTypeValidator blacklist) was already present in the upstream 2.13.4 release that TuxCare onboarded. The fix commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b was authored by upstream maintainer Tatu Saloranta in July 2019, years before TuxCare onboarded version 2.13.4 in September 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T16:45:42.706698+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target (jackson-databind 2.13.4-tuxcare.2) is not affected by CVE-2019-14540. The vulnerability was fixed by upstream maintainer Tatu Saloranta in commit d4983c740fec7d5576b207a8c30a63d3ea7443de, which was already part of upstream version 2.13.4 when TuxCare onboarded it. The fix adds HikariConfig and HikariDataSource to the deserialization blocklist in SubTypeValidator.java, preventing polymorphic deserialization attacks using these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "The target (jackson-databind 2.13.4-tuxcare.2) is not affected by CVE-2019-14540. The vulnerability was fixed by upstream maintainer Tatu Saloranta in commit d4983c740fec7d5576b207a8c30a63d3ea7443de, which was already part of upstream version 2.13.4 when TuxCare onboarded it. The fix adds HikariConfig and HikariDataSource to the deserialization blocklist in SubTypeValidator.java, preventing polymorphic deserialization attacks using these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T15:53:46.035464+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 affects jackson-databind versions before 2.9.10, allowing polymorphic deserialization of malicious objects using commons-configuration JNDI classes for arbitrary code execution. The target repository (jackson-databind 2.13.4-tuxcare.2) contains the upstream fix that blocks these gadget classes. The fix was authored by Tatu Saloranta (upstream maintainer) on 2019-09-19 and was included in the upstream 2.13.4 release before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 affects jackson-databind versions before 2.9.10, allowing polymorphic deserialization of malicious objects using commons-configuration JNDI classes for arbitrary code execution. The target repository (jackson-databind 2.13.4-tuxcare.2) contains the upstream fix that blocks these gadget classes. The fix was authored by Tatu Saloranta (upstream maintainer) on 2019-09-19 and was included in the upstream 2.13.4 release before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution. The fix, which adds this class to the deserialization blocklist, was applied by upstream author Tatu Saloranta in commit 998efd7082 (dated 2019-09-19) and was already present in the upstream 2.13.4 release before TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution. The fix, which adds this class to the deserialization blocklist, was applied by upstream author Tatu Saloranta in commit 998efd7082 (dated 2019-09-19) and was already present in the upstream 2.13.4 release before TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T17:03:25.795966+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is NOT present in jackson-databind 2.13.4. The vulnerability relates to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could be exploited as a gadget for arbitrary code execution. The fix that blocks HikariDataSource from polymorphic deserialization (commit 73c1c2cc76) was authored by upstream maintainer Tatu Saloranta and was already included in the upstream release 2.13.4 that TuxCare onboarded. The target repository contains the defense at SubTypeValidator.java:107.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 is NOT present in jackson-databind 2.13.4. The vulnerability relates to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could be exploited as a gadget for arbitrary code execution. The fix that blocks HikariDataSource from polymorphic deserialization (commit 73c1c2cc76) was authored by upstream maintainer Tatu Saloranta and was already included in the upstream release 2.13.4 that TuxCare onboarded. The target repository contains the defense at SubTypeValidator.java:107.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T15:03:12.180165+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind 2.0.0-2.9.10 via polymorphic deserialization of commons-dbcp gadget classes. Target version 2.13.4-tuxcare.2 is NOT AFFECTED because the upstream fix was already present in the 2.13.4 release. The three gadget classes (org.apache.commons.dbcp.datasources.PerUserPoolDataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, com.p6spy.engine.spy.P6DataSource) are blocklisted in SubTypeValidator.java lines 124-127, preventing their deserialization. The fix was authored by upstream maintainer Tatu Saloranta in commit 328a0f833daf6baa443ac3b37c818a0204714b0b (2019-09-28) and shipped in upstream 2.13.4 before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 affects jackson-databind 2.0.0-2.9.10 via polymorphic deserialization of commons-dbcp gadget classes. Target version 2.13.4-tuxcare.2 is NOT AFFECTED because the upstream fix was already present in the 2.13.4 release. The three gadget classes (org.apache.commons.dbcp.datasources.PerUserPoolDataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, com.p6spy.engine.spy.P6DataSource) are blocklisted in SubTypeValidator.java lines 124-127, preventing their deserialization. The fix was authored by upstream maintainer Tatu Saloranta in commit 328a0f833daf6baa443ac3b37c818a0204714b0b (2019-09-28) and shipped in upstream 2.13.4 before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T17:13:05.282153+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves polymorphic deserialization of malicious gadget classes (com.p6spy.engine.spy.P6DataSource and org.apache.commons.dbcp.datasources.*) when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in version 2.9.10.1 by adding these classes to a blocklist in SubTypeValidator.java. The target version 2.13.4 already contains this fix from the upstream release, shipped before TuxCare's onboarding. The blocklist entries are present at lines 124-127 of SubTypeValidator.java and are enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves polymorphic deserialization of malicious gadget classes (com.p6spy.engine.spy.P6DataSource and org.apache.commons.dbcp.datasources.*) when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in version 2.9.10.1 by adding these classes to a blocklist in SubTypeValidator.java. The target version 2.13.4 already contains this fix from the upstream release, shipped before TuxCare's onboarding. The blocklist entries are present at lines 124-127 of SubTypeValidator.java and are enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T15:27:45.237635+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5. The target is jackson-databind 2.13.4-tuxcare.2, which already contains the upstream vendor fix. The vulnerable class `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup` is present in the denylist at SubTypeValidator.java:99, preventing polymorphic deserialization of this dangerous class. The fix commit (191a4cdf87b) by upstream author Tatu Saloranta was already included in the upstream 2.13.4 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5. The target is jackson-databind 2.13.4-tuxcare.2, which already contains the upstream vendor fix. The vulnerable class `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup` is present in the denylist at SubTypeValidator.java:99, preventing polymorphic deserialization of this dangerous class. The fix commit (191a4cdf87b) by upstream author Tatu Saloranta was already included in the upstream 2.13.4 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T14:46:28.565161+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT AFFECTED in jackson-databind 2.13.4-tuxcare.2. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) was already present in the jackson-databind 2.13.4 release that TuxCare onboarded. The fix adds org.apache.log4j.receivers.db.JNDIConnectionSource and org.apache.log4j.receivers.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java, preventing the polymorphic typing vulnerability that could lead to arbitrary code execution via JNDI exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is NOT AFFECTED in jackson-databind 2.13.4-tuxcare.2. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) was already present in the jackson-databind 2.13.4 release that TuxCare onboarded. The fix adds org.apache.log4j.receivers.db.JNDIConnectionSource and org.apache.log4j.receivers.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java, preventing the polymorphic typing vulnerability that could lead to arbitrary code execution via JNDI exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:05:53.304095+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.4-tuxcare.2) is NOT affected by CVE-2019-20330. The fix for this vulnerability was already present in the upstream jackson-databind 2.13.4 release that TuxCare onboarded. The two ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and net.sf.ehcache.transaction.manager.selector.GlassfishSelector) that needed to be blocked are already present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 134-135). The fix was authored by upstream maintainer Tatu Saloranta, not TuxCare, and shipped with the upstream 2.13.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "The target repository (jackson-databind 2.13.4-tuxcare.2) is NOT affected by CVE-2019-20330. The fix for this vulnerability was already present in the upstream jackson-databind 2.13.4 release that TuxCare onboarded. The two ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and net.sf.ehcache.transaction.manager.selector.GlassfishSelector) that needed to be blocked are already present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 134-135). The fix was authored by upstream maintainer Tatu Saloranta, not TuxCare, and shipped with the upstream 2.13.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T17:00:04.359123+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind < 2.9.10.4 due to unsafe deserialization of ignite-jta classes. The target version 2.13.4-tuxcare.2 is based on upstream jackson-databind 2.13.4, which already includes the fix (commit a424c038). The fix adds three JNDI gadget classes (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider) to the deserialization blacklist in SubTypeValidator.java. The vulnerable pattern is not present because the upstream fix was shipped in the base 2.13.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 affects jackson-databind < 2.9.10.4 due to unsafe deserialization of ignite-jta classes. The target version 2.13.4-tuxcare.2 is based on upstream jackson-databind 2.13.4, which already includes the fix (commit a424c038). The fix adds three JNDI gadget classes (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider) to the deserialization blacklist in SubTypeValidator.java. The vulnerable pattern is not present because the upstream fix was shipped in the base 2.13.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.4-tuxcare.2 is NOT affected by CVE-2020-10672. The vulnerability involves deserialization gadget classes org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory that could enable RCE/JNDI injection via polymorphic deserialization. The fix (adding these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was applied upstream in jackson-databind 2.9.10.4/2.10.4 (March 2020) and is present in the upstream 2.13.4 release that TuxCare onboarded in September 2026. Both gadget classes are blocked at SubTypeValidator.java:163-164.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "The target jackson-databind 2.13.4-tuxcare.2 is NOT affected by CVE-2020-10672. The vulnerability involves deserialization gadget classes org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory that could enable RCE/JNDI injection via polymorphic deserialization. The fix (adding these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was applied upstream in jackson-databind 2.9.10.4/2.10.4 (March 2020) and is present in the upstream 2.13.4 release that TuxCare onboarded in September 2026. Both gadget classes are blocked at SubTypeValidator.java:163-164.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T16:24:56.766712+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is not present in jackson-databind 2.13.4-tuxcare.2. The fix that blocks deserialization of com.caucho.config.types.ResourceRef was included in upstream version 2.9.10.4 (March 2020) and is present in the target's upstream base version 2.13.4. The SubTypeValidator blocklist at line 167 prevents instantiation of this dangerous gadget class during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 is not present in jackson-databind 2.13.4-tuxcare.2. The fix that blocks deserialization of com.caucho.config.types.ResourceRef was included in upstream version 2.9.10.4 (March 2020) and is present in the target's upstream base version 2.13.4. The SubTypeValidator blocklist at line 167 prevents instantiation of this dangerous gadget class during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.13.4-tuxcare.2 is not affected by CVE-2020-10968. The vulnerability involved deserialization gadget classes org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider that could be exploited via polymorphic type handling. The fix, which adds these classes to the SubTypeValidator blacklist, was already present in the upstream jackson-databind 2.13.4 release that TuxCare onboarded. The blacklist entries are present at lines 170-171 of SubTypeValidator.java, and the validation mechanism is properly integrated into the deserialization path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "The target repository jackson-databind 2.13.4-tuxcare.2 is not affected by CVE-2020-10968. The vulnerability involved deserialization gadget classes org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider that could be exploited via polymorphic type handling. The fix, which adds these classes to the SubTypeValidator blacklist, was already present in the upstream jackson-databind 2.13.4 release that TuxCare onboarded. The blacklist entries are present at lines 170-171 of SubTypeValidator.java, and the validation mechanism is properly integrated into the deserialization path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 and relates to a deserialization gadget involving javax.swing.JEditorPane. The target repository (version 2.13.4-tuxcare.2) already contains the upstream fix that blocks javax.swing.JEditorPane from deserialization. The fix was introduced in upstream commit 6ba4845798 by Tatu Saloranta and was already present in version 2.13.4 when TuxCare onboarded it. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 and relates to a deserialization gadget involving javax.swing.JEditorPane. The target repository (version 2.13.4-tuxcare.2) already contains the upstream fix that blocks javax.swing.JEditorPane from deserialization. The fix was introduced in upstream commit 6ba4845798 by Tatu Saloranta and was already present in version 2.13.4 when TuxCare onboarded it. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves deserialization gadgets in org.apache.activemq.* classes that could enable JNDI injection or remote code execution. The upstream jackson-databind 2.13.4 release already contained the fix (commit 08fbfacf89), which adds all nine vulnerable activemq classes to the SubTypeValidator blocklist. This fix was shipped in the upstream release before TuxCare onboarded version 2.13.4, making it an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves deserialization gadgets in org.apache.activemq.* classes that could enable JNDI injection or remote code execution. The upstream jackson-databind 2.13.4 release already contained the fix (commit 08fbfacf89), which adds all nine vulnerable activemq classes to the SubTypeValidator blocklist. This fix was shipped in the upstream release before TuxCare onboarded version 2.13.4, making it an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.4-tuxcare.2 is NOT AFFECTED by CVE-2020-11112. The vulnerability pattern (deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider gadget class) is not present because the upstream FasterXML fix is already applied. The blacklist entry was added in upstream commit 05d7e0e13f (jackson-databind 2.9.10.4) by Tatu Saloranta, and this fix shipped in the upstream 2.13.4 release that TuxCare onboarded. The defense is actively enforced via SubTypeValidator.validateSubType() during bean deserialization (BeanDeserializerFactory.java:140, 1009).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "Target version 2.13.4-tuxcare.2 is NOT AFFECTED by CVE-2020-11112. The vulnerability pattern (deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider gadget class) is not present because the upstream FasterXML fix is already applied. The blacklist entry was added in upstream commit 05d7e0e13f (jackson-databind 2.9.10.4) by Tatu Saloranta, and this fix shipped in the upstream 2.13.4 release that TuxCare onboarded. The defense is actively enforced via SubTypeValidator.validateSubType() during bean deserialization (BeanDeserializerFactory.java:140, 1009).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entry for org.apache.openjpa.ee.WASRegistryManagedRuntime, which could enable deserialization gadget attacks. The target repository (jackson-databind 2.13.4-tuxcare.2) already contains the fix at line 84 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta (commit e2ba12d5d60) and was already present in the upstream 2.13.4 release before TuxCare onboarded it. The vulnerable pattern (missing blacklist entry) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entry for org.apache.openjpa.ee.WASRegistryManagedRuntime, which could enable deserialization gadget attacks. The target repository (jackson-databind 2.13.4-tuxcare.2) already contains the fix at line 84 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta (commit e2ba12d5d60) and was already present in the upstream 2.13.4 release before TuxCare onboarded it. The vulnerable pattern (missing blacklist entry) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is not present in jackson-databind 2.13.4-tuxcare.2. The upstream fix (commit 113e89fb08 by Tatu Saloranta) that adds MethodLocatingFactoryBean and BeanReferenceFactoryBean to the deserialization blacklist was already included in upstream version 2.13.4 when TuxCare onboarded it. The SubTypeValidator.java file at lines 52-54 contains the required blacklist entries preventing deserialization of these dangerous Spring classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 is not present in jackson-databind 2.13.4-tuxcare.2. The upstream fix (commit 113e89fb08 by Tatu Saloranta) that adds MethodLocatingFactoryBean and BeanReferenceFactoryBean to the deserialization blacklist was already included in upstream version 2.13.4 when TuxCare onboarded it. The SubTypeValidator.java file at lines 52-54 contains the required blacklist entries preventing deserialization of these dangerous Spring classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for org.apache.commons.jelly.impl.Embedded, enabling deserialization gadget attacks. The target version 2.13.4-tuxcare.2 is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability in version 2.13.4 before TuxCare onboarded it. The fix (commit 77040d85e3) adds the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, which prevents deserialization of this class and blocks the attack chain. The defense is present at line 189, functional, and was shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for org.apache.commons.jelly.impl.Embedded, enabling deserialization gadget attacks. The target version 2.13.4-tuxcare.2 is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability in version 2.13.4 before TuxCare onboarded it. The fix (commit 77040d85e3) adds the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, which prevents deserialization of this class and blocks the attack chain. The defense is present at line 189, functional, and was shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to unsafe deserialization of the gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool`. The target version 2.13.4 already contains the upstream fix that adds this class (and related `oadd.org.apache.commons.dbcp.*` classes) to the deserialization blocklist in SubTypeValidator.java. The fix commits (d1c67a0396 and ac7232e3f9) were authored by the upstream maintainer (tatu.saloranta@iki.fi) and were already present in the upstream 2.13.4 release before TuxCare onboarding (first TuxCare commit 3420829a84). The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to unsafe deserialization of the gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool`. The target version 2.13.4 already contains the upstream fix that adds this class (and related `oadd.org.apache.commons.dbcp.*` classes) to the deserialization blocklist in SubTypeValidator.java. The fix commits (d1c67a0396 and ac7232e3f9) were authored by the upstream maintainer (tatu.saloranta@iki.fi) and were already present in the upstream 2.13.4 release before TuxCare onboarding (first TuxCare commit 3420829a84). The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.4 is NOT affected by CVE-2020-14061. The vulnerability (missing blacklist entries for Oracle JMS connection factory classes) is not present because the upstream vendor fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by tatu.saloranta@iki.fi) shipped in the upstream 2.13.4 release before TuxCare onboarded it. The five Oracle JMS class names (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist at SubTypeValidator.java lines 200-204, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "Target version 2.13.4 is NOT affected by CVE-2020-14061. The vulnerability (missing blacklist entries for Oracle JMS connection factory classes) is not present because the upstream vendor fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by tatu.saloranta@iki.fi) shipped in the upstream 2.13.4 release before TuxCare onboarded it. The five Oracle JMS class names (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist at SubTypeValidator.java lines 200-204, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves deserialization of the gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool, which could lead to arbitrary code execution. The fix (adding this class to the SubTypeValidator blocklist) was authored by upstream maintainer Tatu Saloranta and shipped in upstream version 2.13.4, which TuxCare subsequently onboarded. The blocklist entry exists at SubTypeValidator.java:119 and is enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves deserialization of the gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool, which could lead to arbitrary code execution. The fix (adding this class to the SubTypeValidator blocklist) was authored by upstream maintainer Tatu Saloranta and shipped in upstream version 2.13.4, which TuxCare subsequently onboarded. The blocklist entry exists at SubTypeValidator.java:119 and is enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is not present in jackson-databind 2.13.4-tuxcare.2. The fix was already included in the upstream jackson-databind 2.13.4 release that TuxCare onboarded. The blocklist entry for org.jsecurity.realm.jndi.JndiRealmFactory exists at line 207 of SubTypeValidator.java, preventing deserialization of this gadget class. The fix commits (f6d9c664f6 and 08fbfacf89) are ancestors of the first TuxCare commit (3420829a84 \"Onboard version 2.13.4\"), confirming they shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 is not present in jackson-databind 2.13.4-tuxcare.2. The fix was already included in the upstream jackson-databind 2.13.4 release that TuxCare onboarded. The blocklist entry for org.jsecurity.realm.jndi.JndiRealmFactory exists at line 207 of SubTypeValidator.java, preventing deserialization of this gadget class. The fix commits (f6d9c664f6 and 08fbfacf89) are ancestors of the first TuxCare commit (3420829a84 \"Onboard version 2.13.4\"), confirming they shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T14:18:25.927574+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is a Jackson deserialization gadget vulnerability related to br.com.anteros.dbcp.AnterosDBCPDataSource affecting versions before 2.9.10.6. The target version 2.13.4 already contains the upstream fix (commit 3d97153944 by Tatu Saloranta) that adds this class to the SubTypeValidator blocklist. The fix was included in the upstream release of jackson-databind 2.13.4 before TuxCare onboarded it, confirmed by the fix commit being an ancestor of the first TuxCare commit (3420829a84 \"Onboard version 2.13.4\"). The vulnerable pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 is a Jackson deserialization gadget vulnerability related to br.com.anteros.dbcp.AnterosDBCPDataSource affecting versions before 2.9.10.6. The target version 2.13.4 already contains the upstream fix (commit 3d97153944 by Tatu Saloranta) that adds this class to the SubTypeValidator blocklist. The fix was included in the upstream release of jackson-databind 2.13.4 before TuxCare onboarded it, confirmed by the fix commit being an ancestor of the first TuxCare commit (3420829a84 \"Onboard version 2.13.4\"). The vulnerable pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T15:13:50.465041+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.4-tuxcare.2 is NOT affected by CVE-2020-24750. The fix (blocklist entry for com.pastdev.httpcomponents.configuration.JndiConfiguration) was already present in the upstream 2.13.4 release that TuxCare onboarded. The gadget class is blocked by SubTypeValidator.java:210, preventing JNDI-based deserialization attacks. Fix commit 6cc9f1a1af by upstream maintainer Tatu Saloranta predates the first TuxCare commit (3420829a84 - Onboard version 2.13.4), confirming this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "The target jackson-databind 2.13.4-tuxcare.2 is NOT affected by CVE-2020-24750. The fix (blocklist entry for com.pastdev.httpcomponents.configuration.JndiConfiguration) was already present in the upstream 2.13.4 release that TuxCare onboarded. The gadget class is blocked by SubTypeValidator.java:210, preventing JNDI-based deserialization attacks. Fix commit 6cc9f1a1af by upstream maintainer Tatu Saloranta predates the first TuxCare commit (3420829a84 - Onboard version 2.13.4), confirming this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in jackson-databind DOMDeserializer) is NOT present in target version 2.13.4-tuxcare.2. The upstream fix (commit 612f971b78c by Tatu Saloranta, 2020-01-09) was already included in the jackson-databind 2.13.4 release that TuxCare onboarded. The fix adds two XML parser features to prevent external entity expansion: (1) disallow-doctype-decl=true to reject DOCTYPE declarations, and (2) load-external-dtd=false to prevent loading external DTDs. These protections are configured in the static initializer of DOMDeserializer.java (lines 43-49) and apply to all DOM document parsing. The vulnerable pattern (unprotected external entity processing) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE vulnerability in jackson-databind DOMDeserializer) is NOT present in target version 2.13.4-tuxcare.2. The upstream fix (commit 612f971b78c by Tatu Saloranta, 2020-01-09) was already included in the jackson-databind 2.13.4 release that TuxCare onboarded. The fix adds two XML parser features to prevent external entity expansion: (1) disallow-doctype-decl=true to reject DOCTYPE declarations, and (2) load-external-dtd=false to prevent loading external DTDs. These protections are configured in the static initializer of DOMDeserializer.java (lines 43-49) and apply to all DOM document parsing. The vulnerable pattern (unprotected external entity processing) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T14:19:44.520074+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.13.4-tuxcare.2 is not affected by CVE-2020-35490. The vulnerability concerns polymorphic deserialization gadgets (PerUserPoolDataSource and SharedPoolDataSource from commons-dbcp2) that could enable arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 41b8bdb5cc by adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.4 release that TuxCare onboarded (first TuxCare commit: 3420829a84 \"Onboard version 2.13.4\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "The target repository jackson-databind 2.13.4-tuxcare.2 is not affected by CVE-2020-35490. The vulnerability concerns polymorphic deserialization gadgets (PerUserPoolDataSource and SharedPoolDataSource from commons-dbcp2) that could enable arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 41b8bdb5cc by adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.4 release that TuxCare onboarded (first TuxCare commit: 3420829a84 \"Onboard version 2.13.4\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T12:31:15.270922+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability was fixed by upstream commit 41b8bdb5cc (issue #2986) which added org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was already included in upstream release 2.13.4 before TuxCare onboarded it, as confirmed by the fix commit being an ancestor of the first TuxCare commit (3420829a84 \"Onboard version 2.13.4\"). The blocklist entries are present at lines 217-218 and properly enforced by the validation logic at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "CVE-2020-35491 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability was fixed by upstream commit 41b8bdb5cc (issue #2986) which added org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was already included in upstream release 2.13.4 before TuxCare onboarded it, as confirmed by the fix commit being an ancestor of the first TuxCare commit (3420829a84 \"Onboard version 2.13.4\"). The blocklist entries are present at lines 217-218 and properly enforced by the validation logic at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T14:53:26.160394+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves deserialization of the gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool, which could lead to arbitrary code execution. The upstream fix (commit 1ca0388c2fb by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in the upstream release 2.13.4, which predates the TuxCare onboarding commit. The target version inherits this protection from the upstream codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves deserialization of the gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool, which could lead to arbitrary code execution. The upstream fix (commit 1ca0388c2fb by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in the upstream release 2.13.4, which predates the TuxCare onboarding commit. The target version inherits this protection from the upstream codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T13:22:33.360201+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.4 is NOT affected by CVE-2020-36179. The vulnerability involves deserialization of dangerous gadget classes (specifically DriverAdapterCPDS and related DBCP classes) that could lead to remote code execution. The upstream fix (commit 3ded28aece by Tatu Saloranta on Dec 31, 2020) adds these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in upstream release 2.12.1 and all subsequent versions. Since the target is version 2.13.4, which is newer than 2.12.1, the fix was already present in the upstream release that TuxCare onboarded (commit 3420829a84 \"Onboard version 2.13.4\" by amoniatovskiy@cloudlinux.com). All five DriverAdapterCPDS variants from the patch are present in SubTypeValidator.java lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "The target jackson-databind 2.13.4 is NOT affected by CVE-2020-36179. The vulnerability involves deserialization of dangerous gadget classes (specifically DriverAdapterCPDS and related DBCP classes) that could lead to remote code execution. The upstream fix (commit 3ded28aece by Tatu Saloranta on Dec 31, 2020) adds these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in upstream release 2.12.1 and all subsequent versions. Since the target is version 2.13.4, which is newer than 2.12.1, the fix was already present in the upstream release that TuxCare onboarded (commit 3420829a84 \"Onboard version 2.13.4\" by amoniatovskiy@cloudlinux.com). All five DriverAdapterCPDS variants from the patch are present in SubTypeValidator.java lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T15:33:21.899203+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.4-tuxcare.2 is NOT AFFECTED by CVE-2020-36180. The vulnerability involves deserialization gadgets using org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes to achieve code execution via polymorphic type handling. The upstream fix (commit 3ded28aece) added five DriverAdapterCPDS class name variants to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in upstream jackson-databind 2.13.4, which TuxCare onboarded at commit 3420829a. All five variants are confirmed present in the target at SubTypeValidator.java lines 123, 193, 219, 228, and 234. The vulnerable code pattern does not exist in the target because the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "Target jackson-databind 2.13.4-tuxcare.2 is NOT AFFECTED by CVE-2020-36180. The vulnerability involves deserialization gadgets using org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes to achieve code execution via polymorphic type handling. The upstream fix (commit 3ded28aece) added five DriverAdapterCPDS class name variants to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in upstream jackson-databind 2.13.4, which TuxCare onboarded at commit 3420829a. All five variants are confirmed present in the target at SubTypeValidator.java lines 123, 193, 219, 228, and 234. The vulnerable code pattern does not exist in the target because the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T16:40:52.879992+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 targets jackson-databind versions before 2.9.10.8, involving deserialization gadget class org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The target version 2.13.4-tuxcare.2 already contains the upstream fix that blocks this gadget class in SubTypeValidator. The fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by upstream author Tatu Saloranta) was included in the upstream 2.13.4 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 targets jackson-databind versions before 2.9.10.8, involving deserialization gadget class org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The target version 2.13.4-tuxcare.2 already contains the upstream fix that blocks this gadget class in SubTypeValidator. The fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by upstream author Tatu Saloranta) was included in the upstream 2.13.4 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T14:11:33.363226+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS which could enable remote code execution. The fix (commit 3ded28aece6 by upstream author Tatu Saloranta) added this class to the deserialization blocklist in SubTypeValidator.java and was included in upstream release 2.9.10.8 (December 2020). Since the target version 2.13.4 (September 2022) is much later, it inherited the fix from the upstream release. The blocklist entry at line 234 of SubTypeValidator.java prevents deserialization of this gadget class, and the validation is active by default with no bypass mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "CVE-2020-36182 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS which could enable remote code execution. The fix (commit 3ded28aece6 by upstream author Tatu Saloranta) added this class to the deserialization blocklist in SubTypeValidator.java and was included in upstream release 2.9.10.8 (December 2020). Since the target version 2.13.4 (September 2022) is much later, it inherited the fix from the upstream release. The blocklist entry at line 234 of SubTypeValidator.java prevents deserialization of this gadget class, and the validation is active by default with no bypass mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T15:20:07.841451+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.4-tuxcare.2 is not affected by CVE-2020-36183. The upstream fix (commit 12e23c962f by Tatu Saloranta) was already present in upstream release 2.9.10.8, and version 2.13.4 inherited this fix. The blocklist entry for \"org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool\" exists at SubTypeValidator.java:243 and is properly enforced during polymorphic deserialization, preventing exploitation of this serialization gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "Target jackson-databind 2.13.4-tuxcare.2 is not affected by CVE-2020-36183. The upstream fix (commit 12e23c962f by Tatu Saloranta) was already present in upstream release 2.9.10.8, and version 2.13.4 inherited this fix. The blocklist entry for \"org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool\" exists at SubTypeValidator.java:243 and is properly enforced during polymorphic deserialization, preventing exploitation of this serialization gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T12:23:26.744347+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 and involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources classes. The target repository is jackson-databind version 2.13.4-tuxcare.2, which already contains the upstream fix. The fix adds blocklist entries for PerUserPoolDataSource and SharedPoolDataSource to SubTypeValidator.java (lines 234-236), preventing their deserialization. This fix was applied upstream by Tatu Saloranta in commit 567194c53ae and was already included in the upstream 2.13.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 and involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources classes. The target repository is jackson-databind version 2.13.4-tuxcare.2, which already contains the upstream fix. The fix adds blocklist entries for PerUserPoolDataSource and SharedPoolDataSource to SubTypeValidator.java (lines 234-236), preventing their deserialization. This fix was applied upstream by Tatu Saloranta in commit 567194c53ae and was already included in the upstream 2.13.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T16:04:33.761797+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves polymorphic deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes. The upstream fix (commit 567194c53a by Tatu Saloranta, 2020-12-26) added these classes to the deserialization blacklist in SubTypeValidator.java and was included in jackson-databind 2.9.10.8. Target version 2.13.4 (released 2022-09-03) already contains this upstream fix, which shipped with the base release that TuxCare onboarded. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves polymorphic deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes. The upstream fix (commit 567194c53a by Tatu Saloranta, 2020-12-26) added these classes to the deserialization blacklist in SubTypeValidator.java and was included in jackson-databind 2.9.10.8. Target version 2.13.4 (released 2022-09-03) already contains this upstream fix, which shipped with the base release that TuxCare onboarded. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T14:29:21.349678+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. The target version 2.13.4 is NOT affected because the upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta, dated 2020-12-26) was already included in the upstream release 2.13.0+ before TuxCare onboarded version 2.13.4. The vulnerable gadget classes are blacklisted in SubTypeValidator.java lines 229-230 and properly enforced at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. The target version 2.13.4 is NOT affected because the upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta, dated 2020-12-26) was already included in the upstream release 2.13.0+ before TuxCare onboarded version 2.13.4. The vulnerable gadget classes are blacklisted in SubTypeValidator.java lines 229-230 and properly enforced at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T14:43:14.856496+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.13.4 is NOT AFFECTED by CVE-2020-36187. The vulnerability concerns deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta, 2020-12-26) added blocklist entries for SharedPoolDataSource and PerUserPoolDataSource to SubTypeValidator.java, preventing their deserialization. This fix was included in upstream version 2.9.10.8 and all subsequent versions. The target version 2.13.4 was released with this fix already present, so the vulnerable code pattern (missing blocklist entries) never existed in this version. The blocklist is actively enforced during bean deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "The target repository jackson-databind version 2.13.4 is NOT AFFECTED by CVE-2020-36187. The vulnerability concerns deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta, 2020-12-26) added blocklist entries for SharedPoolDataSource and PerUserPoolDataSource to SubTypeValidator.java, preventing their deserialization. This fix was included in upstream version 2.9.10.8 and all subsequent versions. The target version 2.13.4 was released with this fix already present, so the vulnerable code pattern (missing blocklist entries) never existed in this version. The blocklist is actively enforced during bean deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T15:49:18.906233+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.4-tuxcare.2 is not affected by CVE-2020-36188. The vulnerability was fixed upstream by commit 33d96c13fe (authored by Tatu Saloranta) which added the malicious gadget classes to the deserialization blacklist. This fix was already present in jackson-databind 2.13.4 when TuxCare onboarded it. The defense blocks instantiation of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource during polymorphic deserialization, preventing the attack chain from reaching arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "The target jackson-databind 2.13.4-tuxcare.2 is not affected by CVE-2020-36188. The vulnerability was fixed upstream by commit 33d96c13fe (authored by Tatu Saloranta) which added the malicious gadget classes to the deserialization blacklist. This fix was already present in jackson-databind 2.13.4 when TuxCare onboarded it. The defense blocks instantiation of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource during polymorphic deserialization, preventing the attack chain from reaching arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T12:58:17.463230+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability, related to deserialization gadgets com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource, was fixed by upstream FasterXML in commit 33d96c13fe (issue #2996). This fix was included in upstream version 2.12.1 (released Jan 2021) and all subsequent versions including 2.13.4, which TuxCare onboarded in commit 3420829a84 without modification. The target version inherited this fix from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 is not present in jackson-databind 2.13.4-tuxcare.2. The vulnerability, related to deserialization gadgets com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource, was fixed by upstream FasterXML in commit 33d96c13fe (issue #2996). This fix was included in upstream version 2.12.1 (released Jan 2021) and all subsequent versions including 2.13.4, which TuxCare onboarded in commit 3420829a84 without modification. The target version inherited this fix from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T14:15:42.590601+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.4-tuxcare.2 is NOT AFFECTED by CVE-2020-36518. The vulnerability (unbounded recursion in UntypedObjectDeserializer causing stack overflow DoS via deeply nested JSON) was fixed in upstream release 2.13.2.1 by commit fcfc4998ec authored by Taylor S. Marks. TuxCare onboarded version 2.13.4 which already included this upstream fix. The defense (MAX_DEPTH=1000 limit with depth tracking and validation) is fully present and active in the target at UntypedObjectDeserializer.java:666,714-716,730-732.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "Target jackson-databind 2.13.4-tuxcare.2 is NOT AFFECTED by CVE-2020-36518. The vulnerability (unbounded recursion in UntypedObjectDeserializer causing stack overflow DoS via deeply nested JSON) was fixed in upstream release 2.13.2.1 by commit fcfc4998ec authored by Taylor S. Marks. TuxCare onboarded version 2.13.4 which already included this upstream fix. The defense (MAX_DEPTH=1000 limit with depth tracking and validation) is fully present and active in the target at UntypedObjectDeserializer.java:666,714-716,730-732.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T16:09:26.959129+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is NOT present in jackson-databind 2.13.4. The vulnerability required the absence of org.apache.xbean.propertyeditor.JndiConverter from the deserialization blacklist to enable JNDI injection attacks. The target contains the fix at SubTypeValidator.java:137-138, added by upstream commit 914e7c9f2c on 2020-02-09. This fix was already in the upstream 2.13.4 release that TuxCare onboarded, as confirmed by ancestry analysis. The CVE affected versions (before 2.9.10.2) are much older than 2.13.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 is NOT present in jackson-databind 2.13.4. The vulnerability required the absence of org.apache.xbean.propertyeditor.JndiConverter from the deserialization blacklist to enable JNDI injection attacks. The target contains the fix at SubTypeValidator.java:137-138, added by upstream commit 914e7c9f2c on 2020-02-09. This fix was already in the upstream 2.13.4 release that TuxCare onboarded, as confirmed by ancestry analysis. The CVE affected versions (before 2.9.10.2) are much older than 2.13.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.4-tuxcare.2) is NOT affected by CVE-2020-9546. The vulnerability involves deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig through Jackson's polymorphic typing. The fix (adding this class to the deserialization blocklist) was introduced by upstream FasterXML in commit 9f4e97019fb0dd836533d0b6198c88787e235ae2 on Feb 29, 2020, and was already present in the 2.13.4 release that TuxCare onboarded on 3420829a84. The blocklist entry is active at SubTypeValidator.java:141 and is enforced through BeanDeserializerFactory during all polymorphic deserialization operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "The target repository (jackson-databind 2.13.4-tuxcare.2) is NOT affected by CVE-2020-9546. The vulnerability involves deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig through Jackson's polymorphic typing. The fix (adding this class to the deserialization blocklist) was introduced by upstream FasterXML in commit 9f4e97019fb0dd836533d0b6198c88787e235ae2 on Feb 29, 2020, and was already present in the 2.13.4 release that TuxCare onboarded on 3420829a84. The blocklist entry is active at SubTypeValidator.java:141 and is enforced through BeanDeserializerFactory during all polymorphic deserialization operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T15:38:16.833370+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions that lack blocklist protection against the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target repository (jackson-databind 2.13.4-tuxcare.2) is NOT AFFECTED because the fix was already present in the upstream version 2.13.4 that TuxCare onboarded. The gadget class is properly blocklisted in SubTypeValidator.java line 144, and this blocklist is actively enforced during deserialization by BeanDeserializerFactory. The fix was authored by the upstream maintainer Tatu Saloranta and shipped in the upstream release, predating TuxCare's involvement by 3380 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 affects jackson-databind versions that lack blocklist protection against the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target repository (jackson-databind 2.13.4-tuxcare.2) is NOT AFFECTED because the fix was already present in the upstream version 2.13.4 that TuxCare onboarded. The gadget class is properly blocklisted in SubTypeValidator.java line 144, and this blocklist is actively enforced during deserialization by BeanDeserializerFactory. The fix was authored by the upstream maintainer Tatu Saloranta and shipped in the upstream release, predating TuxCare's involvement by 3380 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T16:13:53.139556+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves deserialization gadget class br.com.anteros.dbcp.AnterosDBCPConfig being exploitable through polymorphic type handling. The upstream fix (commit 9f4e97019fb by Tatu Saloranta, 2020-02-29) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in the upstream 2.13.4 release when TuxCare onboarded it (first TuxCare commit: 3420829a84, \"Onboard version 2.13.4\"). The defense is active at SubTypeValidator.java:145 and properly integrated into BeanDeserializerFactory's deserialization pipeline.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves deserialization gadget class br.com.anteros.dbcp.AnterosDBCPConfig being exploitable through polymorphic type handling. The upstream fix (commit 9f4e97019fb by Tatu Saloranta, 2020-02-29) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in the upstream 2.13.4 release when TuxCare onboarded it (first TuxCare commit: 3420829a84, \"Onboard version 2.13.4\"). The defense is active at SubTypeValidator.java:145 and properly integrated into BeanDeserializerFactory's deserialization pipeline.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T15:10:53.898872+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves deserialization of malicious gadget classes (specifically javax.swing.JTextPane and javax.swing.JEditorPane) that can lead to remote code execution. The upstream fix, authored by Tatu Saloranta (commit 7dbf51bf), added these classes to the SubTypeValidator blocklist and was already present in the upstream 2.13.4 release before TuxCare onboarded it. The target code contains the complete fix at SubTypeValidator.java:149-151, blocking deserialization of the vulnerable gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.13.4-tuxcare.2. The vulnerability involves deserialization of malicious gadget classes (specifically javax.swing.JTextPane and javax.swing.JEditorPane) that can lead to remote code execution. The upstream fix, authored by Tatu Saloranta (commit 7dbf51bf), added these classes to the SubTypeValidator blocklist and was already present in the upstream 2.13.4 release before TuxCare onboarded it. The target code contains the complete fix at SubTypeValidator.java:149-151, blocking deserialization of the vulnerable gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877: Target jackson-databind 2.13.4 is NOT AFFECTED. The vulnerability was fixed in upstream version 2.13.1 (per CVE: \"2.13.x before 2.13.1\"). The fix (commit 3ccde7d938 by Tatu Saloranta) was already present in the upstream 2.13.4 release that TuxCare onboarded. The vulnerable code pattern (direct heap allocation from untrusted serialization length) is not present; the target contains the complete defense (100KB allocation cap with incremental reading).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "CVE-2021-46877: Target jackson-databind 2.13.4 is NOT AFFECTED. The vulnerability was fixed in upstream version 2.13.1 (per CVE: \"2.13.x before 2.13.1\"). The fix (commit 3ccde7d938 by Tatu Saloranta) was already present in the upstream 2.13.4 release that TuxCare onboarded. The vulnerable code pattern (direct heap allocation from untrusted serialization length) is not present; the target contains the complete defense (100KB allocation cap with incremental reading).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:36.054933+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T14:57:36.079339+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 is not present in jackson-databind 2.13.4-tuxcare.2. The fix for deeply nested array resource exhaustion was already included in the upstream 2.13.4 release (authored by Tatu Saloranta on Aug 23, 2022) before TuxCare onboarded this version. The defensive check in BeanDeserializer._deserializeFromArray() (lines 632-640) prevents processing of deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled by rejecting any input with consecutive START_ARRAY tokens.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "CVE-2022-42004 is not present in jackson-databind 2.13.4-tuxcare.2. The fix for deeply nested array resource exhaustion was already included in the upstream 2.13.4 release (authored by Tatu Saloranta on Aug 23, 2022) before TuxCare onboarded this version. The defensive check in BeanDeserializer._deserializeFromArray() (lines 632-640) prevents processing of deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled by rejecting any input with consecutive START_ARRAY tokens.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:36.054933+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:36.054933+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:36.054933+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:36.054933+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:36.054933+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:36.054933+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:36.054933+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:36.054933+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-03T02:27:24.942271+00:00", "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.13.4-tuxcare.2 is NOT AFFECTED by CVE-2026-54517. While the code flaw (missing @JsonView check in the property-buffering branch of creator-based deserialization at BeanDeserializer.java:468-471 and BuilderBasedDeserializer.java:410-412) exists in the source, the specific attack chain described in the CVE cannot be executed. The vulnerability requires the isMerging() mechanism to route...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54517" }, "impact_statement": "not_affected \u2014 Version 2.13.4-tuxcare.2 is NOT AFFECTED by CVE-2026-54517. While the code flaw (missing @JsonView check in the property-buffering branch of creator-based deserialization at BeanDeserializer.java:468-471 and BuilderBasedDeserializer.java:410-412) exists in the source, the specific attack chain described in the CVE cannot be executed. The vulnerability requires the isMerging() mechanism to route..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-10T04:17:00.447062+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable replay of unwrapped JSON into constructor parameters does not exist, and unwrapped creator parameters are rejected. Unnamed parameters trigger an unsupported-combination error at src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:1156. Named creator properties with unwrapping annotations are rejected during resolution at src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:934.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable replay of unwrapped JSON into constructor parameters does not exist, and unwrapped creator parameters are rejected. Unnamed parameters trigger an unsupported-combination error at src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:1156. Named creator properties with unwrapping annotations are rejected during resolution at src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:934." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-11-05T11:23:00.042132+00:00", "status_notes": "Vulnerability CVE-2026-59888 affects version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.4-tuxcare.3.", "vulnerability": { "name": "CVE-2026-59888" }, "action_statement": "Vulnerability CVE-2026-59888 affects version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.4-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:36.054933+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:50.780549+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:50.780549+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:36.054933+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:50.780549+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:50.780549+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-28T17:51:36.054933+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.13.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.4-tuxcare.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.13.4-tuxcare.2.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }