{ "@id": "urn:uuid:199572e8-3114-4fb9-8895-a09efcf2035f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 84, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T14:18:02.736616+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:08:56.260651+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.14.1 already contains the upstream fix that adds dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring and C3P0 classes) to the deserialization blacklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was already present when TuxCare onboarded version 2.14.1, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.14.1 already contains the upstream fix that adds dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring and C3P0 classes) to the deserialization blacklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was already present when TuxCare onboarded version 2.14.1, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:44:21.734688+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.14.1-tuxcare.3 is NOT vulnerable to CVE-2017-17485. The upstream 2.14.1 release (onboarded by TuxCare) already contained the complete fix introduced by upstream commit 2235894210c75f624a3d0cd60bfb0434a20a18bf. The fix includes: (1) SubTypeValidator class with blacklist for dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, and others); (2) hierarchy-based blocking for Spring classes extending AbstractPointcutAdvisor or AbstractApplicationContext; (3) prefix-based blocking for C3P0 DataSource classes. The defense is actively enforced in BeanDeserializerFactory.createBeanDeserializer (line 141).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "The target jackson-databind version 2.14.1-tuxcare.3 is NOT vulnerable to CVE-2017-17485. The upstream 2.14.1 release (onboarded by TuxCare) already contained the complete fix introduced by upstream commit 2235894210c75f624a3d0cd60bfb0434a20a18bf. The fix includes: (1) SubTypeValidator class with blacklist for dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, and others); (2) hierarchy-based blocking for Spring classes extending AbstractPointcutAdvisor or AbstractApplicationContext; (3) prefix-based blocking for C3P0 DataSource classes. The defense is actively enforced in BeanDeserializerFactory.createBeanDeserializer (line 141).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:27:51.969855+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2017-7525. The vulnerability pattern (unsafe deserialization of dangerous classes like TemplatesImpl) is not present because the fix shipped in the upstream release 2.14.1. The SubTypeValidator blocklist mechanism (introduced in upstream 2.8.11, commit 2235894210c by tatu.saloranta@iki.fi) blocks all CVE-2017-7525 gadget classes and is properly integrated into the bean deserialization path at BeanDeserializerFactory.java:141. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "Target version 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2017-7525. The vulnerability pattern (unsafe deserialization of dangerous classes like TemplatesImpl) is not present because the fix shipped in the upstream release 2.14.1. The SubTypeValidator blocklist mechanism (introduced in upstream 2.8.11, commit 2235894210c by tatu.saloranta@iki.fi) blocks all CVE-2017-7525 gadget classes and is properly integrated into the bean deserialization path at BeanDeserializerFactory.java:141. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:17:59.012677+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.1 is not affected by CVE-2018-11307. The vulnerability was fixed in upstream versions 2.7.9.4, 2.8.11.2, and 2.9.6 by blacklisting the org.apache.ibatis.parsing.XPathParser gadget class. Version 2.14.1 already contains this fix, which was shipped in the upstream release before TuxCare onboarding. The blacklist entry is present at SubTypeValidator.java:65 and actively enforced by BeanDeserializerFactory during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "The target jackson-databind 2.14.1 is not affected by CVE-2018-11307. The vulnerability was fixed in upstream versions 2.7.9.4, 2.8.11.2, and 2.9.6 by blacklisting the org.apache.ibatis.parsing.XPathParser gadget class. Version 2.14.1 already contains this fix, which was shipped in the upstream release before TuxCare onboarding. The blacklist entry is present at SubTypeValidator.java:65 and actively enforced by BeanDeserializerFactory during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T17:18:37.716688+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.14.1-tuxcare.3) is not affected by CVE-2018-12022. The vulnerability allowed polymorphic deserialization of malicious gadget classes (jodd.db.connection.DataSourceConnectionProvider and Oracle JDBC classes) to achieve remote code execution when Default Typing is enabled. The fix, which adds these class names to a blacklist in SubTypeValidator.java (lines 67-72), was authored by upstream FasterXML maintainer Tatu Saloranta and was already present in jackson-databind 2.14.1 when TuxCare onboarded it. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "The target repository (jackson-databind 2.14.1-tuxcare.3) is not affected by CVE-2018-12022. The vulnerability allowed polymorphic deserialization of malicious gadget classes (jodd.db.connection.DataSourceConnectionProvider and Oracle JDBC classes) to achieve remote code execution when Default Typing is enabled. The fix, which adds these class names to a blacklist in SubTypeValidator.java (lines 67-72), was authored by upstream FasterXML maintainer Tatu Saloranta and was already present in jackson-databind 2.14.1 when TuxCare onboarded it. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:20:17.888209+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is not present in jackson-databind 2.14.1-tuxcare.3. The vulnerability was fixed in upstream versions 2.7.9.4, 2.8.11.2, and 2.9.6 (released June 2018) by adding Oracle JDBC class names to the deserialization blacklist in SubTypeValidator.java. These fixes were included in the upstream jackson-databind 2.14.1 release (November 2022) that TuxCare onboarded. Both required blacklist entries (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) are present at lines 71-72 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is not present in jackson-databind 2.14.1-tuxcare.3. The vulnerability was fixed in upstream versions 2.7.9.4, 2.8.11.2, and 2.9.6 (released June 2018) by adding Oracle JDBC class names to the deserialization blacklist in SubTypeValidator.java. These fixes were included in the upstream jackson-databind 2.14.1 release (November 2022) that TuxCare onboarded. Both required blacklist entries (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) are present at lines 71-72 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:51:14.737145+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability involves polymorphic deserialization of dangerous classes including org.slf4j.ext.EventData. The upstream fix added these classes to a blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java. This fix was applied by upstream maintainer Tatu Saloranta in commit 0899726ec34 (2018-08-16) and was already present in the upstream 2.14.1 release that TuxCare onboarded. The vulnerable pattern cannot exist in the target because SubTypeValidator.validateSubType() blocks deserialization of org.slf4j.ext.EventData at lines 74-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability involves polymorphic deserialization of dangerous classes including org.slf4j.ext.EventData. The upstream fix added these classes to a blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java. This fix was applied by upstream maintainer Tatu Saloranta in commit 0899726ec34 (2018-08-16) and was already present in the upstream 2.14.1 release that TuxCare onboarded. The vulnerable pattern cannot exist in the target because SubTypeValidator.validateSubType() blocks deserialization of org.slf4j.ext.EventData at lines 74-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:00:30.548174+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7 by allowing remote code execution via polymorphic deserialization of BlazeDS (blaze-ds) classes. The target repository is jackson-databind version 2.14.1-tuxcare.3, which already contains the upstream fix. The vulnerable class 'flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor' is blacklisted in SubTypeValidator.java (line 76) as part of the DEFAULT_NO_DESER_CLASS_NAMES set. This fix was introduced by upstream commit 87d29af25e82a249ea15858e2d4ecbf64091db44 (Fix #2097 for 2.6.7.2) authored by Tatu Saloranta, and was already present in the upstream 2.14.1 release when TuxCare onboarded it on 2026-08-25.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7 by allowing remote code execution via polymorphic deserialization of BlazeDS (blaze-ds) classes. The target repository is jackson-databind version 2.14.1-tuxcare.3, which already contains the upstream fix. The vulnerable class 'flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor' is blacklisted in SubTypeValidator.java (line 76) as part of the DEFAULT_NO_DESER_CLASS_NAMES set. This fix was introduced by upstream commit 87d29af25e82a249ea15858e2d4ecbf64091db44 (Fix #2097 for 2.6.7.2) authored by Tatu Saloranta, and was already present in the upstream 2.14.1 release when TuxCare onboarded it on 2026-08-25.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:07:52.803278+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.1-tuxcare.3 is NOT vulnerable to CVE-2018-14720. The fix blocking the four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was already present in the upstream 2.14.1 release that TuxCare onboarded. These classes are blocked in SubTypeValidator.java and the validation is enforced during polymorphic deserialization. The fix commit (87d29af25e) was authored by upstream maintainer Tatu Saloranta and predates TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "The target jackson-databind 2.14.1-tuxcare.3 is NOT vulnerable to CVE-2018-14720. The fix blocking the four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was already present in the upstream 2.14.1 release that TuxCare onboarded. These classes are blocked in SubTypeValidator.java and the validation is enforced during polymorphic deserialization. The fix commit (87d29af25e) was authored by upstream maintainer Tatu Saloranta and predates TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:37:15.372164+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2018-14721. The upstream fix (commit 87d29af25e by Tatu Saloranta, FasterXML maintainer) adds org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the blacklist in SubTypeValidator.java line 78, preventing polymorphic deserialization of the dangerous axis2-jaxws class. This fix was already present in the upstream 2.14.1 release before TuxCare onboarded it (fix commit is ancestor of first TuxCare commit f1899c86). The blacklist is actively enforced via SubTypeValidator.validateSubType() called from BeanDeserializerFactory.createBeanDeserializer() line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "Target version 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2018-14721. The upstream fix (commit 87d29af25e by Tatu Saloranta, FasterXML maintainer) adds org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the blacklist in SubTypeValidator.java line 78, preventing polymorphic deserialization of the dangerous axis2-jaxws class. This fix was already present in the upstream 2.14.1 release before TuxCare onboarded it (fix commit is ancestor of first TuxCare commit f1899c86). The blacklist is actively enforced via SubTypeValidator.validateSubType() called from BeanDeserializerFactory.createBeanDeserializer() line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T12:48:57.330318+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind 2.x before 2.9.8 due to failure to block org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization. The target version 2.14.1 already contains the upstream fix: SubTypeValidator.java line 85 includes the blocklist entry for this class. The fix was introduced by upstream commit 72cd4025a229fb28ec133235003dd4616f70afaa (author: tatu.saloranta@iki.fi) and was already present in the upstream 2.14.1 release. The vulnerable pattern (unblocked axis2-transport-jms class) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 affects jackson-databind 2.x before 2.9.8 due to failure to block org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization. The target version 2.14.1 already contains the upstream fix: SubTypeValidator.java line 85 includes the blocklist entry for this class. The fix was introduced by upstream commit 72cd4025a229fb28ec133235003dd4616f70afaa (author: tatu.saloranta@iki.fi) and was already present in the upstream 2.14.1 release. The vulnerable pattern (unblocked axis2-transport-jms class) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:56:06.275906+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2018-19361. The vulnerability pattern (missing blocklist entries for openjpa classes in polymorphic deserialization) is not present because the upstream vendor fix was already included in jackson-databind 2.14.1 upstream release. The SubTypeValidator.java file contains blocklist entries for org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime (lines 82-83), which prevent these classes from being deserialized. This fix was committed by Tatu Saloranta (FasterXML maintainer) on 2018-11-19, well before the 2.14.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "The target jackson-databind 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2018-19361. The vulnerability pattern (missing blocklist entries for openjpa classes in polymorphic deserialization) is not present because the upstream vendor fix was already included in jackson-databind 2.14.1 upstream release. The SubTypeValidator.java file contains blocklist entries for org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime (lines 82-83), which prevent these classes from being deserialized. This fix was committed by Tatu Saloranta (FasterXML maintainer) on 2018-11-19, well before the 2.14.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:24:42.202771+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.1 is not affected by CVE-2018-19362. The vulnerability affects versions \"2.x before 2.9.8\" and requires blocking org.jboss.util.propertyeditor.DocumentEditor from polymorphic deserialization. The fix was already present in the upstream jackson-databind 2.14.1 release, with the dangerous class added to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 81). The upstream fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 72cd4025a2, which predates the first TuxCare commit on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "The target jackson-databind 2.14.1 is not affected by CVE-2018-19362. The vulnerability affects versions \"2.x before 2.9.8\" and requires blocking org.jboss.util.propertyeditor.DocumentEditor from polymorphic deserialization. The fix was already present in the upstream jackson-databind 2.14.1 release, with the dangerous class added to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 81). The upstream fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 72cd4025a2, which predates the first TuxCare commit on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory). The target version 2.14.1 is not affected because the upstream vendor fix (commit 038b471e2e by Tatu Saloranta) was already shipped in the upstream release that TuxCare onboarded. Both gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java lines 62-63), preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory). The target version 2.14.1 is not affected because the upstream vendor fix (commit 038b471e2e by Tatu Saloranta) was already shipped in the upstream release that TuxCare onboarded. Both gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java lines 62-63), preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:46:51.866681+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.14.1-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in issue #1931 by replacing an insufficient blacklist of two specific c3p0 classes with a broader pattern-based validation that blocks ALL c3p0 classes matching `com.mchange.v2.c3p0.*DataSource`. This fix was already present in the upstream 2.14.1 release that TuxCare onboarded (commit f1899c8619), so the vulnerable pattern has never existed in the TuxCare-maintained version. The defense is active in SubTypeValidator.java lines 288-297.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.14.1-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in issue #1931 by replacing an insufficient blacklist of two specific c3p0 classes with a broader pattern-based validation that blocks ALL c3p0 classes matching `com.mchange.v2.c3p0.*DataSource`. This fix was already present in the upstream 2.14.1 release that TuxCare onboarded (commit f1899c8619), so the vulnerable pattern has never existed in the TuxCare-maintained version. The defense is active in SubTypeValidator.java lines 288-297.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:33:25.157477+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability involved a polymorphic typing gadget (com.mysql.cj.jdbc.admin.MiniAdmin) that could be exploited via Default Typing to read arbitrary local files. The upstream vendor fix (adding MiniAdmin to the deserialization blocklist in SubTypeValidator.java) was included in upstream version 2.9.9. Since the target version is 2.14.1, this fix was already present in the upstream release that TuxCare onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability involved a polymorphic typing gadget (com.mysql.cj.jdbc.admin.MiniAdmin) that could be exploited via Default Typing to read arbitrary local files. The upstream vendor fix (adding MiniAdmin to the deserialization blocklist in SubTypeValidator.java) was included in upstream version 2.9.9. Since the target version is 2.14.1, this fix was already present in the upstream release that TuxCare onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-01T18:35:00.085460+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target jackson-databind 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2019-12384. The vulnerability requires the absence of \"ch.qos.logback.core.db.DriverManagerConnectionSource\" from the polymorphic deserialization blocklist, allowing attackers to achieve code execution through unsafe instantiation of this logback-core class. The upstream vendor (Tatu Saloranta) fixed this in commit c9ef4a10d6 by ad...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 Target jackson-databind 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2019-12384. The vulnerability requires the absence of \"ch.qos.logback.core.db.DriverManagerConnectionSource\" from the polymorphic deserialization blocklist, allowing attackers to achieve code execution through unsafe instantiation of this logback-core class. The upstream vendor (Tatu Saloranta) fixed this in commit c9ef4a10d6 by ad..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-02T07:15:16.086271+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 with Default Typing enabled and JDOM in classpath, allowing arbitrary file reads via deserialization of XSLTransformer gadget classes. The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED because the upstream fix (commit 5f7c69bba0 by Tatu Saloranta) was already present in the upstream release 2.14.1 when TuxCare onb...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 with Default Typing enabled and JDOM in classpath, allowing arbitrary file reads via deserialization of XSLTransformer gadget classes. The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED because the upstream fix (commit 5f7c69bba0 by Tatu Saloranta) was already present in the upstream release 2.14.1 when TuxCare onb..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T12:09:40.812233+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.14.1. The dangerous class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup is already blocklisted in SubTypeValidator.java at line 98. The fix was authored by upstream vendor Tatu Saloranta (tatu.saloranta@iki.fi) in commit ad418eeb97 and shipped in upstream release 2.7.9.6 (July 2019). The target version 2.14.1 (November 2021) is far beyond the affected version range (before 2.9.9.2, 2.8.11.4, 2.7.9.6). The vulnerable pattern is not present because it was fixed in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.14.1. The dangerous class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup is already blocklisted in SubTypeValidator.java at line 98. The fix was authored by upstream vendor Tatu Saloranta (tatu.saloranta@iki.fi) in commit ad418eeb97 and shipped in upstream release 2.7.9.6 (July 2019). The target version 2.14.1 (November 2021) is far beyond the affected version range (before 2.9.9.2, 2.8.11.4, 2.7.9.6). The vulnerable pattern is not present because it was fixed in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:31:13.211032+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is not present in jackson-databind 2.14.1-tuxcare.3. The vulnerability concerns unsafe deserialization of ch.qos.logback.core.db.JNDIConnectionSource when Default Typing is enabled. The upstream fix (commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b by Tatu Saloranta, dated 2019-07-25) that adds this class to the SubTypeValidator blocklist was already present in the upstream jackson-databind 2.14.1 release that TuxCare onboarded. The dangerous class is blocked at line 102 of SubTypeValidator.java, preventing the polymorphic deserialization attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 is not present in jackson-databind 2.14.1-tuxcare.3. The vulnerability concerns unsafe deserialization of ch.qos.logback.core.db.JNDIConnectionSource when Default Typing is enabled. The upstream fix (commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b by Tatu Saloranta, dated 2019-07-25) that adds this class to the SubTypeValidator blocklist was already present in the upstream jackson-databind 2.14.1 release that TuxCare onboarded. The dangerous class is blocked at line 102 of SubTypeValidator.java, preventing the polymorphic deserialization attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:47:24.883937+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.14.1 is NOT AFFECTED by CVE-2019-14540. The vulnerability relates to missing blocklist entries for com.zaxxer.hikari.HikariConfig and HikariDataSource in Jackson's polymorphic deserialization validator. These blocklist entries are present in the target at SubTypeValidator.java lines 104-107, preventing the gadget classes from being deserialized. The fix was authored by upstream maintainer Tatu Saloranta and shipped with jackson-databind 2.14.1 release, which TuxCare subsequently onboarded. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "Target version 2.14.1 is NOT AFFECTED by CVE-2019-14540. The vulnerability relates to missing blocklist entries for com.zaxxer.hikari.HikariConfig and HikariDataSource in Jackson's polymorphic deserialization validator. These blocklist entries are present in the target at SubTypeValidator.java lines 104-107, preventing the gadget classes from being deserialized. The fix was authored by upstream maintainer Tatu Saloranta and shipped with jackson-databind 2.14.1 release, which TuxCare subsequently onboarded. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:55:07.952223+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3, allowing polymorphic deserialization of malicious objects using commons-configuration JNDI classes for arbitrary code execution. The target repository (jackson-databind 2.14.1-tuxcare.3) already contains the upstream fix that blocklists org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration in SubTypeValidator.java. This fix (commit 41b7f9b901) was authored by upstream maintainer Tatu Saloranta on 2019-09-19 and was already present in the upstream 2.14.1 release before TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3, allowing polymorphic deserialization of malicious objects using commons-configuration JNDI classes for arbitrary code execution. The target repository (jackson-databind 2.14.1-tuxcare.3) already contains the upstream fix that blocklists org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration in SubTypeValidator.java. This fix (commit 41b7f9b901) was authored by upstream maintainer Tatu Saloranta on 2019-09-19 and was already present in the upstream 2.14.1 release before TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.1-tuxcare.3 is not affected by CVE-2019-14893. The vulnerability (polymorphic deserialization of xalan JNDI gadget enabling arbitrary code execution via JNDI injection) was fixed in upstream jackson-databind by adding org.apache.xalan.lib.sql.JNDIConnectionPool to the SubTypeValidator blocklist. This fix (commit 998efd7082) was already present in jackson-databind 2.14.1 when TuxCare onboarded it, making this an upstream vendor fix rather than a TuxCare backport. The target also includes additional protections for xalan gadget variants.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "The target jackson-databind 2.14.1-tuxcare.3 is not affected by CVE-2019-14893. The vulnerability (polymorphic deserialization of xalan JNDI gadget enabling arbitrary code execution via JNDI injection) was fixed in upstream jackson-databind by adding org.apache.xalan.lib.sql.JNDIConnectionPool to the SubTypeValidator blocklist. This fix (commit 998efd7082) was already present in jackson-databind 2.14.1 when TuxCare onboarded it, making this an upstream vendor fix rather than a TuxCare backport. The target also includes additional protections for xalan gadget variants.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T17:05:23.635575+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 affects Jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic typing vulnerability related to com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream 2.14.1 release that TuxCare onboarded. The fix commit (73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db) by upstream maintainer Tatu Saloranta, dated 2019-09-12, added HikariDataSource to the SubTypeValidator blocklist. This commit is an ancestor of the TuxCare onboarding commit (f1899c86), confirming it was shipped in the upstream release. The vulnerable code pattern (allowing HikariDataSource in polymorphic deserialization) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 affects Jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic typing vulnerability related to com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream 2.14.1 release that TuxCare onboarded. The fix commit (73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db) by upstream maintainer Tatu Saloranta, dated 2019-09-12, added HikariDataSource to the SubTypeValidator blocklist. This commit is an ancestor of the TuxCare onboarding commit (f1899c86), confirming it was shipped in the upstream release. The vulnerable code pattern (allowing HikariDataSource in polymorphic deserialization) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:04:56.336983+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind 2.0.0-2.9.10 via unsafe deserialization of commons-dbcp datasource classes (SharedPoolDataSource, PerUserPoolDataSource). The target version 2.14.1 already contains the upstream fix: both vulnerable classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 124-125). The fix was added by upstream commit 328a0f833d (author: tatu.saloranta@iki.fi) and shipped in the upstream 2.14.1 release, before TuxCare onboarded this version. The blocklist is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType() \u2192 SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 affects jackson-databind 2.0.0-2.9.10 via unsafe deserialization of commons-dbcp datasource classes (SharedPoolDataSource, PerUserPoolDataSource). The target version 2.14.1 already contains the upstream fix: both vulnerable classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 124-125). The fix was added by upstream commit 328a0f833d (author: tatu.saloranta@iki.fi) and shipped in the upstream 2.14.1 release, before TuxCare onboarded this version. The blocklist is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType() \u2192 SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T17:15:39.453186+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3, allowing arbitrary code execution via polymorphic deserialization of the p6spy gadget class P6DataSource. The target version 2.14.1-tuxcare.3 is NOT AFFECTED because the upstream fix was already included in the 2.14.1 release. The malicious gadget class com.p6spy.engine.spy.P6DataSource is present in the SubTypeValidator blocklist at line 127, added by upstream author Tatu Saloranta in commit 9593e16c (September 2019). The validateSubType defense is invoked during bean deserialization, preventing instantiation of blocklisted classes when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3, allowing arbitrary code execution via polymorphic deserialization of the p6spy gadget class P6DataSource. The target version 2.14.1-tuxcare.3 is NOT AFFECTED because the upstream fix was already included in the 2.14.1 release. The malicious gadget class com.p6spy.engine.spy.P6DataSource is present in the SubTypeValidator blocklist at line 127, added by upstream author Tatu Saloranta in commit 9593e16c (September 2019). The validateSubType defense is invoked during bean deserialization, preventing instantiation of blocklisted classes when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:28:17.034118+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability was fixed in upstream version 2.9.10 by adding \"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\" to the polymorphic typing blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.14.1 release that TuxCare onboarded, making this version immune to the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability was fixed in upstream version 2.9.10 by adding \"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\" to the polymorphic typing blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.14.1 release that TuxCare onboarded, making this version immune to the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:48:21.924530+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.14.1-tuxcare.3. This polymorphic typing vulnerability allowed remote code execution when Default Typing was enabled and apache-log4j-extra (1.2.x) was in the classpath. The vulnerability enabled attackers to execute malicious payloads by providing JNDI service access through specially crafted JSON with type metadata pointing to dangerous log4j-extras classes. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0, applied 2019-10-12 by Tatu Saloranta) added two log4j-extras class names to SubTypeValidator's deserialization blocklist: org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource. This fix was included in the upstream jackson-databind 2.14.1 release (2022-11-21) that TuxCare onboarded. The blocklist is enforced during bean deserialization via BeanDeserializerFactory._validateSubType, which calls SubTypeValidator.instance().validateSubType. The target contains the complete fix at SubTypeValidator.java:130-131.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.14.1-tuxcare.3. This polymorphic typing vulnerability allowed remote code execution when Default Typing was enabled and apache-log4j-extra (1.2.x) was in the classpath. The vulnerability enabled attackers to execute malicious payloads by providing JNDI service access through specially crafted JSON with type metadata pointing to dangerous log4j-extras classes. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0, applied 2019-10-12 by Tatu Saloranta) added two log4j-extras class names to SubTypeValidator's deserialization blocklist: org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource. This fix was included in the upstream jackson-databind 2.14.1 release (2022-11-21) that TuxCare onboarded. The blocklist is enforced during bean deserialization via BeanDeserializerFactory._validateSubType, which calls SubTypeValidator.instance().validateSubType. The target contains the complete fix at SubTypeValidator.java:130-131.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:07:59.808671+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 affects jackson-databind versions lacking ehcache JNDI selector class blocking. The target version 2.14.1-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) already included the fix in version 2.14.1, which TuxCare later onboarded. The fix adds two ehcache class names (GenericJndiSelector and GlassfishSelector) to the deserialization blocklist in SubTypeValidator.java, preventing JNDI injection attacks via these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 affects jackson-databind versions lacking ehcache JNDI selector class blocking. The target version 2.14.1-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) already included the fix in version 2.14.1, which TuxCare later onboarded. The fix adds two ehcache class names (GenericJndiSelector and GlassfishSelector) to the deserialization blocklist in SubTypeValidator.java, preventing JNDI injection attacks via these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T17:02:28.386699+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind < 2.9.10.4 via unsafe deserialization of ignite-jta classes. The target repository (jackson-databind 2.14.1-tuxcare.3) contains the upstream fix that blocks deserialization of the three vulnerable classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) in SubTypeValidator.java lines 158-160. This fix was authored by upstream maintainer Tatu Saloranta (commit a424c038ba) and was already present in the upstream 2.14.1 release that TuxCare onboarded (first TuxCare commit f1899c86). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 affects jackson-databind < 2.9.10.4 via unsafe deserialization of ignite-jta classes. The target repository (jackson-databind 2.14.1-tuxcare.3) contains the upstream fix that blocks deserialization of the three vulnerable classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) in SubTypeValidator.java lines 158-160. This fix was authored by upstream maintainer Tatu Saloranta (commit a424c038ba) and was already present in the upstream 2.14.1 release that TuxCare onboarded (first TuxCare commit f1899c86). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability involves deserialization gadgets related to org.apache.aries.transaction.jms classes. The fix (blocklist entries for XaPooledConnectionFactory and RecoverablePooledConnectionFactory) was already present in the upstream jackson-databind 2.14.1 release that TuxCare onboarded. The vulnerable pattern does not exist in the target because the upstream vendor (Tatu Saloranta) applied the fix in commit 592872f423 before the 2.14.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "CVE-2020-10672 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability involves deserialization gadgets related to org.apache.aries.transaction.jms classes. The fix (blocklist entries for XaPooledConnectionFactory and RecoverablePooledConnectionFactory) was already present in the upstream jackson-databind 2.14.1 release that TuxCare onboarded. The vulnerable pattern does not exist in the target because the upstream vendor (Tatu Saloranta) applied the fix in commit 592872f423 before the 2.14.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:27:00.867186+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4. The target is jackson-databind 2.14.1-tuxcare.3, which already contains the upstream fix. The fix (commit 1645efbd by Tatu Saloranta) adds \"com.caucho.config.types.ResourceRef\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 167). This fix was present 11,819 commits before the 2.14.1 release tag and was IN_UPSTREAM_RELEASE before TuxCare onboarded the code. The vulnerable deserialization gadget pattern is not present in the target because the upstream vendor shipped the fix in version 2.9.10.4, well before the 2.14.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4. The target is jackson-databind 2.14.1-tuxcare.3, which already contains the upstream fix. The fix (commit 1645efbd by Tatu Saloranta) adds \"com.caucho.config.types.ResourceRef\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 167). This fix was present 11,819 commits before the 2.14.1 release tag and was IN_UPSTREAM_RELEASE before TuxCare onboarded the code. The vulnerable deserialization gadget pattern is not present in the target because the upstream vendor shipped the fix in version 2.9.10.4, well before the 2.14.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 is NOT present in jackson-databind 2.14.1. The vulnerability involved missing blacklist entries for dangerous deserialization gadget classes (org.aoju.bus.proxy.provider.remoting.RmiProvider and org.aoju.bus.proxy.provider.RmiProvider). These blacklist entries were added by upstream in commit 05d7e0e13f (March 25, 2020) and are present in SubTypeValidator.java lines 169-171. The fix was already included in the upstream jackson-databind 2.14.1 release before TuxCare onboarded it, making this an upstream-provided fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 is NOT present in jackson-databind 2.14.1. The vulnerability involved missing blacklist entries for dangerous deserialization gadget classes (org.aoju.bus.proxy.provider.remoting.RmiProvider and org.aoju.bus.proxy.provider.RmiProvider). These blacklist entries were added by upstream in commit 05d7e0e13f (March 25, 2020) and are present in SubTypeValidator.java lines 169-171. The fix was already included in the upstream jackson-databind 2.14.1 release before TuxCare onboarded it, making this an upstream-provided fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget involving javax.swing.JEditorPane. The target version 2.14.1-tuxcare.3 already contains the upstream fix (commit 6ba4845798) that adds JEditorPane to the deny-list in SubTypeValidator.java. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in upstream release 2.14.1, which TuxCare subsequently onboarded. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget involving javax.swing.JEditorPane. The target version 2.14.1-tuxcare.3 already contains the upstream fix (commit 6ba4845798) that adds JEditorPane to the deny-list in SubTypeValidator.java. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in upstream release 2.14.1, which TuxCare subsequently onboarded. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is not present in jackson-databind 2.14.1-tuxcare.3. The fix that blocks deserialization of org.apache.activemq.* gadget classes was already included in the upstream jackson-databind 2.14.1 release. The vulnerable pattern (absence of activemq classes in the deny list) does not exist in the target because upstream author Tatu Saloranta added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES in commits c14c9f99ed and 05d7e0e13f, which predate TuxCare's onboarding of version 2.14.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 is not present in jackson-databind 2.14.1-tuxcare.3. The fix that blocks deserialization of org.apache.activemq.* gadget classes was already included in the upstream jackson-databind 2.14.1 release. The vulnerable pattern (absence of activemq classes in the deny list) does not exist in the target because upstream author Tatu Saloranta added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES in commits c14c9f99ed and 05d7e0e13f, which predate TuxCare's onboarding of version 2.14.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability concerns deserialization gadget attacks via org.apache.commons.proxy.provider.remoting.RmiProvider. The fix (commit 05d7e0e13f from March 2020) adds this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in upstream jackson-databind 2.14.1 when TuxCare onboarded it (first TuxCare commit f1899c86). The target contains the defense at SubTypeValidator.java:186, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability concerns deserialization gadget attacks via org.apache.commons.proxy.provider.remoting.RmiProvider. The fix (commit 05d7e0e13f from March 2020) adds this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in upstream jackson-databind 2.14.1 when TuxCare onboarded it (first TuxCare commit f1899c86). The target contains the defense at SubTypeValidator.java:186, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability concerns deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The fix (adding this class to SubTypeValidator's blocklist) was already shipped in the upstream FasterXML jackson-databind 2.14.1 release, committed by upstream maintainer Tatu Saloranta (e2ba12d5d6) before TuxCare onboarded the version (f1899c86). The target code contains the defense at SubTypeValidator.java:84, and the validator is properly integrated into the deserialization path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability concerns deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The fix (adding this class to SubTypeValidator's blocklist) was already shipped in the upstream FasterXML jackson-databind 2.14.1 release, committed by upstream maintainer Tatu Saloranta (e2ba12d5d6) before TuxCare onboarded the version (f1899c86). The target code contains the defense at SubTypeValidator.java:84, and the validator is properly integrated into the deserialization path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED by CVE-2020-11619. The vulnerability has been addressed by an upstream fix that was already present in the upstream jackson-databind 2.14.1 release before TuxCare onboarded this version. The fix adds org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean to the deserialization blocklist in SubTypeValidator, preventing the gadget chain attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED by CVE-2020-11619. The vulnerability has been addressed by an upstream fix that was already present in the upstream jackson-databind 2.14.1 release before TuxCare onboarded this version. The fix adds org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean to the deserialization blocklist in SubTypeValidator, preventing the gadget chain attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 (jackson-databind deserialization gadget for org.apache.commons.jelly.impl.Embedded) is NOT present in jackson-databind 2.14.1-tuxcare.3. The upstream fix (commit 77040d85e3eb6710508e6445640ae1a3d5e60c22) was already included in the upstream 2.14.1 release that TuxCare onboarded. The blocklist entry preventing deserialization of org.apache.commons.jelly.impl.Embedded is present at line 189 of SubTypeValidator.java, blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 (jackson-databind deserialization gadget for org.apache.commons.jelly.impl.Embedded) is NOT present in jackson-databind 2.14.1-tuxcare.3. The upstream fix (commit 77040d85e3eb6710508e6445640ae1a3d5e60c22) was already included in the upstream 2.14.1 release that TuxCare onboarded. The blocklist entry preventing deserialization of org.apache.commons.jelly.impl.Embedded is present at line 189 of SubTypeValidator.java, blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5, related to deserialization of the gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version 2.14.1-tuxcare.3 contains the upstream fix that blocks this and related dangerous gadget classes from deserialization via the SubTypeValidator blocklist. This fix was authored by Tatu Saloranta (upstream maintainer) and was already present in jackson-databind 2.14.1 when TuxCare onboarded the version, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5, related to deserialization of the gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version 2.14.1-tuxcare.3 contains the upstream fix that blocks this and related dangerous gadget classes from deserialization via the SubTypeValidator blocklist. This fix was authored by Tatu Saloranta (upstream maintainer) and was already present in jackson-databind 2.14.1 when TuxCare onboarded the version, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is not present in jackson-databind 2.14.1. The upstream fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by Tatu Saloranta) was already included in the upstream 2.14.1 release before TuxCare onboarded it. All five Oracle JMS gadget classes (oracle.jms.AQjms*ConnectionFactory) are blacklisted in SubTypeValidator.java at lines 200-204, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "CVE-2020-14061 is not present in jackson-databind 2.14.1. The upstream fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by Tatu Saloranta) was already included in the upstream 2.14.1 release before TuxCare onboarded it. All five Oracle JMS gadget classes (oracle.jms.AQjms*ConnectionFactory) are blacklisted in SubTypeValidator.java at lines 200-204, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability involves the JNDI injection gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool being exploitable through polymorphic deserialization. The fix (adding this class to the blocklist in SubTypeValidator.java) was authored by upstream maintainer Tatu Saloranta in commit 840eae2ca8 on May 1, 2020, and shipped in upstream release 2.10.4. The target version 2.14.1 already included this fix when TuxCare onboarded it in commit f1899c86197. The blocklist entry is present at lines 118-119 of SubTypeValidator.java and is enforced by BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability involves the JNDI injection gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool being exploitable through polymorphic deserialization. The fix (adding this class to the blocklist in SubTypeValidator.java) was authored by upstream maintainer Tatu Saloranta in commit 840eae2ca8 on May 1, 2020, and shipped in upstream release 2.10.4. The target version 2.14.1 already included this fix when TuxCare onboarded it in commit f1899c86197. The blocklist entry is present at lines 118-119 of SubTypeValidator.java and is enforced by BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget in org.jsecurity.realm.jndi.JndiRealmFactory. The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already included in version 2.14.1. The fix (commit f6d9c664f6) adds org.jsecurity.realm.jndi.JndiRealmFactory to the SubTypeValidator blocklist at line 207, preventing deserialization of this dangerous class. Both the legacy jsecurity and modern Apache Shiro variants are blocked. TuxCare onboarded version 2.14.1 (commit f1899c86), which already contained this upstream security fix from FasterXML.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget in org.jsecurity.realm.jndi.JndiRealmFactory. The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already included in version 2.14.1. The fix (commit f6d9c664f6) adds org.jsecurity.realm.jndi.JndiRealmFactory to the SubTypeValidator blocklist at line 207, preventing deserialization of this dangerous class. Both the legacy jsecurity and modern Apache Shiro variants are blocked. TuxCare onboarded version 2.14.1 (commit f1899c86), which already contained this upstream security fix from FasterXML.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:19:44.520074+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED by CVE-2020-24616. The vulnerability involves the deserialization gadget class `br.com.anteros.dbcp.AnterosDBCPDataSource`. The upstream fix (commit 3d97153944 by tatu.saloranta@iki.fi) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist was already present in the upstream 2.14.1 release before TuxCare onboarded it. The vulnerable code pattern (unblocked AnterosDBCPDataSource) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED by CVE-2020-24616. The vulnerability involves the deserialization gadget class `br.com.anteros.dbcp.AnterosDBCPDataSource`. The upstream fix (commit 3d97153944 by tatu.saloranta@iki.fi) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist was already present in the upstream 2.14.1 release before TuxCare onboarded it. The vulnerable code pattern (unblocked AnterosDBCPDataSource) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:15:32.499277+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.14.1-tuxcare.3 is NOT affected by CVE-2020-24750. The upstream fix (commit 6cc9f1a1af by Tatu Saloranta) was already present in the upstream 2.14.1 release that TuxCare onboarded. The dangerous gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration is blocked in SubTypeValidator.java line 210, preventing deserialization exploitation. The validator throws InvalidDefinitionException when this class is referenced via polymorphic type information, blocking the attack chain from JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "Target version 2.14.1-tuxcare.3 is NOT affected by CVE-2020-24750. The upstream fix (commit 6cc9f1a1af by Tatu Saloranta) was already present in the upstream 2.14.1 release that TuxCare onboarded. The dangerous gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration is blocked in SubTypeValidator.java line 210, preventing deserialization exploitation. The validator throws InvalidDefinitionException when this class is referenced via polymorphic type information, blocking the attack chain from JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2020-25649. The XXE vulnerability fix for issue #2589 was already present in the upstream jackson-databind 2.14.1 release that TuxCare onboarded. The fix adds two XML parser security features in DOMDeserializer.java: (1) disallow-doctype-decl=true to block DOCTYPE declarations, and (2) load-external-dtd=false to prevent loading external DTDs. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 612f971b78, which was included when TuxCare onboarded version 2.14.1 via commit f1899c86. The DOMDeserializer.java file has not been modified after onboarding, confirming the upstream fix remained intact.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "The target jackson-databind version 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2020-25649. The XXE vulnerability fix for issue #2589 was already present in the upstream jackson-databind 2.14.1 release that TuxCare onboarded. The fix adds two XML parser security features in DOMDeserializer.java: (1) disallow-doctype-decl=true to block DOCTYPE declarations, and (2) load-external-dtd=false to prevent loading external DTDs. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 612f971b78, which was included when TuxCare onboarded version 2.14.1 via commit f1899c86. The DOMDeserializer.java file has not been modified after onboarding, confirming the upstream fix remained intact.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:21:16.269542+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 affects jackson-databind versions before 2.9.10.8. The target version 2.14.1-tuxcare.3 already contains the upstream fix that blocks deserialization of the gadget classes org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix was introduced in upstream version 2.9.10.8 by commit 41b8bdb5cc and was already present when TuxCare onboarded version 2.14.1. The vulnerable code pattern (absence of blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "CVE-2020-35490 affects jackson-databind versions before 2.9.10.8. The target version 2.14.1-tuxcare.3 already contains the upstream fix that blocks deserialization of the gadget classes org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix was introduced in upstream version 2.9.10.8 by commit 41b8bdb5cc and was already present when TuxCare onboarded version 2.14.1. The vulnerable code pattern (absence of blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T12:37:16.972133+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 affects jackson-databind versions before 2.9.10.8. The target is version 2.14.1-tuxcare.2, which already contains the upstream fix. The fix (commit 41b8bdb5ccc by Tatu Saloranta, 2020-12-15) adds org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was part of the upstream 2.14.1 release that TuxCare onboarded (2032 commits before onboarding commit f1899c86197). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "CVE-2020-35491 affects jackson-databind versions before 2.9.10.8. The target is version 2.14.1-tuxcare.2, which already contains the upstream fix. The fix (commit 41b8bdb5ccc by Tatu Saloranta, 2020-12-15) adds org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was part of the upstream 2.14.1 release that TuxCare onboarded (2032 commits before onboarding commit f1899c86197). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:54:25.795223+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability concerns a deserialization gadget class (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) that enables JNDI injection attacks when polymorphic typing is enabled. The upstream fix (commit 1ca0388c2f by Tatu Saloranta) added this class to SubTypeValidator's blacklist, preventing its deserialization. This fix was shipped in upstream jackson-databind 2.12.1 and was already present when TuxCare onboarded version 2.14.1. The target contains the fix at SubTypeValidator.java line 240, and the blacklist is enforced during all bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "CVE-2020-35728 is NOT present in jackson-databind 2.14.1-tuxcare.3. The vulnerability concerns a deserialization gadget class (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) that enables JNDI injection attacks when polymorphic typing is enabled. The upstream fix (commit 1ca0388c2f by Tatu Saloranta) added this class to SubTypeValidator's blacklist, preventing its deserialization. This fix was shipped in upstream jackson-databind 2.12.1 and was already present when TuxCare onboarded version 2.14.1. The target contains the fix at SubTypeValidator.java line 240, and the blacklist is enforced during all bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:23:58.768798+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 addresses a Jackson deserialization gadget vulnerability related to DriverAdapterCPDS classes. The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED because the upstream fix commit 3ded28aece was already present in the upstream jackson-databind 2.14.1 release that TuxCare onboarded. The vulnerable gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` and its variants are present in the SubTypeValidator blocklist, preventing deserialization attacks. This is an upstream fix authored by Tatu Saloranta that shipped with the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "CVE-2020-36179 addresses a Jackson deserialization gadget vulnerability related to DriverAdapterCPDS classes. The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED because the upstream fix commit 3ded28aece was already present in the upstream jackson-databind 2.14.1 release that TuxCare onboarded. The vulnerable gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` and its variants are present in the SubTypeValidator blocklist, preventing deserialization attacks. This is an upstream fix authored by Tatu Saloranta that shipped with the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:34:19.282169+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is not present in jackson-databind 2.14.1-tuxcare.3. The fix (commit 3ded28aece, issue #3004) was already included in the upstream jackson-databind 2.14.1 release that TuxCare onboarded. The fix adds org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related gadget classes to the SubTypeValidator blocklist, preventing their deserialization during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "CVE-2020-36180 is not present in jackson-databind 2.14.1-tuxcare.3. The fix (commit 3ded28aece, issue #3004) was already included in the upstream jackson-databind 2.14.1 release that TuxCare onboarded. The fix adds org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related gadget classes to the SubTypeValidator blocklist, preventing their deserialization during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:41:26.898836+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is not present in jackson-databind 2.14.1-tuxcare.3. The vulnerability concerns unsafe deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS and related DBCP gadget classes. The upstream fix (commit 3ded28aece, authored by Tatu Saloranta on 2020-12-31) added these classes to the deserialization blacklist in SubTypeValidator.java. This fix was already present in upstream release 2.14.1, which TuxCare onboarded on 2026-08-25. The target code at SubTypeValidator.java:228 contains the blacklist entry \"org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS\" along with all related DBCP variants added by the patch. Since the fix shipped in the upstream release (not as a TuxCare backport), the vulnerability pattern is absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 is not present in jackson-databind 2.14.1-tuxcare.3. The vulnerability concerns unsafe deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS and related DBCP gadget classes. The upstream fix (commit 3ded28aece, authored by Tatu Saloranta on 2020-12-31) added these classes to the deserialization blacklist in SubTypeValidator.java. This fix was already present in upstream release 2.14.1, which TuxCare onboarded on 2026-08-25. The target code at SubTypeValidator.java:228 contains the blacklist entry \"org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS\" along with all related DBCP variants added by the patch. Since the fix shipped in the upstream release (not as a TuxCare backport), the vulnerability pattern is absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:12:30.909844+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.1-tuxcare.3 is NOT affected by CVE-2020-36182. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by tatu.saloranta@iki.fi) was already included in the upstream 2.14.1 release before TuxCare onboarded it. The SubTypeValidator blacklist at lines 123, 193, 219, 228, and 234 blocks all DriverAdapterCPDS gadget class variants, preventing their instantiation during polymorphic deserialization and blocking the attack chain before the goal (arbitrary code execution via deserialization gadget) is reached.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "The target jackson-databind 2.14.1-tuxcare.3 is NOT affected by CVE-2020-36182. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by tatu.saloranta@iki.fi) was already included in the upstream 2.14.1 release before TuxCare onboarded it. The SubTypeValidator blacklist at lines 123, 193, 219, 228, and 234 blocks all DriverAdapterCPDS gadget class variants, preventing their instantiation during polymorphic deserialization and blocking the attack chain before the goal (arbitrary code execution via deserialization gadget) is reached.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:20:56.878680+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not present in jackson-databind 2.14.1-tuxcare.3. The vulnerability involved a deserialization gadget (org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) that could enable remote code execution via JNDI injection. The upstream vendor (FasterXML) fixed this in commit 12e23c962f by adding the gadget class to the deserialization blocklist. This fix was already included in the upstream 2.14.1 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates TuxCare's first onboarding commit (f1899c86...). The target repository contains the complete fix at line 243 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "CVE-2020-36183 is not present in jackson-databind 2.14.1-tuxcare.3. The vulnerability involved a deserialization gadget (org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) that could enable remote code execution via JNDI injection. The upstream vendor (FasterXML) fixed this in commit 12e23c962f by adding the gadget class to the deserialization blocklist. This fix was already included in the upstream 2.14.1 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates TuxCare's first onboarding commit (f1899c86...). The target repository contains the complete fix at line 243 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T12:24:19.585233+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is not present in jackson-databind 2.14.1. The vulnerability involves deserialization gadgets org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 567194c53a by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization. This fix shipped in the upstream 2.14.1 release that TuxCare onboarded at commit f1899c8619, so the vulnerable pattern was never present in the TuxCare-maintained branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 is not present in jackson-databind 2.14.1. The vulnerability involves deserialization gadgets org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 567194c53a by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization. This fix shipped in the upstream 2.14.1 release that TuxCare onboarded at commit f1899c8619, so the vulnerable pattern was never present in the TuxCare-maintained branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:05:19.852884+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind 2.x before 2.9.10.8 and concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. Target version 2.14.1-tuxcare.3 already contains the upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) which adds these classes to the SubTypeValidator blocklist at lines 234-236. This fix was included in the upstream 2.14.1 release before TuxCare onboarding commit f1899c86197013c976c521cb61a084d054b1003a, making this an upstream vendor fix rather than a TuxCare backport. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 affects jackson-databind 2.x before 2.9.10.8 and concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. Target version 2.14.1-tuxcare.3 already contains the upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) which adds these classes to the SubTypeValidator blocklist at lines 234-236. This fix was included in the upstream 2.14.1 release before TuxCare onboarding commit f1899c86197013c976c521cb61a084d054b1003a, making this an upstream vendor fix rather than a TuxCare backport. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:31:06.545047+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2020-36186. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource that could lead to remote code execution. The fix was already included in the upstream 2.14.1 release before TuxCare onboarded it. The malicious classes are blocklisted in SubTypeValidator.java (lines 226-230), preventing their deserialization. The fix commit (3e8fa3beea) was authored by upstream Jackson maintainer Tatu Saloranta and shipped in the upstream release, not added by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "The target repository jackson-databind version 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2020-36186. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource that could lead to remote code execution. The fix was already included in the upstream 2.14.1 release before TuxCare onboarded it. The malicious classes are blocklisted in SubTypeValidator.java (lines 226-230), preventing their deserialization. The fix commit (3e8fa3beea) was authored by upstream Jackson maintainer Tatu Saloranta and shipped in the upstream release, not added by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:44:46.412412+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for Tomcat DBCP DataSource classes (org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) that enable JNDI injection attacks. The target version 2.14.1-tuxcare.3 already contains the upstream fix from commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 (authored by Tatu Saloranta for FasterXML). The fix was included in the upstream 2.14.1 release that TuxCare onboarded, as confirmed by git history showing the fix commit predates the first TuxCare commit (f1899c86 \"Onboard version 2.14.1\"). SubTypeValidator.java lines 228-230 contain the required blocklist entries that prevent deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for Tomcat DBCP DataSource classes (org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) that enable JNDI injection attacks. The target version 2.14.1-tuxcare.3 already contains the upstream fix from commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 (authored by Tatu Saloranta for FasterXML). The fix was included in the upstream 2.14.1 release that TuxCare onboarded, as confirmed by git history showing the fix commit predates the first TuxCare commit (f1899c86 \"Onboard version 2.14.1\"). SubTypeValidator.java lines 228-230 contain the required blocklist entries that prevent deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:50:34.321769+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is not present in jackson-databind 2.14.1-tuxcare.3. The vulnerability concerns deserialization gadget class `com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource`. The fix (commit 33d96c13fe by upstream maintainer Tatu Saloranta) adds this class to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.14.1 release that TuxCare onboarded, predating any TuxCare modifications. The target version is not vulnerable because the gadget class is blocked from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188 is not present in jackson-databind 2.14.1-tuxcare.3. The vulnerability concerns deserialization gadget class `com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource`. The fix (commit 33d96c13fe by upstream maintainer Tatu Saloranta) adds this class to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.14.1 release that TuxCare onboarded, predating any TuxCare modifications. The target version is not vulnerable because the gadget class is blocked from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T13:00:16.038874+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.1-tuxcare.2 is NOT AFFECTED by CVE-2020-36189. The vulnerability concerns deserialization gadgets in classes com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource. The fix that blocks these classes was already present in the upstream release 2.14.1 when TuxCare onboarded it (commit 33d96c13fe1 by Tatu Saloranta, dated 2020-12-26). The blocklist entries appear at lines 223-224 of SubTypeValidator.java, and the validateSubType method (lines 259-304) enforces the block by throwing \"Illegal type to deserialize: prevented for security reasons\" when these classes are encountered during JSON deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "The target jackson-databind 2.14.1-tuxcare.2 is NOT AFFECTED by CVE-2020-36189. The vulnerability concerns deserialization gadgets in classes com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource. The fix that blocks these classes was already present in the upstream release 2.14.1 when TuxCare onboarded it (commit 33d96c13fe1 by Tatu Saloranta, dated 2020-12-26). The blocklist entries appear at lines 223-224 of SubTypeValidator.java, and the validateSubType method (lines 259-304) enforces the block by throwing \"Illegal type to deserialize: prevented for security reasons\" when these classes are encountered during JSON deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-05T14:18:02.736616+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Version 2.14.1 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-57j2-w4cx-62h2 (affected below 2.13.2.1), NVD (affected below 2.13.2.1), Snyk (affected below 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "Version 2.14.1 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-57j2-w4cx-62h2 (affected below 2.13.2.1), NVD (affected below 2.13.2.1), Snyk (affected below 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:10:12.627525+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is not present in jackson-databind 2.14.1-tuxcare.3. The vulnerability involves missing blocklist protection for org.apache.xbean.propertyeditor.JndiConverter during polymorphic deserialization, enabling JNDI injection attacks. The fix (adding JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was authored by upstream maintainer Tatu Saloranta and shipped in Jackson 2.10.4 (Feb 2020). This fix was already present in the upstream Jackson 2.14.1 release that TuxCare onboarded, as confirmed by fix commits 9bb52c7122/914e7c9f2c being ancestors of the first TuxCare commit f1899c86 (\"Onboard version 2.14.1\"). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 is not present in jackson-databind 2.14.1-tuxcare.3. The vulnerability involves missing blocklist protection for org.apache.xbean.propertyeditor.JndiConverter during polymorphic deserialization, enabling JNDI injection attacks. The fix (adding JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was authored by upstream maintainer Tatu Saloranta and shipped in Jackson 2.10.4 (Feb 2020). This fix was already present in the upstream Jackson 2.14.1 release that TuxCare onboarded, as confirmed by fix commits 9bb52c7122/914e7c9f2c being ancestors of the first TuxCare commit f1899c86 (\"Onboard version 2.14.1\"). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2020-9546. The vulnerability, which allows deserialization gadget exploitation via org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, was fixed in upstream version 2.9.10.4. The fix (blocklisting the HikariConfig class) was already present in the upstream 2.14.1 release that TuxCare onboarded, meaning the vulnerable pattern never existed in this version. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 9f4e97019fb0dd836533d0b6198c88787e235ae2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "The target jackson-databind 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2020-9546. The vulnerability, which allows deserialization gadget exploitation via org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, was fixed in upstream version 2.9.10.4. The fix (blocklisting the HikariConfig class) was already present in the upstream 2.14.1 release that TuxCare onboarded, meaning the vulnerable pattern never existed in this version. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 9f4e97019fb0dd836533d0b6198c88787e235ae2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:40:43.036497+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to deserialization gadgets (specifically com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig). The target version 2.14.1-tuxcare.3 is NOT AFFECTED because the fix was already present in the upstream release 2.14.1 that TuxCare onboarded. The gadget class is blocked in SubTypeValidator.java line 144, added by upstream commit 1e64db6a2f authored by Tatu Saloranta (tatu.saloranta@iki.fi) before any TuxCare modifications to this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to deserialization gadgets (specifically com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig). The target version 2.14.1-tuxcare.3 is NOT AFFECTED because the fix was already present in the upstream release 2.14.1 that TuxCare onboarded. The gadget class is blocked in SubTypeValidator.java line 144, added by upstream commit 1e64db6a2f authored by Tatu Saloranta (tatu.saloranta@iki.fi) before any TuxCare modifications to this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:14:34.572852+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing blocklist entries for deserialization gadgets including br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream release 2.14.1 that TuxCare onboarded. The blocklist entry for br.com.anteros.dbcp.AnterosDBCPConfig is present at SubTypeValidator.java:145, and the validation mechanism actively prevents deserialization of this class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing blocklist entries for deserialization gadgets including br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.14.1-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream release 2.14.1 that TuxCare onboarded. The blocklist entry for br.com.anteros.dbcp.AnterosDBCPConfig is present at SubTypeValidator.java:145, and the validation mechanism actively prevents deserialization of this class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T15:13:02.714408+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is a Jackson deserialization vulnerability where dangerous gadget classes can be instantiated through polymorphic type handling. The upstream fixes (commits 7dbf51bf78 and 08fbfacf89) add specific gadget classes including javax.swing.JTextPane and many others to SubTypeValidator's blocklist. The target jackson-databind 2.14.1-tuxcare.3 already contains these fixes - they were part of the upstream 2.14.1 release that TuxCare onboarded (commit f1899c86). The vulnerable code pattern is not present because the fix was already shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 is a Jackson deserialization vulnerability where dangerous gadget classes can be instantiated through polymorphic type handling. The upstream fixes (commits 7dbf51bf78 and 08fbfacf89) add specific gadget classes including javax.swing.JTextPane and many others to SubTypeValidator's blocklist. The target jackson-databind 2.14.1-tuxcare.3 already contains these fixes - they were part of the upstream 2.14.1 release that TuxCare onboarded (commit f1899c86). The vulnerable code pattern is not present because the fix was already shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.14.1 is not affected by CVE-2021-46877. The vulnerability (unbounded memory allocation in NodeSerialization.readExternal based on attacker-controlled length header) was fixed in upstream commit 3ccde7d938 (Dec 2021), which was already included in the jackson-databind 2.14.1 release (Nov 2022) before TuxCare onboarded it. The fix adds incremental allocation via ByteArrayBuilder for payloads exceeding 100KB, preventing DoS attacks via malicious JDK-serialized JsonNode objects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "Target version 2.14.1 is not affected by CVE-2021-46877. The vulnerability (unbounded memory allocation in NodeSerialization.readExternal based on attacker-controlled length header) was fixed in upstream commit 3ccde7d938 (Dec 2021), which was already included in the jackson-databind 2.14.1 release (Nov 2022) before TuxCare onboarded it. The fix adds incremental allocation via ByteArrayBuilder for payloads exceeding 100KB, preventing DoS attacks via malicious JDK-serialized JsonNode objects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T16:44:46.608372+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 addresses resource exhaustion via deep wrapper array nesting when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The target jackson-databind 2.14.1-tuxcare.3 is NOT affected because the upstream fix (commits cd090979b7 and d78d00ee7b) was already present in the upstream 2.14.1 release that TuxCare onboarded. The fix adds checks in primitive deserializers (StdDeserializer) and BeanDeserializer to detect double-START_ARRAY patterns and throw errors instead of recursively unwrapping, preventing unbounded recursion. Fix authored by upstream maintainer Tatu Saloranta, shipped before first TuxCare commit (f1899c86...).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "CVE-2022-42003 addresses resource exhaustion via deep wrapper array nesting when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The target jackson-databind 2.14.1-tuxcare.3 is NOT affected because the upstream fix (commits cd090979b7 and d78d00ee7b) was already present in the upstream 2.14.1 release that TuxCare onboarded. The fix adds checks in primitive deserializers (StdDeserializer) and BeanDeserializer to detect double-START_ARRAY patterns and throw errors instead of recursively unwrapping, preventing unbounded recursion. Fix authored by upstream maintainer Tatu Saloranta, shipped before first TuxCare commit (f1899c86...).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T14:57:36.079339+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.14.1-tuxcare.3 is not affected by CVE-2022-42004. The vulnerability affects jackson-databind before 2.12.7.1 and 2.13.x before 2.13.4. The upstream fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta) was already present in the 2.14.1 release that TuxCare onboarded. The fix adds a check in BeanDeserializer._deserializeFromArray() that detects and rejects deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, preventing resource exhaustion via unbounded recursion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "Target version 2.14.1-tuxcare.3 is not affected by CVE-2022-42004. The vulnerability affects jackson-databind before 2.12.7.1 and 2.13.x before 2.13.4. The upstream fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta) was already present in the 2.14.1 release that TuxCare onboarded. The fix adds a check in BeanDeserializer._deserializeFromArray() that detects and rejects deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, preventing resource exhaustion via unbounded recursion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:19:21.558986+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:19:21.558986+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:20:00.147047+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-02T20:19:00.068472+00:00", "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2026-50193. The vulnerability (stack overflow via recursive JsonNode serialization) was fixed in upstream jackson-databind 2.14.0 via commit a1fa4ae4ec (authored by Tatu Saloranta on 2022-05-04). This fix shipped in the upstream 2.14.1 release that TuxCare onboarded. The vulnerable recursive pattern is not present in the target; iterative s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50193" }, "impact_statement": "not_affected \u2014 Target version 2.14.1-tuxcare.3 is NOT AFFECTED by CVE-2026-50193. The vulnerability (stack overflow via recursive JsonNode serialization) was fixed in upstream jackson-databind 2.14.0 via commit a1fa4ae4ec (authored by Tatu Saloranta on 2022-05-04). This fix shipped in the upstream 2.14.1 release that TuxCare onboarded. The vulnerable recursive pattern is not present in the target; iterative s..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:19:21.558986+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:19:21.558986+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:19:21.558986+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:19:21.558986+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T02:31:13.178868+00:00", "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.14.1 is not affected by CVE-2026-54517. The vulnerability requires the `isMerging()` feature that routes setterless properties through an unguarded property-buffering branch during creator-based deserialization. This feature was introduced in version 2.20.1 (commit e40aaee8f1, August 2025), after the target version 2.14.1. The CVE's affected range (2.21.0-2.21.3, 3.0.0-3.1.3) accurate...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54517" }, "impact_statement": "not_affected \u2014 Version 2.14.1 is not affected by CVE-2026-54517. The vulnerability requires the `isMerging()` feature that routes setterless properties through an unguarded property-buffering branch during creator-based deserialization. This feature was introduced in version 2.20.1 (commit e40aaee8f1, August 2025), after the target version 2.14.1. The CVE's affected range (2.21.0-2.21.3, 3.0.0-3.1.3) accurate..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-03T02:02:48.266870+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.14.1 is not affected by CVE-2026-54518. The vulnerability concerns @JsonView bypass in unwrapped creator parameters, but version 2.14.1 explicitly blocks the combination of @JsonUnwrapped with @JsonCreator parameters with error \"Cannot define Creator parameter %d as `@JsonUnwrapped`: combination not yet supported\". The vulnerable feature (unwrapped creator parameter support) wa...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Target version 2.14.1 is not affected by CVE-2026-54518. The vulnerability concerns @JsonView bypass in unwrapped creator parameters, but version 2.14.1 explicitly blocks the combination of @JsonUnwrapped with @JsonCreator parameters with error \"Cannot define Creator parameter %d as `@JsonUnwrapped`: combination not yet supported\". The vulnerable feature (unwrapped creator parameter support) wa..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-05T11:26:41.121390+00:00", "status_notes": "Vulnerability CVE-2026-59888 affects version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-59888" }, "action_statement": "Vulnerability CVE-2026-59888 affects version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.1-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:19:21.558986+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:20:00.147047+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:20:00.147047+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:20:00.147047+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-01T12:38:00.128304+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.1-tuxcare.3.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.1-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-11-01T12:38:00.128304+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.1-tuxcare.3.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.1-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-28T15:20:00.147047+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.14.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1-tuxcare.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.14.1-tuxcare.2.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }