{ "@id": "urn:uuid:b58ea9d3-f6b1-4225-8d17-2781db46af68", "role": "Document Creator", "author": "https://tuxcare.com", "version": 84, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:17:00.447062+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:10:32.786596+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind 2.15.3-tuxcare.3. The vulnerability involves unsafe deserialization allowing code execution via malicious type specifications. The upstream vendor (FasterXML) fixed this by adding dangerous classes to a blacklist in SubTypeValidator.java. All CVE-2017-15095 classes (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, Spring/C3P0 types) are present in the blacklist at lines 45-57 of SubTypeValidator.java. The fix commits (e8f043d1aa for #1680, ddfddfba64 for #1737) were authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.15.3 release before TuxCare's onboarding commit c3881010de. The validation is actively enforced via BeanDeserializerFactory._validateSubType() at line 141, which invokes SubTypeValidator.validateSubType() to check against the blacklist and reject dangerous types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 is not present in jackson-databind 2.15.3-tuxcare.3. The vulnerability involves unsafe deserialization allowing code execution via malicious type specifications. The upstream vendor (FasterXML) fixed this by adding dangerous classes to a blacklist in SubTypeValidator.java. All CVE-2017-15095 classes (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, Spring/C3P0 types) are present in the blacklist at lines 45-57 of SubTypeValidator.java. The fix commits (e8f043d1aa for #1680, ddfddfba64 for #1737) were authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.15.3 release before TuxCare's onboarding commit c3881010de. The validation is actively enforced via BeanDeserializerFactory._validateSubType() at line 141, which invokes SubTypeValidator.validateSubType() to check against the blacklist and reject dangerous types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:45:35.958455+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.3 is NOT affected by CVE-2017-17485. The vulnerability affected versions through 2.8.10 and 2.9.x through 2.9.3. The fix was introduced upstream in version 2.8.11 (December 2017) via the SubTypeValidator class, which implements a comprehensive blacklist of dangerous deserialization gadget classes. Version 2.15.3 (June 2023) is years newer and includes all the fixes. The SubTypeValidator blocks all classes mentioned in CVE-2017-17485: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, plus hierarchical checks for Spring AbstractPointcutAdvisor and AbstractApplicationContext subclasses, and C3P0 DataSource variants. The vulnerable pattern is not present in the shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "The target jackson-databind 2.15.3 is NOT affected by CVE-2017-17485. The vulnerability affected versions through 2.8.10 and 2.9.x through 2.9.3. The fix was introduced upstream in version 2.8.11 (December 2017) via the SubTypeValidator class, which implements a comprehensive blacklist of dangerous deserialization gadget classes. Version 2.15.3 (June 2023) is years newer and includes all the fixes. The SubTypeValidator blocks all classes mentioned in CVE-2017-17485: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, plus hierarchical checks for Spring AbstractPointcutAdvisor and AbstractApplicationContext subclasses, and C3P0 DataSource variants. The vulnerable pattern is not present in the shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:29:21.349678+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability was fixed in upstream versions 2.6.7.1, 2.7.9.1, and 2.8.8.1/2.8.9 (April-July 2017) via issue #1599. The target version 2.15.3 (October 2023) is significantly later and includes comprehensive SubTypeValidator defenses that block dangerous classes during polymorphic deserialization. The fix was already present in the upstream release 2.15.3 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability was fixed in upstream versions 2.6.7.1, 2.7.9.1, and 2.8.8.1/2.8.9 (April-July 2017) via issue #1599. The target version 2.15.3 (October 2023) is significantly later and includes comprehensive SubTypeValidator defenses that block dangerous classes during polymorphic deserialization. The fix was already present in the upstream release 2.15.3 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:20:11.775734+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5 and allows data exfiltration via polymorphic deserialization of the iBatis XPathParser gadget class. The target version 2.15.3 already contains the upstream fix that blacklists org.apache.ibatis.parsing.XPathParser in SubTypeValidator.java (line 65). This fix was authored by upstream maintainer Tatu Saloranta in commit 27b4defc270 (2018-05-10) and was already present in the upstream version 2.15.3 when TuxCare onboarded it. The defense mechanism validates all deserialization attempts and rejects the blacklisted class with \"Illegal type to deserialize: prevented for security reasons\". Target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5 and allows data exfiltration via polymorphic deserialization of the iBatis XPathParser gadget class. The target version 2.15.3 already contains the upstream fix that blacklists org.apache.ibatis.parsing.XPathParser in SubTypeValidator.java (line 65). This fix was authored by upstream maintainer Tatu Saloranta in commit 27b4defc270 (2018-05-10) and was already present in the upstream version 2.15.3 when TuxCare onboarded it. The defense mechanism validates all deserialization attempts and rejects the blacklisted class with \"Illegal type to deserialize: prevented for security reasons\". Target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T17:20:10.514084+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind when Default Typing is enabled and gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) are present in the classpath. The vulnerability allows arbitrary code execution via JNDI/LDAP injection during deserialization. The target version 2.15.3-tuxcare.4 is NOT affected because the upstream fix (commit 7487cf7e by Tatu Saloranta, May 31 2018) blacklisted these three gadget classes in SubTypeValidator, preventing their deserialization. This fix was already present in the upstream release 2.15.3 that TuxCare onboarded (commit c3881010de3 by amoniatovskiy@cloudlinux.com). The SubTypeValidator check is always active (BeanDeserializerFactory line 141, unconditional call) and cannot be bypassed or disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 affects jackson-databind when Default Typing is enabled and gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) are present in the classpath. The vulnerability allows arbitrary code execution via JNDI/LDAP injection during deserialization. The target version 2.15.3-tuxcare.4 is NOT affected because the upstream fix (commit 7487cf7e by Tatu Saloranta, May 31 2018) blacklisted these three gadget classes in SubTypeValidator, preventing their deserialization. This fix was already present in the upstream release 2.15.3 that TuxCare onboarded (commit c3881010de3 by amoniatovskiy@cloudlinux.com). The SubTypeValidator check is always active (BeanDeserializerFactory line 141, unconditional call) and cannot be bypassed or disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:21:53.187202+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.3-tuxcare.4 is NOT AFFECTED by CVE-2018-12023. The vulnerability involves JNDI injection via polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled. The fix\u2014adding these classes to the deserialization blacklist in SubTypeValidator.java\u2014was authored by the upstream maintainer (Tatu Saloranta) and shipped in upstream jackson-databind before version 2.15.3. TuxCare onboarded version 2.15.3 which already contained this fix, so the vulnerable code pattern has never been present in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "The target jackson-databind 2.15.3-tuxcare.4 is NOT AFFECTED by CVE-2018-12023. The vulnerability involves JNDI injection via polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled. The fix\u2014adding these classes to the deserialization blacklist in SubTypeValidator.java\u2014was authored by the upstream maintainer (Tatu Saloranta) and shipped in upstream jackson-databind before version 2.15.3. TuxCare onboarded version 2.15.3 which already contained this fix, so the vulnerable code pattern has never been present in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:56:02.232476+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.15.3-tuxcare.4 is NOT AFFECTED by CVE-2018-14718. The fix that blocks polymorphic deserialization of dangerous classes (including org.slf4j.ext.EventData mentioned in the CVE) was already present in upstream version 2.15.3 when TuxCare onboarded it. The blocklist is enforced via SubTypeValidator during bean deserialization, preventing arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "Target jackson-databind version 2.15.3-tuxcare.4 is NOT AFFECTED by CVE-2018-14718. The fix that blocks polymorphic deserialization of dangerous classes (including org.slf4j.ext.EventData mentioned in the CVE) was already present in upstream version 2.15.3 when TuxCare onboarded it. The blocklist is enforced via SubTypeValidator during bean deserialization, preventing arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:01:11.316675+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.15.3 is NOT AFFECTED by CVE-2018-14719. The vulnerability involves polymorphic deserialization of dangerous classes (blaze-ds: flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, plus org.slf4j.ext.EventData, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl). The fix for this vulnerability was already present in the upstream 2.15.3 release. These classes are blacklisted in SubTypeValidator.java lines 74-78, preventing their instantiation during polymorphic deserialization. The fix was authored by upstream Jackson maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e82a249ea15858e2d4ecbf64091db44, which is an ancestor of the TuxCare onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "The target jackson-databind version 2.15.3 is NOT AFFECTED by CVE-2018-14719. The vulnerability involves polymorphic deserialization of dangerous classes (blaze-ds: flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, plus org.slf4j.ext.EventData, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl). The fix for this vulnerability was already present in the upstream 2.15.3 release. These classes are blacklisted in SubTypeValidator.java lines 74-78, preventing their instantiation during polymorphic deserialization. The fix was authored by upstream Jackson maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e82a249ea15858e2d4ecbf64091db44, which is an ancestor of the TuxCare onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:08:55.717276+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involved the ability to deserialize four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks or other exploits. The fix (adding these classes to the blacklist) was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e and shipped in the upstream release 2.15.3 before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 is not present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involved the ability to deserialize four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks or other exploits. The fix (adding these classes to the blacklist) was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e and shipped in the upstream release 2.15.3 before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:39:17.858992+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability was fixed by upstream author Tatu Saloranta in commit 87d29af25e (Fix #2097 for 2.6.7.2), which added org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.3 release before TuxCare onboarded it (first TuxCare commit: c3881010de \"Onboard version 2.15.3\"). The blocklist is enforced unconditionally in BeanDeserializerFactory.createBeanDeserializer() via the _validateSubType() call, preventing polymorphic deserialization of the dangerous axis2-jaxws class and blocking the SSRF attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability was fixed by upstream author Tatu Saloranta in commit 87d29af25e (Fix #2097 for 2.6.7.2), which added org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.3 release before TuxCare onboarded it (first TuxCare commit: c3881010de \"Onboard version 2.15.3\"). The blocklist is enforced unconditionally in BeanDeserializerFactory.createBeanDeserializer() via the _validateSubType() call, preventing polymorphic deserialization of the dangerous axis2-jaxws class and blocking the SSRF attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T12:50:52.202330+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.15.3-tuxcare.3 is not affected by CVE-2018-19360. The vulnerability concerns polymorphic deserialization of the org.apache.axis2.transport.jms.JMSOutTransportInfo class, which could allow attackers unspecified impact. The upstream fix adds this class to a blocklist in SubTypeValidator.java that prevents dangerous classes from being instantiated during polymorphic deserialization. The target contains this fix at line 85 of SubTypeValidator.java. The fix was authored by Tatu Saloranta (upstream jackson-databind maintainer) in commit 72cd4025a229fb28ec133235003dd4616f70afaa on 2018-11-19, which predates TuxCare's onboarding of version 2.15.3. Therefore, this is an upstream fix that shipped in the base 2.15.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "The target repository jackson-databind version 2.15.3-tuxcare.3 is not affected by CVE-2018-19360. The vulnerability concerns polymorphic deserialization of the org.apache.axis2.transport.jms.JMSOutTransportInfo class, which could allow attackers unspecified impact. The upstream fix adds this class to a blocklist in SubTypeValidator.java that prevents dangerous classes from being instantiated during polymorphic deserialization. The target contains this fix at line 85 of SubTypeValidator.java. The fix was authored by Tatu Saloranta (upstream jackson-databind maintainer) in commit 72cd4025a229fb28ec133235003dd4616f70afaa on 2018-11-19, which predates TuxCare's onboarding of version 2.15.3. Therefore, this is an upstream fix that shipped in the base 2.15.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:57:30.465792+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involves polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that can lead to code execution. The upstream vendor fix that blocks these classes was already present in the upstream release 2.15.3 when TuxCare onboarded it. The fix commit 72cd4025a229fb28ec133235003dd4616f70afaa by Tatu Saloranta (upstream author) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist, and this commit is an ancestor of the first TuxCare commit c3881010de (\"Onboard version 2.15.3\"). Therefore, the vulnerable code pattern is not present in this target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involves polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that can lead to code execution. The upstream vendor fix that blocks these classes was already present in the upstream release 2.15.3 when TuxCare onboarded it. The fix commit 72cd4025a229fb28ec133235003dd4616f70afaa by Tatu Saloranta (upstream author) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist, and this commit is an ancestor of the first TuxCare commit c3881010de (\"Onboard version 2.15.3\"). Therefore, the vulnerable code pattern is not present in this target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:25:11.271555+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind 2.x before 2.9.8 due to missing blocklist entry for org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core, enabling polymorphic deserialization gadget attacks. The target repository (jackson-databind 2.15.3-tuxcare.4) is NOT affected because the fix was already present in the upstream 2.15.3 release. The vulnerable class is blocked at line 81 of SubTypeValidator.java. Fix commit 72cd4025a2 by upstream author Tatu Saloranta was included in the upstream release before TuxCare onboarded it (first TuxCare commit: c3881010de \"Onboard version 2.15.3\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 affects jackson-databind 2.x before 2.9.8 due to missing blocklist entry for org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core, enabling polymorphic deserialization gadget attacks. The target repository (jackson-databind 2.15.3-tuxcare.4) is NOT affected because the fix was already present in the upstream 2.15.3 release. The vulnerable class is blocked at line 81 of SubTypeValidator.java. Fix commit 72cd4025a2 by upstream author Tatu Saloranta was included in the upstream release before TuxCare onboarded it (first TuxCare commit: c3881010de \"Onboard version 2.15.3\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the existing blacklist. The target version 2.15.3 contains the upstream fix (commit 038b471e2e from 2018-01-21) that adds both gadget classes to SubTypeValidator's blacklist. This fix was authored by FasterXML maintainer Tatu Saloranta and was already present in the upstream release 2.15.3 when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the existing blacklist. The target version 2.15.3 contains the upstream fix (commit 038b471e2e from 2018-01-21) that adds both gadget classes to SubTypeValidator's blacklist. This fix was authored by FasterXML maintainer Tatu Saloranta and was already present in the upstream release 2.15.3 when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:52:54.438603+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 affects jackson-databind versions before 2.7.9.3, 2.8.11.1, and 2.9.5 due to incomplete blacklisting of c3p0 gadget classes that enable remote code execution via malicious JSON deserialization. The target repository (jackson-databind 2.15.3-tuxcare.4) is NOT AFFECTED because the upstream fix (commit 6799f8f10c) was already present in the jackson-databind 2.15.3 release that TuxCare onboarded. The fix adds pattern-based validation in SubTypeValidator that blocks deserialization of any class whose fully-qualified name starts with \"com.mchange.v2.c3p0.\" and ends with \"DataSource\", preventing exploitation of c3p0 gadget chains. This is an upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream 2.15.3 release before TuxCare's onboarding commit (c3881010de).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 affects jackson-databind versions before 2.7.9.3, 2.8.11.1, and 2.9.5 due to incomplete blacklisting of c3p0 gadget classes that enable remote code execution via malicious JSON deserialization. The target repository (jackson-databind 2.15.3-tuxcare.4) is NOT AFFECTED because the upstream fix (commit 6799f8f10c) was already present in the jackson-databind 2.15.3 release that TuxCare onboarded. The fix adds pattern-based validation in SubTypeValidator that blocks deserialization of any class whose fully-qualified name starts with \"com.mchange.v2.c3p0.\" and ends with \"DataSource\", preventing exploitation of c3p0 gadget chains. This is an upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream 2.15.3 release before TuxCare's onboarding commit (c3881010de).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:34:22.136729+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability requires the ability to instantiate the gadget class com.mysql.cj.jdbc.admin.MiniAdmin during polymorphic JSON deserialization with Default Typing enabled. The target repository contains the upstream fix at SubTypeValidator.java:88, which adds \"com.mysql.cj.jdbc.admin.MiniAdmin\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This blocklist is enforced by the validation logic at line 269, which rejects deserialization attempts for any class in the blocklist. The fix was introduced by upstream commit dda513bd (author: tatu.saloranta@iki.fi) and was already present in upstream release 2.15.3 when TuxCare onboarded it via commit c3881010de. Therefore, the vulnerable pattern never existed in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability requires the ability to instantiate the gadget class com.mysql.cj.jdbc.admin.MiniAdmin during polymorphic JSON deserialization with Default Typing enabled. The target repository contains the upstream fix at SubTypeValidator.java:88, which adds \"com.mysql.cj.jdbc.admin.MiniAdmin\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This blocklist is enforced by the validation logic at line 269, which rejects deserialization attempts for any class in the blocklist. The fix was introduced by upstream commit dda513bd (author: tatu.saloranta@iki.fi) and was already present in upstream release 2.15.3 when TuxCare onboarded it via commit c3881010de. Therefore, the vulnerable pattern never existed in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-01T18:38:51.937076+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind version 2.15.3-tuxcare.4 is NOT AFFECTED by CVE-2019-12384. The fix that blocks polymorphic deserialization of ch.qos.logback.core.db.DriverManagerConnectionSource is present in SubTypeValidator.java at line 91. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit c9ef4a10d6 and was already included in the upstream 2.15.3 rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 The target jackson-databind version 2.15.3-tuxcare.4 is NOT AFFECTED by CVE-2019-12384. The fix that blocks polymorphic deserialization of ch.qos.logback.core.db.DriverManagerConnectionSource is present in SubTypeValidator.java at line 91. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit c9ef4a10d6 and was already included in the upstream 2.15.3 rele..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-02T07:20:00.097137+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability allows reading arbitrary local files through JDOM XSLTransformer gadget classes when Default Typing is enabled. The fix (blocking deserialization of org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer) was already included in the upstream release 2.15.3, which TuxCare onboarded. The blockl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability allows reading arbitrary local files through JDOM XSLTransformer gadget classes when Default Typing is enabled. The fix (blocking deserialization of org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer) was already included in the upstream release 2.15.3, which TuxCare onboarded. The blockl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T12:13:29.842653+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 does not affect this target. The vulnerability involves unsafe deserialization of ehcache's DefaultTransactionManagerLookup and logback's JNDIConnectionSource classes when default typing is enabled. The target version (2.15.3) already contains the upstream fix in SubTypeValidator.java lines 97-102, which blacklists both dangerous classes. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.15.3 that TuxCare onboarded, not applied as a TuxCare backport. The CVE affects versions before 2.9.9.2/2.8.11.4/2.7.9.6; version 2.15.3 (released 2023) is far beyond the affected range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 does not affect this target. The vulnerability involves unsafe deserialization of ehcache's DefaultTransactionManagerLookup and logback's JNDIConnectionSource classes when default typing is enabled. The target version (2.15.3) already contains the upstream fix in SubTypeValidator.java lines 97-102, which blacklists both dangerous classes. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.15.3 that TuxCare onboarded, not applied as a TuxCare backport. The CVE affects versions before 2.9.9.2/2.8.11.4/2.7.9.6; version 2.15.3 (released 2023) is far beyond the affected range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:33:56.225785+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 when Default Typing is enabled and logback jar is in classpath. The target version 2.15.3-tuxcare.4 is NOT vulnerable. The upstream fix (commit ad418eeb97 by Tatu Saloranta) was already present in FasterXML's 2.15.3 release before TuxCare onboarding. The dangerous class ch.qos.logback.core.db.JNDIConnectionSource is properly blacklisted in SubTypeValidator.java at line 102, preventing polymorphic deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 when Default Typing is enabled and logback jar is in classpath. The target version 2.15.3-tuxcare.4 is NOT vulnerable. The upstream fix (commit ad418eeb97 by Tatu Saloranta) was already present in FasterXML's 2.15.3 release before TuxCare onboarding. The dangerous class ch.qos.logback.core.db.JNDIConnectionSource is properly blacklisted in SubTypeValidator.java at line 102, preventing polymorphic deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:48:47.972282+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target repository is version 2.15.3-tuxcare.4, which already contains the upstream fix. The vulnerable classes com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource are blocked in SubTypeValidator.java (lines 105-107) via the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was introduced by upstream author Tatu Saloranta in commits d4983c74 and 73c1c2cc, which were already present in the upstream 2.15.3 release before TuxCare onboarded it (commit c3881010de by amoniatovskiy@cloudlinux.com). The validation is enforced by default during bean deserialization via BeanDeserializerFactory._validateSubType() with no configuration required.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target repository is version 2.15.3-tuxcare.4, which already contains the upstream fix. The vulnerable classes com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource are blocked in SubTypeValidator.java (lines 105-107) via the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was introduced by upstream author Tatu Saloranta in commits d4983c74 and 73c1c2cc, which were already present in the upstream 2.15.3 release before TuxCare onboarded it (commit c3881010de by amoniatovskiy@cloudlinux.com). The validation is enforced by default during bean deserialization via BeanDeserializerFactory._validateSubType() with no configuration required.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:57:36.777269+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.15.3-tuxcare.4 is NOT affected by CVE-2019-14892. The vulnerability involves polymorphic deserialization of malicious objects using commons-configuration JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) that can lead to arbitrary code execution. The vendor fix adds these two class names to a blocklist in SubTypeValidator.java to prevent their deserialization. This fix was committed by upstream maintainer Tatu Saloranta on September 19, 2019 (commit 41b7f9b901) and was included in upstream releases 2.9.10, 2.8.11.5, and 2.6.7.3. Since the target is version 2.15.3 (released much later), it already contains this upstream fix. The blocklist entries are present at SubTypeValidator.java:113-114, and the validator is actively enforced during deserialization via BeanDeserializerFactory:1032.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "The target jackson-databind version 2.15.3-tuxcare.4 is NOT affected by CVE-2019-14892. The vulnerability involves polymorphic deserialization of malicious objects using commons-configuration JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) that can lead to arbitrary code execution. The vendor fix adds these two class names to a blocklist in SubTypeValidator.java to prevent their deserialization. This fix was committed by upstream maintainer Tatu Saloranta on September 19, 2019 (commit 41b7f9b901) and was included in upstream releases 2.9.10, 2.8.11.5, and 2.6.7.3. Since the target is version 2.15.3 (released much later), it already contains this upstream fix. The blocklist entries are present at SubTypeValidator.java:113-114, and the validator is actively enforced during deserialization via BeanDeserializerFactory:1032.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is not present in jackson-databind 2.15.3. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution. The upstream vendor fix (commit 998efd7) added this class to the SubTypeValidator blacklist, and this fix was already included in the upstream 2.15.3 release when TuxCare onboarded it. The vulnerable pattern is not present because the upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893 is not present in jackson-databind 2.15.3. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution. The upstream vendor fix (commit 998efd7) added this class to the SubTypeValidator blacklist, and this fix was already included in the upstream 2.15.3 release when TuxCare onboarded it. The vulnerable pattern is not present because the upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T17:07:57.029053+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.3-tuxcare.4 is not affected by CVE-2019-16335. The fix that blocks com.zaxxer.hikari.HikariDataSource from polymorphic deserialization was already present in the upstream 2.15.3 release, authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi). The vulnerable pattern does not exist in the target because the defense was shipped in the base upstream version that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "The target jackson-databind 2.15.3-tuxcare.4 is not affected by CVE-2019-16335. The fix that blocks com.zaxxer.hikari.HikariDataSource from polymorphic deserialization was already present in the upstream 2.15.3 release, authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi). The vulnerable pattern does not exist in the target because the defense was shipped in the base upstream version that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:06:35.446673+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.15.3-tuxcare.4. The vulnerability allowed arbitrary code execution via polymorphic deserialization of commons-dbcp datasource gadget classes (PerUserPoolDataSource, SharedPoolDataSource). The upstream fix (commit 9593e16c by Tatu Saloranta) added these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was already present in upstream release 2.15.3 when TuxCare onboarded it (first TuxCare commit c3881010). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.15.3-tuxcare.4. The vulnerability allowed arbitrary code execution via polymorphic deserialization of commons-dbcp datasource gadget classes (PerUserPoolDataSource, SharedPoolDataSource). The upstream fix (commit 9593e16c by Tatu Saloranta) added these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was already present in upstream release 2.15.3 when TuxCare onboarded it (first TuxCare commit c3881010). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T17:16:29.149062+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 (jackson-databind polymorphic typing deserialization gadget via p6spy) is NOT affecting this target. The vulnerability was fixed by upstream jackson-databind in commit 9593e16c (databind#2478) by adding com.p6spy.engine.spy.P6DataSource to the deserialization blocklist in SubTypeValidator.java. This fix shipped in upstream 2.15.3 release and was already present when TuxCare onboarded version 2.15.3. The blocklist validation is enforced at runtime via BeanDeserializerFactory, preventing deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 (jackson-databind polymorphic typing deserialization gadget via p6spy) is NOT affecting this target. The vulnerability was fixed by upstream jackson-databind in commit 9593e16c (databind#2478) by adding com.p6spy.engine.spy.P6DataSource to the deserialization blocklist in SubTypeValidator.java. This fix shipped in upstream 2.15.3 release and was already present when TuxCare onboarded version 2.15.3. The blocklist validation is enforced at runtime via BeanDeserializerFactory, preventing deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:29:31.146838+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is not present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involved polymorphic deserialization of the dangerous gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream vendor (FasterXML) fixed this in commit 191a4cdf87 by adding the class to SubTypeValidator's blocklist. This fix was already included in the upstream 2.15.3 release that TuxCare onboarded, predating all TuxCare modifications. The blocklist entry at SubTypeValidator.java:99 prevents instantiation of the dangerous class during polymorphic deserialization, and this validation is enforced in the critical path at BeanDeserializerFactory.java:141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 is not present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involved polymorphic deserialization of the dangerous gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream vendor (FasterXML) fixed this in commit 191a4cdf87 by adding the class to SubTypeValidator's blocklist. This fix was already included in the upstream 2.15.3 release that TuxCare onboarded, predating all TuxCare modifications. The blocklist entry at SubTypeValidator.java:99 prevents instantiation of the dangerous class during polymorphic deserialization, and this validation is enforced in the critical path at BeanDeserializerFactory.java:141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:48:52.287276+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is not present in jackson-databind 2.15.3-tuxcare.4. The fix (adding org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource to the deserialization blocklist) was already included in the upstream release 2.15.3 that TuxCare onboarded. The blocklist entries appear at lines 130-131 of SubTypeValidator.java, preventing deserialization of these log4j-extras gadget classes when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is not present in jackson-databind 2.15.3-tuxcare.4. The fix (adding org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource to the deserialization blocklist) was already included in the upstream release 2.15.3 that TuxCare onboarded. The blocklist entries appear at lines 130-131 of SubTypeValidator.java, preventing deserialization of these log4j-extras gadget classes when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.3 is not affected by CVE-2019-20330. The vulnerability requires the absence of ehcache class blocking in jackson-databind's SubTypeValidator. The target contains the upstream fix (commit eb254813cc from November 2019) that adds the two required blocklist entries for net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector. This fix was already present in upstream release 2.15.3 (July 2023) before TuxCare onboarded it, as confirmed by the fix commit being an ancestor of the first TuxCare commit (c3881010de \"Onboard version 2.15.3\"). The vulnerable pattern (missing ehcache blocking) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "Target version 2.15.3 is not affected by CVE-2019-20330. The vulnerability requires the absence of ehcache class blocking in jackson-databind's SubTypeValidator. The target contains the upstream fix (commit eb254813cc from November 2019) that adds the two required blocklist entries for net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector. This fix was already present in upstream release 2.15.3 (July 2023) before TuxCare onboarded it, as confirmed by the fix commit being an ancestor of the first TuxCare commit (c3881010de \"Onboard version 2.15.3\"). The vulnerable pattern (missing ehcache blocking) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T17:03:58.617275+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability affects versions before 2.9.10.4 and involves unsafe deserialization of ignite-jta JNDI classes that could lead to remote code execution. The upstream fix (commit a424c038ba) added blocklist entries for org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup and CacheJndiTmFactory to SubTypeValidator.java. This fix was already present in the upstream 2.15.3 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (c3881010de \"Onboard version 2.15.3\"). The target contains the complete defense mechanism: SubTypeValidator maintains a blocklist of dangerous classes (DEFAULT_NO_DESER_CLASS_NAMES) and rejects deserialization attempts via validateSubType() method called by BeanDeserializerFactory during polymorphic type resolution. The vulnerable pattern (missing blocklist entries for ignite-jta) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability affects versions before 2.9.10.4 and involves unsafe deserialization of ignite-jta JNDI classes that could lead to remote code execution. The upstream fix (commit a424c038ba) added blocklist entries for org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup and CacheJndiTmFactory to SubTypeValidator.java. This fix was already present in the upstream 2.15.3 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (c3881010de \"Onboard version 2.15.3\"). The target contains the complete defense mechanism: SubTypeValidator maintains a blocklist of dangerous classes (DEFAULT_NO_DESER_CLASS_NAMES) and rejects deserialization attempts via validateSubType() method called by BeanDeserializerFactory during polymorphic type resolution. The vulnerable pattern (missing blocklist entries for ignite-jta) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is not present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involves deserialization of the gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory, which could enable arbitrary code execution. The upstream fix (commit 592872f4) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This fix was already present in the upstream 2.15.3 release that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "CVE-2020-10672 is not present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involves deserialization of the gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory, which could enable arbitrary code execution. The upstream fix (commit 592872f4) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This fix was already present in the upstream 2.15.3 release that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:28:57.615729+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in com.caucho.config.types.ResourceRef. The target repository (jackson-databind 2.15.3-tuxcare.4) is NOT AFFECTED because the upstream fix was already included in version 2.15.3. The fix adds com.caucho.config.types.ResourceRef to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java:167, preventing deserialization of this gadget class. The fix commit (1645efbd39) was authored by Tatu Saloranta (upstream maintainer) and was included in the upstream release before TuxCare onboarded version 2.15.3. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in com.caucho.config.types.ResourceRef. The target repository (jackson-databind 2.15.3-tuxcare.4) is NOT AFFECTED because the upstream fix was already included in version 2.15.3. The fix adds com.caucho.config.types.ResourceRef to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java:167, preventing deserialization of this gadget class. The fix commit (1645efbd39) was authored by Tatu Saloranta (upstream maintainer) and was included in the upstream release before TuxCare onboarded version 2.15.3. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 addresses a Java deserialization gadget vulnerability in jackson-databind related to org.aoju.bus.proxy.provider.remoting.RmiProvider (bus-proxy). The target repository (jackson-databind 2.15.3-tuxcare.4) is NOT AFFECTED because the upstream vendor fix was already present in the upstream release 2.15.3 that TuxCare onboarded. The fix adds org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider to the SubTypeValidator blacklist (lines 170-171), blocking deserialization of these gadget classes. The fix commit (05d7e0e13f) was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare onboarding commit (c3881010de).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 addresses a Java deserialization gadget vulnerability in jackson-databind related to org.aoju.bus.proxy.provider.remoting.RmiProvider (bus-proxy). The target repository (jackson-databind 2.15.3-tuxcare.4) is NOT AFFECTED because the upstream vendor fix was already present in the upstream release 2.15.3 that TuxCare onboarded. The fix adds org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider to the SubTypeValidator blacklist (lines 170-171), blocking deserialization of these gadget classes. The fix commit (05d7e0e13f) was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare onboarding commit (c3881010de).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.15.3-tuxcare.4) is not affected by CVE-2020-10969. The vulnerability pattern is not present because the fix was already included in the upstream jackson-databind 2.15.3 release that TuxCare onboarded. The fix adds javax.swing.JEditorPane to a deserialization blocklist in SubTypeValidator, preventing exploitation of this deserialization gadget. The fix commit (6ba4845798) by upstream maintainer Tatu Saloranta is an ancestor of TuxCare's onboarding commit (c3881010de), confirming this was an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "The target repository (jackson-databind 2.15.3-tuxcare.4) is not affected by CVE-2020-10969. The vulnerability pattern is not present because the fix was already included in the upstream jackson-databind 2.15.3 release that TuxCare onboarded. The fix adds javax.swing.JEditorPane to a deserialization blocklist in SubTypeValidator, preventing exploitation of this deserialization gadget. The fix commit (6ba4845798) by upstream maintainer Tatu Saloranta is an ancestor of TuxCare's onboarding commit (c3881010de), confirming this was an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is not present in jackson-databind 2.15.3-tuxcare.4. The fix for this CVE (blocking deserialization of org.apache.activemq.* classes) was already included in the upstream jackson-databind 2.15.3 release. The target repository contains the complete denylist including all nine activemq classes (ActiveMQConnectionFactory, ActiveMQXAConnectionFactory, spring variants, pool variants, and jms.pool variants) in SubTypeValidator.java lines 173-183. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit c14c9f99ed and was part of the upstream release before TuxCare onboarded version 2.15.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 is not present in jackson-databind 2.15.3-tuxcare.4. The fix for this CVE (blocking deserialization of org.apache.activemq.* classes) was already included in the upstream jackson-databind 2.15.3 release. The target repository contains the complete denylist including all nine activemq classes (ActiveMQConnectionFactory, ActiveMQXAConnectionFactory, spring variants, pool variants, and jms.pool variants) in SubTypeValidator.java lines 173-183. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit c14c9f99ed and was part of the upstream release before TuxCare onboarded version 2.15.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involved missing blacklist entries for deserialization gadget classes including org.apache.commons.proxy.provider.remoting.RmiProvider. The fix was added by upstream maintainer Tatu Saloranta in commit 05d7e0e1 on March 25, 2020, and was already present in the upstream 2.15.3 release that TuxCare onboarded. The target contains the complete fix at SubTypeValidator.java line 186.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involved missing blacklist entries for deserialization gadget classes including org.apache.commons.proxy.provider.remoting.RmiProvider. The fix was added by upstream maintainer Tatu Saloranta in commit 05d7e0e1 on March 25, 2020, and was already present in the upstream 2.15.3 release that TuxCare onboarded. The target contains the complete fix at SubTypeValidator.java line 186.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involves unsafe deserialization of org.apache.openjpa.ee.WASRegistryManagedRuntime. The target contains the upstream fix that adds this class to the SubTypeValidator blocklist (line 84 of SubTypeValidator.java), preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta in commit e2ba12d5d60715d95105e3e790fc234cfb59893d (March 28, 2020) and was already present in upstream release 2.15.3 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involves unsafe deserialization of org.apache.openjpa.ee.WASRegistryManagedRuntime. The target contains the upstream fix that adds this class to the SubTypeValidator blocklist (line 84 of SubTypeValidator.java), preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta in commit e2ba12d5d60715d95105e3e790fc234cfb59893d (March 28, 2020) and was already present in upstream release 2.15.3 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability was fixed in upstream version 2.9.10.4 (commit 113e89fb08 by Tatu Saloranta on April 6, 2020), which added MethodLocatingFactoryBean and BeanReferenceFactoryBean to the deserialization blacklist. The target version 2.15.3 is much newer than 2.9.10.4 and inherited this fix from the upstream release that TuxCare onboarded. The vulnerable code pattern (unblocked gadget classes) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability was fixed in upstream version 2.9.10.4 (commit 113e89fb08 by Tatu Saloranta on April 6, 2020), which added MethodLocatingFactoryBean and BeanReferenceFactoryBean to the deserialization blacklist. The target version 2.15.3 is much newer than 2.9.10.4 and inherited this fix from the upstream release that TuxCare onboarded. The vulnerable code pattern (unblocked gadget classes) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.15.3-tuxcare.4) is not affected by CVE-2020-11620. The vulnerability involves deserialization of the malicious gadget class org.apache.commons.jelly.impl.Embedded, which could lead to arbitrary code execution. The upstream FasterXML project fixed this vulnerability in commit 77040d85 (April 7, 2020) by adding the class to a blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.3 release that TuxCare onboarded in September 2026, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "The target repository (jackson-databind 2.15.3-tuxcare.4) is not affected by CVE-2020-11620. The vulnerability involves deserialization of the malicious gadget class org.apache.commons.jelly.impl.Embedded, which could lead to arbitrary code execution. The upstream FasterXML project fixed this vulnerability in commit 77040d85 (April 7, 2020) by adding the class to a blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.3 release that TuxCare onboarded in September 2026, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5. The target version 2.15.3-tuxcare.4 is based on upstream 2.15.3, which already contains the fix. The vulnerable class \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\" is blacklisted in SubTypeValidator.java at line 192. The fix was introduced in upstream commit d1c67a0396 authored by tatu.saloranta@iki.fi and was already present in the upstream 2.15.3 release before TuxCare onboarded it (first TuxCare commit: c3881010de). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5. The target version 2.15.3-tuxcare.4 is based on upstream 2.15.3, which already contains the fix. The vulnerable class \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\" is blacklisted in SubTypeValidator.java at line 192. The fix was introduced in upstream commit d1c67a0396 authored by tatu.saloranta@iki.fi and was already present in the upstream 2.15.3 release before TuxCare onboarded it (first TuxCare commit: c3881010de). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involves deserialization of Oracle JMS gadget classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) that could lead to arbitrary code execution. The upstream fix (commit 5c8642aeae9) added these 5 classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in the upstream jackson-databind 2.15.3 release (before TuxCare onboarding commit c3881010de38), so the vulnerable code pattern does not exist in the target. The CVE affects versions \"before 2.9.10.5\" and 2.15.3 is well after that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "CVE-2020-14061 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involves deserialization of Oracle JMS gadget classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) that could lead to arbitrary code execution. The upstream fix (commit 5c8642aeae9) added these 5 classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in the upstream jackson-databind 2.15.3 release (before TuxCare onboarding commit c3881010de38), so the vulnerable code pattern does not exist in the target. The CVE affects versions \"before 2.9.10.5\" and 2.15.3 is well after that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is NOT present in jackson-databind 2.15.3-tuxcare.4. The fix for this vulnerability (blacklisting com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool) was already included in the upstream jackson-databind 2.15.3 release. The blacklist entry is present at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:119, added by upstream commit 840eae2ca81 (Tatu Saloranta, 2020-05-01) which predates the TuxCare onboarding of version 2.15.3. The target repository inherited this fix from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 is NOT present in jackson-databind 2.15.3-tuxcare.4. The fix for this vulnerability (blacklisting com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool) was already included in the upstream jackson-databind 2.15.3 release. The blacklist entry is present at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:119, added by upstream commit 840eae2ca81 (Tatu Saloranta, 2020-05-01) which predates the TuxCare onboarding of version 2.15.3. The target repository inherited this fix from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects Jackson's polymorphic deserialization, allowing attackers to instantiate org.jsecurity.realm.jndi.JndiRealmFactory via crafted JSON, leading to JNDI injection and potential RCE. The fix adds this class to SubTypeValidator's blacklist (DEFAULT_NO_DESER_CLASS_NAMES). Target version 2.15.3-tuxcare.4 contains the upstream fix at line 207 of SubTypeValidator.java. Both fix commits (f6d9c664f6, 08fbfacf89) predate TuxCare's onboarding commit (c3881010de \"Onboard version 2.15.3\"), confirming the fix shipped in the upstream release. The blacklist is enforced by validateSubType() which throws \"Illegal type to deserialize: prevented for security reasons\" when a blacklisted class is encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 affects Jackson's polymorphic deserialization, allowing attackers to instantiate org.jsecurity.realm.jndi.JndiRealmFactory via crafted JSON, leading to JNDI injection and potential RCE. The fix adds this class to SubTypeValidator's blacklist (DEFAULT_NO_DESER_CLASS_NAMES). Target version 2.15.3-tuxcare.4 contains the upstream fix at line 207 of SubTypeValidator.java. Both fix commits (f6d9c664f6, 08fbfacf89) predate TuxCare's onboarding commit (c3881010de \"Onboard version 2.15.3\"), confirming the fix shipped in the upstream release. The blacklist is enforced by validateSubType() which throws \"Illegal type to deserialize: prevented for security reasons\" when a blacklisted class is encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:20:14.370746+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a deserialization gadget (br.com.anteros.dbcp.AnterosDBCPDataSource). The target version 2.15.3-tuxcare.4 is NOT vulnerable. The fix (adding AnterosDBCPDataSource to the blacklist in SubTypeValidator.java) was already present in upstream release 2.15.3, authored by Tatu Saloranta on 2020-08-10 in commit 3d97153944f. This upstream fix shipped with the version TuxCare onboarded, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a deserialization gadget (br.com.anteros.dbcp.AnterosDBCPDataSource). The target version 2.15.3-tuxcare.4 is NOT vulnerable. The fix (adding AnterosDBCPDataSource to the blacklist in SubTypeValidator.java) was already present in upstream release 2.15.3, authored by Tatu Saloranta on 2020-08-10 in commit 3d97153944f. This upstream fix shipped with the version TuxCare onboarded, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:16:30.596459+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 affects jackson-databind versions before 2.9.10.6, related to unsafe deserialization of the com.pastdev.httpcomponents.configuration.JndiConfiguration gadget class. The target version 2.15.3-tuxcare.4 is not affected because the upstream vendor (FasterXML) already added this class to the deserialization blacklist in version 2.10.5 (July 2020). This fix was included in the upstream 2.15.3 release that TuxCare onboarded. The vulnerable code pattern (missing blacklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 affects jackson-databind versions before 2.9.10.6, related to unsafe deserialization of the com.pastdev.httpcomponents.configuration.JndiConfiguration gadget class. The target version 2.15.3-tuxcare.4 is not affected because the upstream vendor (FasterXML) already added this class to the deserialization blacklist in version 2.10.5 (July 2020). This fix was included in the upstream 2.15.3 release that TuxCare onboarded. The vulnerable code pattern (missing blacklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in jackson-databind DOMDeserializer) is NOT present in target version 2.15.3-tuxcare.4. The upstream fix (commits 612f971b78 and 3d932709ab) was already included in the upstream release 2.15.3 before TuxCare onboarded it. The DOMDeserializer.java file at HEAD contains both security features that prevent XXE: (1) disallow-doctype-decl=true and (2) nonvalidating/load-external-dtd=false. These features were added by upstream maintainer Tatu Saloranta in January 2020 (commit 612f971b78) to address GitHub issue #2589, which became CVE-2020-25649. The fix is present at lines 40-46 of src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java with the comment \"[databind#2589] add two more settings just in case\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE vulnerability in jackson-databind DOMDeserializer) is NOT present in target version 2.15.3-tuxcare.4. The upstream fix (commits 612f971b78 and 3d932709ab) was already included in the upstream release 2.15.3 before TuxCare onboarded it. The DOMDeserializer.java file at HEAD contains both security features that prevent XXE: (1) disallow-doctype-decl=true and (2) nonvalidating/load-external-dtd=false. These features were added by upstream maintainer Tatu Saloranta in January 2020 (commit 612f971b78) to address GitHub issue #2589, which became CVE-2020-25649. The fix is present at lines 40-46 of src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java with the comment \"[databind#2589] add two more settings just in case\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:21:46.608783+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.3-tuxcare.4 is not affected by CVE-2020-35490. The vulnerability involves deserialization gadgets using Apache Commons DBCP2 classes (PerUserPoolDataSource, SharedPoolDataSource). The fix that blocklists these classes was already present in the upstream 2.15.3 release, which TuxCare onboarded. The vulnerable code pattern does not exist in the target because the upstream vendor (Tatu Saloranta) fixed it in commit 41b8bdb5 for release 2.9.10.8, and this fix is included in all subsequent versions including 2.15.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "The target jackson-databind 2.15.3-tuxcare.4 is not affected by CVE-2020-35490. The vulnerability involves deserialization gadgets using Apache Commons DBCP2 classes (PerUserPoolDataSource, SharedPoolDataSource). The fix that blocklists these classes was already present in the upstream 2.15.3 release, which TuxCare onboarded. The vulnerable code pattern does not exist in the target because the upstream vendor (Tatu Saloranta) fixed it in commit 41b8bdb5 for release 2.9.10.8, and this fix is included in all subsequent versions including 2.15.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T12:42:49.066061+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 affects jackson-databind 2.x before 2.9.10.8 due to missing blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource, enabling deserialization gadget exploitation. The target version 2.15.3 is not affected because it inherited the upstream fix from FasterXML release 2.9.10.8. The fix (commit 41b8bdb5cc) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, and this fix is present in the target at lines 217-218. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not TuxCare, and shipped in the upstream release that TuxCare version 2.15.3-tuxcare.3 is based on.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "CVE-2020-35491 affects jackson-databind 2.x before 2.9.10.8 due to missing blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource, enabling deserialization gadget exploitation. The target version 2.15.3 is not affected because it inherited the upstream fix from FasterXML release 2.9.10.8. The fix (commit 41b8bdb5cc) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, and this fix is present in the target at lines 217-218. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not TuxCare, and shipped in the upstream release that TuxCare version 2.15.3-tuxcare.3 is based on.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:54:51.888467+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.15.3-tuxcare.4. The fix for this deserialization gadget vulnerability was already included in the upstream 2.15.3 release that TuxCare onboarded. The dangerous class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool is blocked in SubTypeValidator.java at line 240, preventing its deserialization. This fix was originally applied by upstream maintainer Tatu Saloranta in December 2020 (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84), well before the 2.15.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.15.3-tuxcare.4. The fix for this deserialization gadget vulnerability was already included in the upstream 2.15.3 release that TuxCare onboarded. The dangerous class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool is blocked in SubTypeValidator.java at line 240, preventing its deserialization. This fix was originally applied by upstream maintainer Tatu Saloranta in December 2020 (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84), well before the 2.15.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:23:58.768798+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 does not affect jackson-databind 2.15.3-tuxcare.4. The vulnerability involves unsafe deserialization of DriverAdapterCPDS gadget classes. The upstream fix (commit 3ded28aece by Tatu Saloranta, Dec 31, 2020) added all five DriverAdapterCPDS variants to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.15.3 before TuxCare onboarded it on Sep 10, 2026. All five blocklist entries are present and active at lines 123, 193, 219, 228, and 234, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "CVE-2020-36179 does not affect jackson-databind 2.15.3-tuxcare.4. The vulnerability involves unsafe deserialization of DriverAdapterCPDS gadget classes. The upstream fix (commit 3ded28aece by Tatu Saloranta, Dec 31, 2020) added all five DriverAdapterCPDS variants to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.15.3 before TuxCare onboarded it on Sep 10, 2026. All five blocklist entries are present and active at lines 123, 193, 219, 228, and 234, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:36:59.729049+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.15.3-tuxcare.4) is not affected by CVE-2020-36180. The vulnerability was fixed in upstream jackson-databind release 2.9.10.8 (December 2020) by commit 3ded28aece, authored by Tatu Saloranta. The target version 2.15.3 is significantly newer than 2.9.10.8 and already contains the fix. All five DriverAdapterCPDS class name entries added by the patch are present in SubTypeValidator.java's denylist (lines 123, 193, 219, 228, 234), preventing deserialization of these gadget classes. This is an upstream fix that shipped in the 2.15.3 release before TuxCare onboarded it (first TuxCare commit c3881010de \"Onboard version 2.15.3\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "The target repository (jackson-databind 2.15.3-tuxcare.4) is not affected by CVE-2020-36180. The vulnerability was fixed in upstream jackson-databind release 2.9.10.8 (December 2020) by commit 3ded28aece, authored by Tatu Saloranta. The target version 2.15.3 is significantly newer than 2.9.10.8 and already contains the fix. All five DriverAdapterCPDS class name entries added by the patch are present in SubTypeValidator.java's denylist (lines 123, 193, 219, 228, 234), preventing deserialization of these gadget classes. This is an upstream fix that shipped in the 2.15.3 release before TuxCare onboarded it (first TuxCare commit c3881010de \"Onboard version 2.15.3\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:41:53.192155+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability affects versions before 2.9.10.8, and version 2.15.3 already contains the upstream fix. The SubTypeValidator blocklist includes org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS (line 228), preventing deserialization of this gadget class. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.15.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability affects versions before 2.9.10.8, and version 2.15.3 already contains the upstream fix. The SubTypeValidator blocklist includes org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS (line 228), preventing deserialization of this gadget class. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.15.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:13:29.562378+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, which can lead to code execution through JNDI injection. The upstream vendor fix (commit 3ded28aece by Tatu Saloranta) added this class to the deserialization blacklist in SubTypeValidator.java. This fix was already included in the upstream 2.15.3 release before TuxCare onboarded it (onboarding commit c3881010de by amoniatovskiy@cloudlinux.com). The target repository contains the complete defense mechanism: the gadget class is blacklisted at line 234, and the validation logic at lines 269-270 ensures any deserialization attempt of this class is rejected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, which can lead to code execution through JNDI injection. The upstream vendor fix (commit 3ded28aece by Tatu Saloranta) added this class to the deserialization blacklist in SubTypeValidator.java. This fix was already included in the upstream 2.15.3 release before TuxCare onboarded it (onboarding commit c3881010de by amoniatovskiy@cloudlinux.com). The target repository contains the complete defense mechanism: the gadget class is blacklisted at line 234, and the validation logic at lines 269-270 ensures any deserialization attempt of this class is rejected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:21:27.770551+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not present in jackson-databind 2.15.3-tuxcare.4. The fix (blocklist entry for org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) was already included in the upstream 2.15.3 release, authored by Tatu Saloranta on 2020-12-31. The vulnerable deserialization gadget class is blocked at SubTypeValidator.java:243, preventing exploitation. This is an upstream fix that shipped with the original release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "CVE-2020-36183 is not present in jackson-databind 2.15.3-tuxcare.4. The fix (blocklist entry for org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) was already included in the upstream 2.15.3 release, authored by Tatu Saloranta on 2020-12-31. The vulnerable deserialization gadget class is blocked at SubTypeValidator.java:243, preventing exploitation. This is an upstream fix that shipped with the original release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T12:25:55.953386+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.15.3. The vulnerability involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 567194c5 by Tatu Saloranta, dated 2020-12-26) added these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already part of the upstream 2.15.3 release that TuxCare onboarded on 2026-09-10, making this an upstream-provided protection rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.15.3. The vulnerability involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 567194c5 by Tatu Saloranta, dated 2020-12-26) added these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already part of the upstream 2.15.3 release that TuxCare onboarded on 2026-09-10, making this an upstream-provided protection rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:06:30.945793+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to a deserialization gadget vulnerability involving org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. The target repository (jackson-databind 2.15.3-tuxcare.4) is not affected because the upstream fix (commit 567194c53ae by Tatu Saloranta) was already present in the upstream 2.15.3 release before TuxCare onboarding. The fix adds the vulnerable gadget classes to the blocklist in SubTypeValidator.java, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to a deserialization gadget vulnerability involving org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. The target repository (jackson-databind 2.15.3-tuxcare.4) is not affected because the upstream fix (commit 567194c53ae by Tatu Saloranta) was already present in the upstream 2.15.3 release before TuxCare onboarding. The fix adds the vulnerable gadget classes to the blocklist in SubTypeValidator.java, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:33:03.457896+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The vendor's fix adds these classes to a deserialization blocklist in SubTypeValidator.java. The target already contains this fix at lines 229-230, which was shipped in the upstream 2.15.3 release (authored by Tatu Saloranta, the upstream maintainer). The fix commit (3e8fa3beea) predates TuxCare's onboarding commit (c3881010de), confirming it was included in the base upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "CVE-2020-36186 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The vendor's fix adds these classes to a deserialization blocklist in SubTypeValidator.java. The target already contains this fix at lines 229-230, which was shipped in the upstream 2.15.3 release (authored by Tatu Saloranta, the upstream maintainer). The fix commit (3e8fa3beea) predates TuxCare's onboarding commit (c3881010de), confirming it was included in the base upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:46:07.417160+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 3e8fa3beea) added these classes to the deserialization blocklist in SubTypeValidator.java, and this fix was already included in the upstream jackson-databind 2.15.3 release that TuxCare onboarded. The blocklist entries are present at lines 229-230 of SubTypeValidator.java, preventing instantiation of these dangerous classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "CVE-2020-36187 is NOT present in jackson-databind 2.15.3-tuxcare.4. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 3e8fa3beea) added these classes to the deserialization blocklist in SubTypeValidator.java, and this fix was already included in the upstream jackson-databind 2.15.3 release that TuxCare onboarded. The blocklist entries are present at lines 229-230 of SubTypeValidator.java, preventing instantiation of these dangerous classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:51:34.970346+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.15.3-tuxcare.4) is NOT AFFECTED by CVE-2020-36188. The vulnerability affects jackson-databind versions before 2.9.10.8 and 2.6.7.5. The fix that blocks the newrelic-agent gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) from deserialization is already present in the target at SubTypeValidator.java lines 223-224. This fix was introduced by upstream commit 33d96c13fe (authored by Tatu Saloranta) and was already included in the upstream 2.15.3 release that TuxCare onboarded. The vulnerable code pattern does not exist in the current version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "The target repository (jackson-databind 2.15.3-tuxcare.4) is NOT AFFECTED by CVE-2020-36188. The vulnerability affects jackson-databind versions before 2.9.10.8 and 2.6.7.5. The fix that blocks the newrelic-agent gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) from deserialization is already present in the target at SubTypeValidator.java lines 223-224. This fix was introduced by upstream commit 33d96c13fe (authored by Tatu Saloranta) and was already included in the upstream 2.15.3 release that TuxCare onboarded. The vulnerable code pattern does not exist in the current version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:02:11.032230+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. The target version 2.15.3 is not affected because the upstream fix (commit 33d96c13fe by Tatu Saloranta) was already included in the upstream release 2.15.3 that TuxCare onboarded. The fix adds both com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization and blocking the attack chain from Input (JSON with gadget type metadata) to Goal (arbitrary code execution via polymorphic deserialization).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. The target version 2.15.3 is not affected because the upstream fix (commit 33d96c13fe by Tatu Saloranta) was already included in the upstream release 2.15.3 that TuxCare onboarded. The fix adds both com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization and blocking the attack chain from Input (JSON with gadget type metadata) to Goal (arbitrary code execution via polymorphic deserialization).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:16:13.721778+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.15.3. The vulnerability (stack overflow from deeply nested JSON) was fixed upstream in version 2.14 via commit 8238ab41d0 by implementing a non-recursive deserializer (UntypedObjectDeserializerNR). This fix was already present in the upstream 2.15.3 release that TuxCare onboarded. The default configuration uses the safe non-recursive implementation, preventing stack exhaustion from deep nesting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.15.3. The vulnerability (stack overflow from deeply nested JSON) was fixed upstream in version 2.14 via commit 8238ab41d0 by implementing a non-recursive deserializer (UntypedObjectDeserializerNR). This fix was already present in the upstream 2.15.3 release that TuxCare onboarded. The default configuration uses the safe non-recursive implementation, preventing stack exhaustion from deep nesting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:11:03.643431+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.3 is not affected by CVE-2020-8840. The upstream vendor (FasterXML) fixed this vulnerability by adding org.apache.xbean.propertyeditor.JndiConverter to the deserialization blocklist in commit 914e7c9f2c (authored by Tatu Saloranta on Feb 9, 2020). This fix was already present in the upstream release 2.15.3 when TuxCare onboarded it on the tuxcare-current branch. The vulnerable code pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "Target version 2.15.3 is not affected by CVE-2020-8840. The upstream vendor (FasterXML) fixed this vulnerability by adding org.apache.xbean.propertyeditor.JndiConverter to the deserialization blocklist in commit 914e7c9f2c (authored by Tatu Saloranta on Feb 9, 2020). This fix was already present in the upstream release 2.15.3 when TuxCare onboarded it on the tuxcare-current branch. The vulnerable code pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 concerns a Jackson deserialization gadget vulnerability related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target repository jackson-databind version 2.15.3-tuxcare.4 is NOT AFFECTED because the upstream fix was already present in the 2.15.3 release that TuxCare onboarded. The SubTypeValidator.java file at line 141 contains the blocklist entry \"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig\" which blocks deserialization of this gadget class. The fix was authored by upstream maintainer Tatu Saloranta in commit 1e64db6a2f, which was already included in the upstream 2.15.3 release before TuxCare's onboarding commit c3881010de.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 concerns a Jackson deserialization gadget vulnerability related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target repository jackson-databind version 2.15.3-tuxcare.4 is NOT AFFECTED because the upstream fix was already present in the 2.15.3 release that TuxCare onboarded. The SubTypeValidator.java file at line 141 contains the blocklist entry \"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig\" which blocks deserialization of this gadget class. The fix was authored by upstream maintainer Tatu Saloranta in commit 1e64db6a2f, which was already included in the upstream 2.15.3 release before TuxCare's onboarding commit c3881010de.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:42:44.997491+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.15.3-tuxcare.4) is NOT AFFECTED by CVE-2020-9547. The vulnerability fix - blacklisting the dangerous class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` in SubTypeValidator - was already present in upstream version 2.15.3 when TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta in February 2020 and shipped with upstream releases 2.9.10.4, 2.8.11.6, and 2.7.9.7, all of which predate version 2.15.3. The vulnerable code pattern (unblacklisted ibatis class allowing dangerous deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "The target repository (jackson-databind 2.15.3-tuxcare.4) is NOT AFFECTED by CVE-2020-9547. The vulnerability fix - blacklisting the dangerous class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` in SubTypeValidator - was already present in upstream version 2.15.3 when TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta in February 2020 and shipped with upstream releases 2.9.10.4, 2.8.11.6, and 2.7.9.7, all of which predate version 2.15.3. The vulnerable code pattern (unblacklisted ibatis class allowing dangerous deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:16:13.062310+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7. The target version 2.15.3-tuxcare.4 is not vulnerable because the fix was already present in the upstream jackson-databind 2.15.3 release. The dangerous class br.com.anteros.dbcp.AnterosDBCPConfig is blocked in SubTypeValidator.java at line 145, preventing deserialization gadget exploitation. This fix was authored by upstream maintainer Tatu Saloranta (commit 1e64db6a2f, dated 2020-02-29) and was included in the upstream 2.15.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7. The target version 2.15.3-tuxcare.4 is not vulnerable because the fix was already present in the upstream jackson-databind 2.15.3 release. The dangerous class br.com.anteros.dbcp.AnterosDBCPConfig is blocked in SubTypeValidator.java at line 145, preventing deserialization gadget exploitation. This fix was authored by upstream maintainer Tatu Saloranta (commit 1e64db6a2f, dated 2020-02-29) and was included in the upstream 2.15.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:14:37.389349+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 (issue #2854) concerns deserialization of javax.swing.JTextPane as a gadget class. The target version 2.15.3-tuxcare.4 is not affected because the upstream fix blocking JTextPane was already present in the upstream release 2.15.3 when TuxCare onboarded it. The defense (blocklist entry) exists at SubTypeValidator.java line 151. Fix commits 7dbf51bf78 and 08fbfacf89 are ancestors of HEAD and predate the first TuxCare commit (c3881010de - onboarding), confirming this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 (issue #2854) concerns deserialization of javax.swing.JTextPane as a gadget class. The target version 2.15.3-tuxcare.4 is not affected because the upstream fix blocking JTextPane was already present in the upstream release 2.15.3 when TuxCare onboarded it. The defense (blocklist entry) exists at SubTypeValidator.java line 151. Fix commits 7dbf51bf78 and 08fbfacf89 are ancestors of HEAD and predate the first TuxCare commit (c3881010de - onboarding), confirming this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 is not present in jackson-databind 2.15.3. The vulnerability was fixed upstream in commit 3ccde7d938 (Dec 2021) by Tatu Saloranta, which added protection against DoS via maliciously large length values in JDK serialization. The fix limits eager allocation to 100KB and uses incremental reading for larger payloads. This fix was already included in the upstream 2.15.3 release that TuxCare onboarded, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "CVE-2021-46877 is not present in jackson-databind 2.15.3. The vulnerability was fixed upstream in commit 3ccde7d938 (Dec 2021) by Tatu Saloranta, which added protection against DoS via maliciously large length values in JDK serialization. The fix limits eager allocation to 100KB and uses incremental reading for larger payloads. This fix was already included in the upstream 2.15.3 release that TuxCare onboarded, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:45:07.357611+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.3 contains the upstream fix for CVE-2022-42003 that was shipped in the upstream release. The fix adds depth checks in primitive value deserializers and BeanDeserializer to prevent unbounded recursion when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The vulnerable pattern (missing nested array checks) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "Target version 2.15.3 contains the upstream fix for CVE-2022-42003 that was shipped in the upstream release. The fix adds depth checks in primitive value deserializers and BeanDeserializer to prevent unbounded recursion when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The vulnerable pattern (missing nested array checks) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:58:07.747368+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.3-tuxcare.4 is NOT AFFECTED by CVE-2022-42004. The vulnerability (resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream versions 2.12.7.1 and 2.13.4. Since 2.15.3 > 2.13.4, the fix was already present in the upstream 2.15.3 release that TuxCare onboarded. The defense code at BeanDeserializer.java:638-646 checks for a second START_ARRAY token after unwrapping one level and rejects the input, preventing unbounded recursive array processing. Fix commit 063183589 was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit c3881010de.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "The target jackson-databind 2.15.3-tuxcare.4 is NOT AFFECTED by CVE-2022-42004. The vulnerability (resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream versions 2.12.7.1 and 2.13.4. Since 2.15.3 > 2.13.4, the fix was already present in the upstream 2.15.3 release that TuxCare onboarded. The defense code at BeanDeserializer.java:638-646 checks for a second START_ARRAY token after unwrapping one level and rejects the input, preventing unbounded recursive array processing. Fix commit 063183589 was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit c3881010de.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-02T20:19:00.068472+00:00", "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193: Target version 2.15.3-tuxcare.4 is NOT AFFECTED. The vulnerability (stack overflow from deeply nested JSON serialization) was fixed in upstream jackson-databind 2.14.0 via commit a1fa4ae4ec by Tatu Saloranta. Since 2.15.3 was released after 2.14.0, the fix was already included in the upstream release that TuxCare onboarded. The vulnerable recursive serialization pattern is not p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50193" }, "impact_statement": "not_affected \u2014 CVE-2026-50193: Target version 2.15.3-tuxcare.4 is NOT AFFECTED. The vulnerability (stack overflow from deeply nested JSON serialization) was fixed in upstream jackson-databind 2.14.0 via commit a1fa4ae4ec by Tatu Saloranta. Since 2.15.3 was released after 2.14.0, the fix was already included in the upstream release that TuxCare onboarded. The vulnerable recursive serialization pattern is not p..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-54512 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.3-tuxcare.3.", "vulnerability": { "name": "CVE-2026-54512" }, "action_statement": "Vulnerability CVE-2026-54512 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.3-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-05T10:16:16.309591+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.3-tuxcare.5.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-10T04:17:00.447062+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it rejects @JsonUnwrapped creator parameters before they can receive input. Unnamed parameters are rejected during creator construction at src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:870; named properties are rejected during resolution at src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:934. These checks prevent the vulnerable replay of buffered JSON into unwrapped creator parameters.", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it rejects @JsonUnwrapped creator parameters before they can receive input. Unnamed parameters are rejected during creator construction at src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:870; named properties are rejected during resolution at src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:934. These checks prevent the vulnerable replay of buffered JSON into unwrapped creator parameters." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59888" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-01T13:50:01.087137+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.3-tuxcare.4.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.3-tuxcare.3.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.3-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.3-tuxcare.3.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.3-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-11-05T10:16:16.309591+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.3-tuxcare.5.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.3-tuxcare.5." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.15.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3-tuxcare.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.15.3-tuxcare.2.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }