{ "@id": "urn:uuid:2391d81b-56cf-42e6-add1-c938cd0c183b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 63, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:24:45.618566+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:11:20.672019+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.17.1-tuxcare.4 is not affected by CVE-2017-15095. The vulnerability allowed arbitrary code execution through polymorphic deserialization of malicious classes. The upstream fix (issue #1737, commit ddfddfba64) added a blacklist of dangerous classes to SubTypeValidator.java, preventing their deserialization. This fix was already present in upstream version 2.17.1 when TuxCare onboarded it (commit d1a4eb5f86 by amoniatovskiy@cloudlinux.com). The blacklist includes all CVE-2017-15095 classes: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, and org.springframework.beans.factory.config.PropertyPathFactoryBean. The validation is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "Target jackson-databind 2.17.1-tuxcare.4 is not affected by CVE-2017-15095. The vulnerability allowed arbitrary code execution through polymorphic deserialization of malicious classes. The upstream fix (issue #1737, commit ddfddfba64) added a blacklist of dangerous classes to SubTypeValidator.java, preventing their deserialization. This fix was already present in upstream version 2.17.1 when TuxCare onboarded it (commit d1a4eb5f86 by amoniatovskiy@cloudlinux.com). The blacklist includes all CVE-2017-15095 classes: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, and org.springframework.beans.factory.config.PropertyPathFactoryBean. The validation is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:46:24.540154+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.17.1 is NOT vulnerable to CVE-2017-17485. The vulnerability was fixed upstream in version 2.8.11 (December 2017) through commits that added blacklist entries for dangerous classes. Version 2.17.1 (released May 2024) already contains all these fixes as part of the upstream release, specifically in commit 2235894210c75f624a3d0cd60bfb0434a20a18bf which introduced SubTypeValidator with comprehensive blacklist validation including: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, and pattern-based checks for Spring AbstractPointcutAdvisor/AbstractApplicationContext and C3P0 DataSource classes. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "The target jackson-databind version 2.17.1 is NOT vulnerable to CVE-2017-17485. The vulnerability was fixed upstream in version 2.8.11 (December 2017) through commits that added blacklist entries for dangerous classes. Version 2.17.1 (released May 2024) already contains all these fixes as part of the upstream release, specifically in commit 2235894210c75f624a3d0cd60bfb0434a20a18bf which introduced SubTypeValidator with comprehensive blacklist validation including: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, and pattern-based checks for Spring AbstractPointcutAdvisor/AbstractApplicationContext and C3P0 DataSource classes. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:30:21.985032+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.17.1-tuxcare.4 is NOT affected by CVE-2017-7525. The vulnerability (deserialization of dangerous classes enabling RCE) was fixed in upstream versions 2.6.7.1, 2.7.9.1, and 2.8.9 (July 2017) via SubTypeValidator blacklist checks. The fix was already present in the upstream 2.17.1 release that TuxCare onboarded, making this an upstream fix shipped in the release rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "Target jackson-databind 2.17.1-tuxcare.4 is NOT affected by CVE-2017-7525. The vulnerability (deserialization of dangerous classes enabling RCE) was fixed in upstream versions 2.6.7.1, 2.7.9.1, and 2.8.9 (July 2017) via SubTypeValidator blacklist checks. The fix was already present in the upstream 2.17.1 release that TuxCare onboarded, making this an upstream fix shipped in the release rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:22:33.360201+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5 and was fixed in 2.7.9.4, 2.8.11.2, 2.9.6. The target version 2.17.1-tuxcare.4 is much newer and already contains the upstream fix. The defense (blacklist entry for org.apache.ibatis.parsing.XPathParser in SubTypeValidator) is present at line 65 of SubTypeValidator.java, blocking deserialization of the iBatis gadget class that enables XXE-based data exfiltration. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 27b4defc270 and was already present in the 2.17.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5 and was fixed in 2.7.9.4, 2.8.11.2, 2.9.6. The target version 2.17.1-tuxcare.4 is much newer and already contains the upstream fix. The defense (blacklist entry for org.apache.ibatis.parsing.XPathParser in SubTypeValidator) is present at line 65 of SubTypeValidator.java, blocking deserialization of the iBatis gadget class that enables XXE-based data exfiltration. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 27b4defc270 and was already present in the 2.17.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.17.1-tuxcare.4 is NOT affected by CVE-2018-12022. The vulnerability affected jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6 (fixed June 2018). The target version is significantly newer and already contains the upstream fix. The dangerous class `jodd.db.connection.DataSourceConnectionProvider` is blacklisted in SubTypeValidator.java:68, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 28badf7ef6 and was already present in the upstream 2.17.1 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "Target version 2.17.1-tuxcare.4 is NOT affected by CVE-2018-12022. The vulnerability affected jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6 (fixed June 2018). The target version is significantly newer and already contains the upstream fix. The dangerous class `jodd.db.connection.DataSourceConnectionProvider` is blacklisted in SubTypeValidator.java:68, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 28badf7ef6 and was already present in the upstream 2.17.1 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:22:27.344203+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.17.1. The vulnerability involves polymorphic deserialization of Oracle JDBC classes (OracleJDBCRowSet, OracleManagedConnectionFactory) that can trigger JNDI/LDAP injection leading to remote code execution when Default Typing is enabled. The fix\u2014blacklisting these classes in SubTypeValidator\u2014was implemented by upstream maintainer Tatu Saloranta in June 2018 (commits 28badf7ef6, 7487cf7eb1) and shipped in the upstream 2.17.1 release that TuxCare onboarded. The target version contains the complete fix with all three Oracle JDBC gadget classes blocked.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.17.1. The vulnerability involves polymorphic deserialization of Oracle JDBC classes (OracleJDBCRowSet, OracleManagedConnectionFactory) that can trigger JNDI/LDAP injection leading to remote code execution when Default Typing is enabled. The fix\u2014blacklisting these classes in SubTypeValidator\u2014was implemented by upstream maintainer Tatu Saloranta in June 2018 (commits 28badf7ef6, 7487cf7eb1) and shipped in the upstream 2.17.1 release that TuxCare onboarded. The target version contains the complete fix with all three Oracle JDBC gadget classes blocked.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:58:58.947122+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability allowed arbitrary code execution through polymorphic deserialization of slf4j-ext classes. The fix, which adds org.slf4j.ext.EventData and three other dangerous classes to a blocklist (DEFAULT_NO_DESER_CLASS_NAMES), is present in the target repository. This fix was authored by upstream maintainer Tatu Saloranta (commit 87d29af25e) on August 16, 2018, and was already part of the upstream release 2.17.1 when TuxCare onboarded it on September 20, 2026. The blocklist is actively enforced during bean deserialization via SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability allowed arbitrary code execution through polymorphic deserialization of slf4j-ext classes. The fix, which adds org.slf4j.ext.EventData and three other dangerous classes to a blocklist (DEFAULT_NO_DESER_CLASS_NAMES), is present in the target repository. This fix was authored by upstream maintainer Tatu Saloranta (commit 87d29af25e) on August 16, 2018, and was already part of the upstream release 2.17.1 when TuxCare onboarded it on September 20, 2026. The blocklist is actively enforced during bean deserialization via SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:02:25.196465+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability involved BlazeDS classes (blaze-ds-opt/blaze-ds-core, specifically flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor) being exploitable through polymorphic deserialization to achieve arbitrary code execution. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by Tatu Saloranta) added these classes to a deserialization blacklist. This fix was already present in the upstream 2.17.1 release that TuxCare onboarded, making the vulnerable code pattern absent from the target. The blacklist check in SubTypeValidator.java:76,269 blocks instantiation of the BlazeDS gadget class before any deserialization occurs, preventing the attack chain from INPUT (JSON with polymorphic type information) to GOAL (arbitrary code execution).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability involved BlazeDS classes (blaze-ds-opt/blaze-ds-core, specifically flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor) being exploitable through polymorphic deserialization to achieve arbitrary code execution. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by Tatu Saloranta) added these classes to a deserialization blacklist. This fix was already present in the upstream 2.17.1 release that TuxCare onboarded, making the vulnerable code pattern absent from the target. The blacklist check in SubTypeValidator.java:76,269 blocks instantiation of the BlazeDS gadget class before any deserialization occurs, preventing the attack chain from INPUT (JSON with polymorphic type information) to GOAL (arbitrary code execution).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:09:29.528523+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.17.1-tuxcare.4 is NOT vulnerable to CVE-2018-14720. The fix for this XXE/polymorphic deserialization vulnerability was already present in the upstream release 2.17.1 when TuxCare onboarded it. The four dangerous classes identified in the patch (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are properly blacklisted in SubTypeValidator.java lines 74-78, and the SubTypeValidator.validateSubType method actively checks this blacklist during polymorphic deserialization to prevent instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "The target repository jackson-databind 2.17.1-tuxcare.4 is NOT vulnerable to CVE-2018-14720. The fix for this XXE/polymorphic deserialization vulnerability was already present in the upstream release 2.17.1 when TuxCare onboarded it. The four dangerous classes identified in the patch (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are properly blacklisted in SubTypeValidator.java lines 74-78, and the SubTypeValidator.validateSubType method actively checks this blacklist during polymorphic deserialization to prevent instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:40:31.077655+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 addresses polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl that enables SSRF attacks. The target repository (jackson-databind 2.17.1-tuxcare.4) is NOT affected because the upstream vendor fix was already present in the release that TuxCare onboarded. The axis2-jaxws class is blocklisted in SubTypeValidator.java line 78, and the validateSubType method rejects deserialization attempts with a security exception. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 87d29af25e and was already in the upstream release before TuxCare's onboarding commit d1a4eb5f86.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 addresses polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl that enables SSRF attacks. The target repository (jackson-databind 2.17.1-tuxcare.4) is NOT affected because the upstream vendor fix was already present in the release that TuxCare onboarded. The axis2-jaxws class is blocklisted in SubTypeValidator.java line 78, and the validateSubType method rejects deserialization attempts with a security exception. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 87d29af25e and was already in the upstream release before TuxCare's onboarding commit d1a4eb5f86.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T12:53:41.382779+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is NOT present in jackson-databind 2.17.1. The vulnerability concerns polymorphic deserialization of the org.apache.axis2.transport.jms.JMSOutTransportInfo class. The upstream fix (commit 72cd4025a2, issue #2186) added this class to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.17.1 before TuxCare onboarded it. The target code at line 85 of SubTypeValidator.java contains the blocklist entry, and the validateSubType method actively enforces the blocklist, throwing exceptions for blocked classes. The vulnerable pattern (ability to deserialize axis2-transport-jms classes) has been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 is NOT present in jackson-databind 2.17.1. The vulnerability concerns polymorphic deserialization of the org.apache.axis2.transport.jms.JMSOutTransportInfo class. The upstream fix (commit 72cd4025a2, issue #2186) added this class to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.17.1 before TuxCare onboarded it. The target code at line 85 of SubTypeValidator.java contains the blocklist entry, and the validateSubType method actively enforces the blocklist, throwing exceptions for blocked classes. The vulnerable pattern (ability to deserialize axis2-transport-jms classes) has been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:59:33.966848+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.17.1-tuxcare.4) is not affected by CVE-2018-19361. The vulnerability concerns missing Apache OpenJPA classes (RegistryManagedRuntime, JNDIManagedRuntime) in Jackson's polymorphic deserialization deny-list, which could enable deserialization gadget attacks. The upstream fix (commit 72cd4025) adding these classes to SubTypeValidator.java was already present in version 2.17.1 when TuxCare onboarded it. The deny-list entries exist at SubTypeValidator.java lines 82-83 and are active by default in all deserialization flows.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "The target repository (jackson-databind 2.17.1-tuxcare.4) is not affected by CVE-2018-19361. The vulnerability concerns missing Apache OpenJPA classes (RegistryManagedRuntime, JNDIManagedRuntime) in Jackson's polymorphic deserialization deny-list, which could enable deserialization gadget attacks. The upstream fix (commit 72cd4025) adding these classes to SubTypeValidator.java was already present in version 2.17.1 when TuxCare onboarded it. The deny-list entries exist at SubTypeValidator.java lines 82-83 and are active by default in all deserialization flows.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:26:39.614024+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2018-19362. The vulnerability concerns polymorphic deserialization of dangerous classes (org.jboss.util.propertyeditor.DocumentEditor and others). The fix adding these classes to the deserialization blocklist was authored by upstream maintainer Tatu Saloranta (commit 72cd4025a2) and was already present in the upstream 2.17.1 release that TuxCare onboarded. The dangerous classes are blocked at SubTypeValidator.java lines 80-85, preventing the malicious INPUT (polymorphic type identifiers) from reaching the GOAL (execution of dangerous class code).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "Target jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2018-19362. The vulnerability concerns polymorphic deserialization of dangerous classes (org.jboss.util.propertyeditor.DocumentEditor and others). The fix adding these classes to the deserialization blocklist was authored by upstream maintainer Tatu Saloranta (commit 72cd4025a2) and was already present in the upstream 2.17.1 release that TuxCare onboarded. The dangerous classes are blocked at SubTypeValidator.java lines 80-85, preventing the malicious INPUT (polymorphic type identifiers) from reaching the GOAL (execution of dangerous class code).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 due to two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The target version 2.17.1 is not affected because the upstream fix was already included when TuxCare onboarded version 2.17.1. Both gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 62-63), preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 due to two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The target version 2.17.1 is not affected because the upstream fix was already included when TuxCare onboarded version 2.17.1. Both gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 62-63), preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:57:09.327261+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 affects jackson-databind's incomplete blacklist for c3p0 deserialization gadgets. The target version 2.17.1-tuxcare.4 is NOT vulnerable because the fix was already present in the upstream release 2.17.1 when TuxCare onboarded it. The fix, authored by upstream maintainer Tatu Saloranta in commit 6799f8f10c (2018-02-10), blocks deserialization of c3p0 classes matching \"com.mchange.v2.c3p0.*DataSource\" in SubTypeValidator.java. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 affects jackson-databind's incomplete blacklist for c3p0 deserialization gadgets. The target version 2.17.1-tuxcare.4 is NOT vulnerable because the fix was already present in the upstream release 2.17.1 when TuxCare onboarded it. The fix, authored by upstream maintainer Tatu Saloranta in commit 6799f8f10c (2018-02-10), blocks deserialization of c3p0 classes matching \"com.mchange.v2.c3p0.*DataSource\" in SubTypeValidator.java. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:36:34.248507+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.17.1 is not affected by CVE-2019-12086. The vulnerability was fixed in upstream jackson-databind 2.9.9 by adding \"com.mysql.cj.jdbc.admin.MiniAdmin\" to the deserialization blocklist. This fix was already present in the upstream release when TuxCare onboarded version 2.17.1, as confirmed by commit dda513bd72 authored by upstream maintainer Tatu Saloranta. The fix is present at line 88 of SubTypeValidator.java and actively enforced through the deserialization validation path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "Target version 2.17.1 is not affected by CVE-2019-12086. The vulnerability was fixed in upstream jackson-databind 2.9.9 by adding \"com.mysql.cj.jdbc.admin.MiniAdmin\" to the deserialization blocklist. This fix was already present in the upstream release when TuxCare onboarded version 2.17.1, as confirmed by commit dda513bd72 authored by upstream maintainer Tatu Saloranta. The fix is present at line 88 of SubTypeValidator.java and actively enforced through the deserialization validation path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T18:43:34.870603+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is not a vulnerability in jackson-databind 2.17.1-tuxcare.4. The upstream fix (commit c9ef4a10d6) was already present in upstream release 2.17.1 before TuxCare onboarded it. The fix adds 'ch.qos.logback.core.db.DriverManagerConnectionSource' to the SubTypeValidator blocklist at line 91, preventing polymorphic deserialization of this gadget class. The validateSubType method enforc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 is not a vulnerability in jackson-databind 2.17.1-tuxcare.4. The upstream fix (commit c9ef4a10d6) was already present in upstream release 2.17.1 before TuxCare onboarded it. The fix adds 'ch.qos.logback.core.db.DriverManagerConnectionSource' to the SubTypeValidator blocklist at line 91, preventing polymorphic deserialization of this gadget class. The validateSubType method enforc..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-02T07:25:00.155484+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.17.1 is not affected by CVE-2019-12814. The vulnerability (polymorphic deserialization of JDOM XSLTransformer classes leading to arbitrary file read) is prevented by a blocklist in SubTypeValidator.java that prohibits deserialization of org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer. This fix was authored by upstream maintainer Tatu Salora...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 The target jackson-databind 2.17.1 is not affected by CVE-2019-12814. The vulnerability (polymorphic deserialization of JDOM XSLTransformer classes leading to arbitrary file read) is prevented by a blocklist in SubTypeValidator.java that prohibits deserialization of org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer. This fix was authored by upstream maintainer Tatu Salora..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T12:15:19.421943+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is not present in jackson-databind 2.17.1. The fix (adding net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deny-list in SubTypeValidator.java) was shipped in the upstream release and is present in the target at lines 97-99. The target version 2.17.1 is much newer than the affected versions (before 2.9.9.2, 2.8.11.4, and 2.7.9.6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is not present in jackson-databind 2.17.1. The fix (adding net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deny-list in SubTypeValidator.java) was shipped in the upstream release and is present in the target at lines 97-99. The target version 2.17.1 is much newer than the affected versions (before 2.9.9.2, 2.8.11.4, and 2.7.9.6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:36:59.528750+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 (jackson-databind polymorphic deserialization gadget) is NOT present in jackson-databind 2.17.1-tuxcare.4. The fix was already included in upstream version 2.17.1 before TuxCare onboarded this version. The blacklist entries for the dangerous classes (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) are present in SubTypeValidator.java at lines 98 and 102, preventing deserialization attacks when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 (jackson-databind polymorphic deserialization gadget) is NOT present in jackson-databind 2.17.1-tuxcare.4. The fix was already included in upstream version 2.17.1 before TuxCare onboarded this version. The blacklist entries for the dangerous classes (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) are present in SubTypeValidator.java at lines 98 and 102, preventing deserialization attacks when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:49:36.466974+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is a jackson-databind polymorphic deserialization vulnerability allowing remote code execution via HikariCP configuration classes. The target (jackson-databind 2.17.1-tuxcare.4) is NOT AFFECTED because the upstream fix was already included in the 2.17.1 release before TuxCare onboarded it. The HikariCP classes (com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource) are blacklisted in SubTypeValidator.java at lines 105-107, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta in commits d4983c740f and 73c1c2cc76, which are ancestors of the first TuxCare commit d1a4eb5f86.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 is a jackson-databind polymorphic deserialization vulnerability allowing remote code execution via HikariCP configuration classes. The target (jackson-databind 2.17.1-tuxcare.4) is NOT AFFECTED because the upstream fix was already included in the 2.17.1 release before TuxCare onboarded it. The HikariCP classes (com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource) are blacklisted in SubTypeValidator.java at lines 105-107, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta in commits d4983c740f and 73c1c2cc76, which are ancestors of the first TuxCare commit d1a4eb5f86.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:58:22.317135+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is not present in jackson-databind 2.17.1-tuxcare.4. The vulnerability required blocklisting commons-configuration JNDI classes to prevent polymorphic deserialization exploitation. This fix was implemented by upstream maintainer Tatu Saloranta in commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af (September 2019) and was already present in the upstream 2.17.1 release that TuxCare onboarded. The blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration are present in SubTypeValidator.java at lines 113-114, and the validation mechanism is actively integrated into the deserialization flow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 is not present in jackson-databind 2.17.1-tuxcare.4. The vulnerability required blocklisting commons-configuration JNDI classes to prevent polymorphic deserialization exploitation. This fix was implemented by upstream maintainer Tatu Saloranta in commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af (September 2019) and was already present in the upstream 2.17.1 release that TuxCare onboarded. The blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration are present in SubTypeValidator.java at lines 113-114, and the validation mechanism is actively integrated into the deserialization flow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.17.1-tuxcare.4) is NOT AFFECTED by CVE-2019-14893. The upstream fix for this vulnerability (commit 998efd7082 by Tatu Saloranta) was already present in version 2.17.1 before TuxCare onboarded it. The malicious class org.apache.xalan.lib.sql.JNDIConnectionPool is blocked in SubTypeValidator.java at line 117, preventing polymorphic deserialization attacks using the xalan JNDI gadget. The blocklist is actively enforced during deserialization by BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "The target repository (jackson-databind 2.17.1-tuxcare.4) is NOT AFFECTED by CVE-2019-14893. The upstream fix for this vulnerability (commit 998efd7082 by Tatu Saloranta) was already present in version 2.17.1 before TuxCare onboarded it. The malicious class org.apache.xalan.lib.sql.JNDIConnectionPool is blocked in SubTypeValidator.java at line 117, preventing polymorphic deserialization attacks using the xalan JNDI gadget. The blocklist is actively enforced during deserialization by BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T17:08:31.778572+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is a polymorphic typing vulnerability in jackson-databind involving HikariDataSource gadget chain exploitation. The target (jackson-databind 2.17.1-tuxcare.4) is NOT AFFECTED because the upstream fix (commit 73c1c2cc76) was already included in version 2.17.1 before TuxCare onboarded it. The fix adds HikariDataSource to the SubTypeValidator blocklist at line 107, blocking polymorphic deserialization with the security error \"Illegal type to deserialize: prevented for security reasons\". The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 is a polymorphic typing vulnerability in jackson-databind involving HikariDataSource gadget chain exploitation. The target (jackson-databind 2.17.1-tuxcare.4) is NOT AFFECTED because the upstream fix (commit 73c1c2cc76) was already included in version 2.17.1 before TuxCare onboarded it. The fix adds HikariDataSource to the SubTypeValidator blocklist at line 107, blocking polymorphic deserialization with the security error \"Illegal type to deserialize: prevented for security reasons\". The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:08:01.045470+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability relates to polymorphic deserialization of Apache Commons DBCP datasource classes (PerUserPoolDataSource, SharedPoolDataSource) and P6DataSource that can trigger JNDI injection attacks. The upstream fix commits (9593e16cf5 and 328a0f833d) added these classes to the SubTypeValidator blacklist, preventing their deserialization. These fixes were authored by Tatu Saloranta (upstream maintainer) and were already included in the upstream jackson-databind 2.17.1 release before TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability relates to polymorphic deserialization of Apache Commons DBCP datasource classes (PerUserPoolDataSource, SharedPoolDataSource) and P6DataSource that can trigger JNDI injection attacks. The upstream fix commits (9593e16cf5 and 328a0f833d) added these classes to the SubTypeValidator blacklist, preventing their deserialization. These fixes were authored by Tatu Saloranta (upstream maintainer) and were already included in the upstream jackson-databind 2.17.1 release before TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T17:17:53.657243+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.1-tuxcare.4 is not affected by CVE-2019-16943. The vulnerability involves polymorphic deserialization of the P6DataSource gadget class when Default Typing is enabled. The upstream fix (commit 9593e16cf5 by Tatu Saloranta) added com.p6spy.engine.spy.P6DataSource to the deserialization blacklist in SubTypeValidator.java. This fix shipped in the upstream jackson-databind 2.17.1 release before TuxCare onboarded it (onboard commit d1a4eb5f86). The vulnerable pattern is not present in HEAD because the upstream vendor already removed it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "The target jackson-databind 2.17.1-tuxcare.4 is not affected by CVE-2019-16943. The vulnerability involves polymorphic deserialization of the P6DataSource gadget class when Default Typing is enabled. The upstream fix (commit 9593e16cf5 by Tatu Saloranta) added com.p6spy.engine.spy.P6DataSource to the deserialization blacklist in SubTypeValidator.java. This fix shipped in the upstream jackson-databind 2.17.1 release before TuxCare onboarded it (onboard commit d1a4eb5f86). The vulnerable pattern is not present in HEAD because the upstream vendor already removed it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:30:13.587550+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is not present in jackson-databind 2.17.1-tuxcare.4. The vulnerability involves polymorphic deserialization of the dangerous gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream vendor (FasterXML) fixed this in commit 191a4cdf87b (dated 2019-09-19) by adding the class to the SubTypeValidator blocklist. This fix was included in upstream release 2.10.0 and all subsequent versions. The target version 2.17.1 was onboarded by TuxCare with this fix already present from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 is not present in jackson-databind 2.17.1-tuxcare.4. The vulnerability involves polymorphic deserialization of the dangerous gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream vendor (FasterXML) fixed this in commit 191a4cdf87b (dated 2019-09-19) by adding the class to the SubTypeValidator blocklist. This fix was included in upstream release 2.10.0 and all subsequent versions. The target version 2.17.1 was onboarded by TuxCare with this fix already present from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:49:46.568438+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2019-17531. The vulnerability fix (adding org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource to the deserialization blocklist) was authored by upstream maintainer Tatu Saloranta in commit b5a304a9859 on 2019-10-12 and shipped in the upstream jackson-databind 2.17.1 release. When TuxCare onboarded version 2.17.1 (commit d1a4eb5f86c), the fix was already present. The blocklist in SubTypeValidator.java (lines 129-131) prevents deserialization of the two log4j-extras gadget classes, blocking the attack chain from malicious JSON payload to arbitrary code execution via JNDI lookup.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "The target jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2019-17531. The vulnerability fix (adding org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource to the deserialization blocklist) was authored by upstream maintainer Tatu Saloranta in commit b5a304a9859 on 2019-10-12 and shipped in the upstream jackson-databind 2.17.1 release. When TuxCare onboarded version 2.17.1 (commit d1a4eb5f86c), the fix was already present. The blocklist in SubTypeValidator.java (lines 129-131) prevents deserialization of the two log4j-extras gadget classes, blocking the attack chain from malicious JSON payload to arbitrary code execution via JNDI lookup.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability required blocking two ehcache JNDI selector classes (GenericJndiSelector and GlassfishSelector) to prevent deserialization-based JNDI injection attacks. The upstream vendor (Tatu Saloranta) added these classes to the SubTypeValidator blocklist in commit fc4214a883d (2019-11-01), which was already present in the upstream 2.17.1 release that TuxCare onboarded. The target version shipped with the fix already applied by upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability required blocking two ehcache JNDI selector classes (GenericJndiSelector and GlassfishSelector) to prevent deserialization-based JNDI injection attacks. The upstream vendor (Tatu Saloranta) added these classes to the SubTypeValidator blocklist in commit fc4214a883d (2019-11-01), which was already present in the upstream 2.17.1 release that TuxCare onboarded. The target version shipped with the fix already applied by upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T17:06:16.056250+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 does not affect jackson-databind 2.17.1-tuxcare.4. The vulnerability concerns unsafe deserialization of ignite-jta classes that could lead to arbitrary code execution via JNDI injection. The fix (commit a424c038ba from March 2020) was already present in the upstream jackson-databind 2.17.1 release that TuxCare onboarded. The target's SubTypeValidator.java contains the blocklist entries that prevent deserialization of the dangerous classes: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 does not affect jackson-databind 2.17.1-tuxcare.4. The vulnerability concerns unsafe deserialization of ignite-jta classes that could lead to arbitrary code execution via JNDI injection. The fix (commit a424c038ba from March 2020) was already present in the upstream jackson-databind 2.17.1 release that TuxCare onboarded. The target's SubTypeValidator.java contains the blocklist entries that prevent deserialization of the dangerous classes: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target (jackson-databind 2.17.1-tuxcare.4) is NOT affected by CVE-2020-10672. The vulnerability was fixed in the upstream release by adding org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory to the deserialization blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 592872f423, which was already present in the upstream 2.17.1 release that TuxCare onboarded (commit d1a4eb5f86).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "The target (jackson-databind 2.17.1-tuxcare.4) is NOT affected by CVE-2020-10672. The vulnerability was fixed in the upstream release by adding org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory to the deserialization blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 592872f423, which was already present in the upstream 2.17.1 release that TuxCare onboarded (commit d1a4eb5f86).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:30:36.061493+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.17.1-tuxcare.4) is not affected by CVE-2020-10673. The vulnerability pattern (missing blacklist entry for the deserialization gadget class com.caucho.config.types.ResourceRef) is not present because the fix was already included in the upstream release 2.17.1 that TuxCare onboarded. The fix adds the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing malicious deserialization attacks using this gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "The target repository (jackson-databind 2.17.1-tuxcare.4) is not affected by CVE-2020-10673. The vulnerability pattern (missing blacklist entry for the deserialization gadget class com.caucho.config.types.ResourceRef) is not present because the fix was already included in the upstream release 2.17.1 that TuxCare onboarded. The fix adds the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing malicious deserialization attacks using this gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2020-10968. The vulnerability involves deserialization gadgets related to org.aoju.bus.proxy.provider.remoting.RmiProvider that could enable arbitrary code execution via polymorphic deserialization. The upstream vendor (FasterXML) fixed this in commit 05d7e0e13f4 by adding the dangerous class names to a blocklist in SubTypeValidator.java. This fix was already present in version 2.17.1 when TuxCare onboarded it, so no backport was needed. The blocklist entries at lines 170-171 prevent instantiation of the RmiProvider gadget classes during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "The target jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2020-10968. The vulnerability involves deserialization gadgets related to org.aoju.bus.proxy.provider.remoting.RmiProvider that could enable arbitrary code execution via polymorphic deserialization. The upstream vendor (FasterXML) fixed this in commit 05d7e0e13f4 by adding the dangerous class names to a blocklist in SubTypeValidator.java. This fix was already present in version 2.17.1 when TuxCare onboarded it, so no backport was needed. The blocklist entries at lines 170-171 prevent instantiation of the RmiProvider gadget classes during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for javax.swing.JEditorPane, allowing polymorphic deserialization gadget attacks. The target version 2.17.1-tuxcare.4 already contains the upstream fix (commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60 by Tatu Saloranta on 2020-03-03) which added JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix shipped in the upstream 2.17.1 release before TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for javax.swing.JEditorPane, allowing polymorphic deserialization gadget attacks. The target version 2.17.1-tuxcare.4 already contains the upstream fix (commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60 by Tatu Saloranta on 2020-03-03) which added JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix shipped in the upstream 2.17.1 release before TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 does not affect this version. The vulnerability relates to unsafe deserialization of Apache ActiveMQ classes through Jackson's polymorphic type handling, which could lead to remote code execution. The fix, which adds nine ActiveMQ connection factory classes to the deserialization denylist in SubTypeValidator.java (lines 173-183), was already present in the upstream 2.17.1 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in commit c14c9f99ed0 on March 26, 2020, well before the 2.17.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 does not affect this version. The vulnerability relates to unsafe deserialization of Apache ActiveMQ classes through Jackson's polymorphic type handling, which could lead to remote code execution. The fix, which adds nine ActiveMQ connection factory classes to the deserialization denylist in SubTypeValidator.java (lines 173-183), was already present in the upstream 2.17.1 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in commit c14c9f99ed0 on March 26, 2020, well before the 2.17.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.17.1-tuxcare.4) contains the upstream fix that was shipped in version 2.17.1. The blocklist entry is present at SubTypeValidator.java:186, preventing deserialization of the dangerous RmiProvider class. The fix commit (05d7e0e13f) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.17.1-tuxcare.4) contains the upstream fix that was shipped in version 2.17.1. The blocklist entry is present at SubTypeValidator.java:186, preventing deserialization of the dangerous RmiProvider class. The fix commit (05d7e0e13f) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability relates to deserialization gadget chain exploitation via org.apache.openjpa.ee.WASRegistryManagedRuntime. The upstream fix (blocking this class in SubTypeValidator) was already included in the 2.17.1 release that TuxCare onboarded. The fix is present at SubTypeValidator.java:84 and actively prevents deserialization of the vulnerable class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability relates to deserialization gadget chain exploitation via org.apache.openjpa.ee.WASRegistryManagedRuntime. The upstream fix (blocking this class in SubTypeValidator) was already included in the 2.17.1 release that TuxCare onboarded. The fix is present at SubTypeValidator.java:84 and actively prevents deserialization of the vulnerable class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 due to unrestricted deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean, enabling gadget chain exploitation. The target version 2.17.1-tuxcare.4 is NOT AFFECTED because the upstream vendor (FasterXML) fixed this vulnerability in commit 113e89fb08 on April 6, 2020 by adding both classes to SubTypeValidator's blocklist (lines 53-54). This fix was included in upstream release 2.17.1, which TuxCare onboarded on September 20, 2026. The vulnerable code pattern (unrestricted deserialization of these Spring classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 due to unrestricted deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean, enabling gadget chain exploitation. The target version 2.17.1-tuxcare.4 is NOT AFFECTED because the upstream vendor (FasterXML) fixed this vulnerability in commit 113e89fb08 on April 6, 2020 by adding both classes to SubTypeValidator's blocklist (lines 53-54). This fix was included in upstream release 2.17.1, which TuxCare onboarded on September 20, 2026. The vulnerable code pattern (unrestricted deserialization of these Spring classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability concerns unsafe deserialization of org.apache.commons.jelly.impl.Embedded, which could lead to arbitrary code execution. The upstream fix (commit 77040d85e3) adds this class to SubTypeValidator's blocklist, preventing its deserialization. This fix was already present in upstream version 2.17.1 before TuxCare onboarded it, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (d1a4eb5f86). The target is not affected because the vulnerable pattern was never present in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability concerns unsafe deserialization of org.apache.commons.jelly.impl.Embedded, which could lead to arbitrary code execution. The upstream fix (commit 77040d85e3) adds this class to SubTypeValidator's blocklist, preventing its deserialization. This fix was already present in upstream version 2.17.1 before TuxCare onboarded it, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (d1a4eb5f86). The target is not affected because the vulnerable pattern was never present in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 and concerns deserialization gadgets related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version 2.17.1-tuxcare.4 is NOT vulnerable because the upstream fix (commit d1c67a0396 by Tatu Saloranta) was already included in the upstream release 2.17.1 before TuxCare onboarded it. The required blacklist entries are present in SubTypeValidator.java at lines 192-195, preventing deserialization of the dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 and concerns deserialization gadgets related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version 2.17.1-tuxcare.4 is NOT vulnerable because the upstream fix (commit d1c67a0396 by Tatu Saloranta) was already included in the upstream release 2.17.1 before TuxCare onboarded it. The required blacklist entries are present in SubTypeValidator.java at lines 192-195, preventing deserialization of the dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is not present in jackson-databind 2.17.1-tuxcare.4. The vulnerability concerns deserialization of Oracle JMS AQjms classes that could lead to remote code execution. The fix (adding five Oracle JMS classes to the deserialization blocklist in SubTypeValidator) was already present in the upstream release 2.17.1 that TuxCare onboarded, applied by upstream maintainer Tatu Saloranta in commit 5c8642aeae on April 24, 2020. The target version contains the complete defense, making it not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "CVE-2020-14061 is not present in jackson-databind 2.17.1-tuxcare.4. The vulnerability concerns deserialization of Oracle JMS AQjms classes that could lead to remote code execution. The fix (adding five Oracle JMS classes to the deserialization blocklist in SubTypeValidator) was already present in the upstream release 2.17.1 that TuxCare onboarded, applied by upstream maintainer Tatu Saloranta in commit 5c8642aeae on April 24, 2020. The target version contains the complete defense, making it not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.17.1-tuxcare.4 is NOT affected by CVE-2020-14062. The vulnerability involves JNDI gadget deserialization via com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The fix was already present in the upstream release 2.17.1 when TuxCare onboarded it. The vulnerable class is blacklisted in SubTypeValidator.java at line 119, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "The target jackson-databind version 2.17.1-tuxcare.4 is NOT affected by CVE-2020-14062. The vulnerability involves JNDI gadget deserialization via com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The fix was already present in the upstream release 2.17.1 when TuxCare onboarded it. The vulnerable class is blacklisted in SubTypeValidator.java at line 119, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is not present in jackson-databind 2.17.1. The vulnerability affects versions before 2.9.10.5 and involves the deserialization gadget class \"org.jsecurity.realm.jndi.JndiRealmFactory\". The target version 2.17.1 includes the upstream fix (commit f6d9c664f6, June 2020) that adds this class to the blocklist in SubTypeValidator.java at line 207. The fix was authored by upstream maintainer Tatu Saloranta and shipped with the upstream 2.17.1 release, predating TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 is not present in jackson-databind 2.17.1. The vulnerability affects versions before 2.9.10.5 and involves the deserialization gadget class \"org.jsecurity.realm.jndi.JndiRealmFactory\". The target version 2.17.1 includes the upstream fix (commit f6d9c664f6, June 2020) that adds this class to the blocklist in SubTypeValidator.java at line 207. The fix was authored by upstream maintainer Tatu Saloranta and shipped with the upstream 2.17.1 release, predating TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:21:16.269542+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2020-24616. The vulnerability involves deserialization of the dangerous gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The upstream fix (commit 3d97153944f7 by Tatu Saloranta) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream 2.17.1 release that TuxCare onboarded, as confirmed by verification that the fix commit predates the first TuxCare commit (d1a4eb5f86 \"Onboard version 2.17.1\" by amoniatovskiy@cloudlinux.com). The blocklist enforcement is active in the deserialization flow via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "The target jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2020-24616. The vulnerability involves deserialization of the dangerous gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The upstream fix (commit 3d97153944f7 by Tatu Saloranta) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream 2.17.1 release that TuxCare onboarded, as confirmed by verification that the fix commit predates the first TuxCare commit (d1a4eb5f86 \"Onboard version 2.17.1\" by amoniatovskiy@cloudlinux.com). The blocklist enforcement is active in the deserialization flow via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:16:55.064774+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2020-24750. The upstream fix that blocks deserialization of com.pastdev.httpcomponents.configuration.JndiConfiguration was already present in upstream release 2.17.1 (well above the 2.9.10.6 fix threshold) when TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:210, preventing the JNDI injection attack vector. Fix authored by upstream maintainer Tatu Saloranta, shipped in the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "Target version 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2020-24750. The upstream fix that blocks deserialization of com.pastdev.httpcomponents.configuration.JndiConfiguration was already present in upstream release 2.17.1 (well above the 2.9.10.6 fix threshold) when TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:210, preventing the JNDI injection attack vector. Fix authored by upstream maintainer Tatu Saloranta, shipped in the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2020-25649 (XXE vulnerability). The upstream vendor (FasterXML) fixed this vulnerability in commit 612f971b78c (Fix #2589) by adding two XML parser security features to DOMDeserializer.java: disallow-doctype-decl=true and load-external-dtd=false. This fix was already present in the upstream 2.17.1 release that TuxCare onboarded via commit d1a4eb5f86c by amoniatovskiy@cloudlinux.com. The vulnerable code pattern (unprotected XML parsing allowing external entity resolution) is not present in HEAD because it was fixed upstream before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "The target jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2020-25649 (XXE vulnerability). The upstream vendor (FasterXML) fixed this vulnerability in commit 612f971b78c (Fix #2589) by adding two XML parser security features to DOMDeserializer.java: disallow-doctype-decl=true and load-external-dtd=false. This fix was already present in the upstream 2.17.1 release that TuxCare onboarded via commit d1a4eb5f86c by amoniatovskiy@cloudlinux.com. The vulnerable code pattern (unprotected XML parsing allowing external entity resolution) is not present in HEAD because it was fixed upstream before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:22:15.181090+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.17.1-tuxcare.4) is NOT affected by CVE-2020-35490. The vulnerability involves deserialization gadgets via org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 41b8bdb5ccc by Tatu Saloranta, 2020-12-15) added these classes to the denylist in SubTypeValidator.java, blocking their deserialization. This fix was already present in upstream release 2.17.1, which TuxCare onboarded (commit d1a4eb5f86c, 2026). The defense is active by default and cannot be bypassed - it's a hard-coded security check in BeanDeserializerFactory that runs before any bean deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "The target repository (jackson-databind 2.17.1-tuxcare.4) is NOT affected by CVE-2020-35490. The vulnerability involves deserialization gadgets via org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 41b8bdb5ccc by Tatu Saloranta, 2020-12-15) added these classes to the denylist in SubTypeValidator.java, blocking their deserialization. This fix was already present in upstream release 2.17.1, which TuxCare onboarded (commit d1a4eb5f86c, 2026). The defense is active by default and cannot be bypassed - it's a hard-coded security check in BeanDeserializerFactory that runs before any bean deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T12:46:12.447284+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.17.1-tuxcare.3 is not affected by CVE-2020-35491. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource that could lead to remote code execution. The fix, which adds these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, was already present in the upstream version 2.17.1 before TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta in commit 41b8bdb5ccc on 2020-12-15, preventing these dangerous classes from being deserialized during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "The target repository jackson-databind version 2.17.1-tuxcare.3 is not affected by CVE-2020-35491. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource that could lead to remote code execution. The fix, which adds these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, was already present in the upstream version 2.17.1 before TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta in commit 41b8bdb5ccc on 2020-12-15, preventing these dangerous classes from being deserialized during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:55:19.903675+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is NOT present in jackson-databind 2.17.1. The fix that blocks deserialization of com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool was already included in the upstream 2.17.1 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:240, added by upstream commit 1ca0388c2fb authored by Tatu Saloranta on 2020-12-26, which predates the first TuxCare commit (d1a4eb5f86, \"Onboard version 2.17.1\"). The vulnerable deserialization gadget cannot be exploited in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "CVE-2020-35728 is NOT present in jackson-databind 2.17.1. The fix that blocks deserialization of com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool was already included in the upstream 2.17.1 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:240, added by upstream commit 1ca0388c2fb authored by Tatu Saloranta on 2020-12-26, which predates the first TuxCare commit (d1a4eb5f86, \"Onboard version 2.17.1\"). The vulnerable deserialization gadget cannot be exploited in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:24:51.671524+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is NOT present in jackson-databind 2.17.1. The vulnerability concerns missing blocklist entries for `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` and related gadget classes that could be exploited via polymorphic deserialization. The upstream fix (commit 3ded28aece from 2020-12-31 by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their instantiation during deserialization. This fix was already present in the upstream 2.17.1 release that TuxCare onboarded, so the target has never contained the vulnerable pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "CVE-2020-36179 is NOT present in jackson-databind 2.17.1. The vulnerability concerns missing blocklist entries for `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` and related gadget classes that could be exploited via polymorphic deserialization. The upstream fix (commit 3ded28aece from 2020-12-31 by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their instantiation during deserialization. This fix was already present in the upstream 2.17.1 release that TuxCare onboarded, so the target has never contained the vulnerable pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:37:53.137465+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability relates to deserialization gadgets in org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP classes. The fix (commit 3ded28aece from 2020-12-31 by upstream author Tatu Saloranta) was already included in the upstream release 2.17.1 that TuxCare onboarded. All five variants of DriverAdapterCPDS gadget classes are present in the SubTypeValidator blocklist, preventing their deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "CVE-2020-36180 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability relates to deserialization gadgets in org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP classes. The fix (commit 3ded28aece from 2020-12-31 by upstream author Tatu Saloranta) was already included in the upstream release 2.17.1 that TuxCare onboarded. All five variants of DriverAdapterCPDS gadget classes are present in the SubTypeValidator blocklist, preventing their deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:42:20.075693+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is NOT present in jackson-databind 2.17.1. The fix was already included in the upstream 2.17.1 release. The vulnerable class org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS is blocked in SubTypeValidator.java line 228, preventing deserialization gadget attacks. Fix commit 3ded28aece by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) was part of the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 is NOT present in jackson-databind 2.17.1. The fix was already included in the upstream 2.17.1 release. The vulnerable class org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS is blocked in SubTypeValidator.java line 228, preventing deserialization gadget attacks. Fix commit 3ded28aece by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) was part of the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:13:29.562378+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 affects jackson-databind versions before 2.9.10.8, allowing deserialization of dangerous DriverAdapterCPDS gadget classes. The target version 2.17.1-tuxcare.4 is not affected because the upstream fix (commit 3ded28aece) was already present in the 2.17.1 release when TuxCare onboarded it. All 5 DriverAdapterCPDS class variants are blocklisted in SubTypeValidator.java and actively enforced during deserialization, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "CVE-2020-36182 affects jackson-databind versions before 2.9.10.8, allowing deserialization of dangerous DriverAdapterCPDS gadget classes. The target version 2.17.1-tuxcare.4 is not affected because the upstream fix (commit 3ded28aece) was already present in the 2.17.1 release when TuxCare onboarded it. All 5 DriverAdapterCPDS class variants are blocklisted in SubTypeValidator.java and actively enforced during deserialization, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:21:27.770551+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability involves missing blocklist entry for the gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, which enables remote code execution via JNDI injection during polymorphic deserialization. The target contains the fix at SubTypeValidator.java:243, installed by upstream commit 12e23c962f (author: tatu.saloranta@iki.fi, tag: jackson-databind-2.9.10.8). This fix was already present in upstream version 2.17.1 before TuxCare onboarded it (first TuxCare commit: d1a4eb5f86 \"Onboard version 2.17.1\"). The CVE affects versions before 2.9.10.8; the target is 2.17.1, which is significantly newer and shipped with the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "CVE-2020-36183 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability involves missing blocklist entry for the gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, which enables remote code execution via JNDI injection during polymorphic deserialization. The target contains the fix at SubTypeValidator.java:243, installed by upstream commit 12e23c962f (author: tatu.saloranta@iki.fi, tag: jackson-databind-2.9.10.8). This fix was already present in upstream version 2.17.1 before TuxCare onboarded it (first TuxCare commit: d1a4eb5f86 \"Onboard version 2.17.1\"). The CVE affects versions before 2.9.10.8; the target is 2.17.1, which is significantly newer and shipped with the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T12:28:48.622691+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.17.1-tuxcare.3. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes (PerUserPoolDataSource and SharedPoolDataSource) that could enable arbitrary code execution. The upstream fix (commit 567194c53a by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in upstream jackson-databind 2.17.1 when TuxCare onboarded it (first TuxCare commit: d1a4eb5f86 \"Onboard version 2.17.1\"). The target version is not affected because the vulnerable code pattern does not exist - the defense mechanism blocks deserialization attempts for these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.17.1-tuxcare.3. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes (PerUserPoolDataSource and SharedPoolDataSource) that could enable arbitrary code execution. The upstream fix (commit 567194c53a by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in upstream jackson-databind 2.17.1 when TuxCare onboarded it (first TuxCare commit: d1a4eb5f86 \"Onboard version 2.17.1\"). The target version is not affected because the vulnerable code pattern does not exist - the defense mechanism blocks deserialization attempts for these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:07:05.916705+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.17.1-tuxcare.4 is not affected by CVE-2020-36185. The upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) that adds org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist was already present in the upstream 2.17.1 release. The blocklist entries exist at SubTypeValidator.java:235-236 and are actively enforced during type validation to prevent deserialization of these gadget classes, blocking the attack chain from INPUT (JSON with polymorphic type info) to GOAL (unauthorized operations via gadget deserialization).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "Target version 2.17.1-tuxcare.4 is not affected by CVE-2020-36185. The upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) that adds org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist was already present in the upstream 2.17.1 release. The blocklist entries exist at SubTypeValidator.java:235-236 and are actively enforced during type validation to prevent deserialization of these gadget classes, blocking the attack chain from INPUT (JSON with polymorphic type info) to GOAL (unauthorized operations via gadget deserialization).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:34:24.934920+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2020-36186. The vulnerability involves polymorphic deserialization gadgets (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource) that could enable arbitrary code execution. The upstream fix added these classes to the SubTypeValidator blocklist in commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 (Dec 2020, released in 2.9.10.8). The target version 2.17.1 already contains this fix as it was shipped in the upstream release before TuxCare onboarded version 2.17.1 (onboarding commit d1a4eb5f86). The blocklist entries are present at lines 229-230 of SubTypeValidator.java and are enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "The target jackson-databind version 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2020-36186. The vulnerability involves polymorphic deserialization gadgets (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource) that could enable arbitrary code execution. The upstream fix added these classes to the SubTypeValidator blocklist in commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 (Dec 2020, released in 2.9.10.8). The target version 2.17.1 already contains this fix as it was shipped in the upstream release before TuxCare onboarded version 2.17.1 (onboarding commit d1a4eb5f86). The blocklist entries are present at lines 229-230 of SubTypeValidator.java and are enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:47:05.724799+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 addresses a Jackson deserialization gadget vulnerability related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. The target repository (jackson-databind 2.17.1-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream release 2.17.1 that TuxCare onboarded. The vulnerable class is blocked by the SubTypeValidator blacklist at line 230, preventing its deserialization. The fix was authored by upstream maintainer Tatu Saloranta in commit 3e8fa3beea4 on 2020-12-26, well before the 2.17.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "CVE-2020-36187 addresses a Jackson deserialization gadget vulnerability related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. The target repository (jackson-databind 2.17.1-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream release 2.17.1 that TuxCare onboarded. The vulnerable class is blocked by the SubTypeValidator blacklist at line 230, preventing its deserialization. The fix was authored by upstream maintainer Tatu Saloranta in commit 3e8fa3beea4 on 2020-12-26, well before the 2.17.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:52:50.541440+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188: Target jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED. The vulnerability involves JNDI injection via deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource gadget classes. The fix (blocking these classes in SubTypeValidator) was already present in the upstream release 2.17.1 before TuxCare onboarding. The blocklist prevents these classes from being deserialized, blocking the attack chain from JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188: Target jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED. The vulnerability involves JNDI injection via deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource gadget classes. The fix (blocking these classes in SubTypeValidator) was already present in the upstream release 2.17.1 before TuxCare onboarding. The blocklist prevents these classes from being deserialized, blocking the attack chain from JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T13:03:12.649222+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is not present in jackson-databind 2.17.1-tuxcare.3. The vulnerability concerns deserialization gadgets related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. The upstream fix (commit 33d96c13fe by Tatu Saloranta) added these class names to the deserialization blocklist in SubTypeValidator.java and was already included in the upstream 2.17.1 release that TuxCare onboarded. The fix is present in the target at lines 221-224 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 is not present in jackson-databind 2.17.1-tuxcare.3. The vulnerability concerns deserialization gadgets related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. The upstream fix (commit 33d96c13fe by Tatu Saloranta) added these class names to the deserialization blocklist in SubTypeValidator.java and was already included in the upstream 2.17.1 release that TuxCare onboarded. The fix is present in the target at lines 221-224 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:16:13.721778+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.17.1-tuxcare.4. The upstream release already contains the fix (commit 8238ab41d0) which replaced the vulnerable recursive deserialization implementation with a non-recursive iterative approach (UntypedObjectDeserializerNR). This eliminates the stack overflow vulnerability by using heap-allocated Scope objects instead of recursive method calls. The fix was shipped in the upstream 2.17.1 release, prior to TuxCare's onboarding (commit d1a4eb5f86).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.17.1-tuxcare.4. The upstream release already contains the fix (commit 8238ab41d0) which replaced the vulnerable recursive deserialization implementation with a non-recursive iterative approach (UntypedObjectDeserializerNR). This eliminates the stack overflow vulnerability by using heap-allocated Scope objects instead of recursive method calls. The fix was shipped in the upstream 2.17.1 release, prior to TuxCare's onboarding (commit d1a4eb5f86).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:12:27.199890+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability requires the ability to deserialize org.apache.xbean.propertyeditor.JndiConverter, which enables JNDI-based remote code execution. The target repository contains the upstream fix (blocklist entry for JndiConverter) that was authored by Tatu Saloranta and shipped in the upstream 2.17.1 release before TuxCare onboarding. The fix is enforced via SubTypeValidator.validateSubType() called from BeanDeserializerFactory, preventing deserialization of the dangerous class with error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 is NOT present in jackson-databind 2.17.1-tuxcare.4. The vulnerability requires the ability to deserialize org.apache.xbean.propertyeditor.JndiConverter, which enables JNDI-based remote code execution. The target repository contains the upstream fix (blocklist entry for JndiConverter) that was authored by Tatu Saloranta and shipped in the upstream 2.17.1 release before TuxCare onboarding. The fix is enforced via SubTypeValidator.validateSubType() called from BeanDeserializerFactory, preventing deserialization of the dangerous class with error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is not present in jackson-databind 2.17.1. The vulnerability concerns deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The upstream vendor (FasterXML) added this class to the SubTypeValidator blocklist in commit 9f4e97019fb (Feb 29, 2020) as part of version 2.9.10.4. Since the target is version 2.17.1 (released much later), this fix was already present in the upstream release that TuxCare onboarded. The blocklist entry at SubTypeValidator.java:141 prevents deserialization of the dangerous gadget class, blocking the attack chain from JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 is not present in jackson-databind 2.17.1. The vulnerability concerns deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The upstream vendor (FasterXML) added this class to the SubTypeValidator blocklist in commit 9f4e97019fb (Feb 29, 2020) as part of version 2.9.10.4. Since the target is version 2.17.1 (released much later), this fix was already present in the upstream release that TuxCare onboarded. The blocklist entry at SubTypeValidator.java:141 prevents deserialization of the dangerous gadget class, blocking the attack chain from JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:43:13.146994+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is not present in jackson-databind 2.17.1-tuxcare.4. The upstream vendor fix (commit 9f4e97019fb by Tatu Saloranta, 2020-02-29) that blocks deserialization of com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig is already present at SubTypeValidator.java:144. This fix shipped in the upstream release 2.17.1 before TuxCare onboarded it, as confirmed by ancestry analysis showing the fix commit predates the first TuxCare commit d1a4eb5f86. The defense mechanism in validateSubType() checks all deserialization requests against the DEFAULT_NO_DESER_CLASS_NAMES blocklist and throws an exception (line 302-303) when the gadget class is detected, preventing the deserialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 is not present in jackson-databind 2.17.1-tuxcare.4. The upstream vendor fix (commit 9f4e97019fb by Tatu Saloranta, 2020-02-29) that blocks deserialization of com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig is already present at SubTypeValidator.java:144. This fix shipped in the upstream release 2.17.1 before TuxCare onboarded it, as confirmed by ancestry analysis showing the fix commit predates the first TuxCare commit d1a4eb5f86. The defense mechanism in validateSubType() checks all deserialization requests against the DEFAULT_NO_DESER_CLASS_NAMES blocklist and throws an exception (line 302-303) when the gadget class is detected, preventing the deserialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:17:47.656427+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 addresses a deserialization gadget vulnerability in jackson-databind related to br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.17.1-tuxcare.4) is NOT AFFECTED because the upstream fix was already present in version 2.17.1 when TuxCare onboarded it. The vulnerable class is blocklisted in SubTypeValidator.java at line 145, added by upstream commit 9f4e97019fb (author: tatu.saloranta@iki.fi) on 2020-02-29. This commit is an ancestor of TuxCare's first commit d1a4eb5f86 \"Onboard version 2.17.1\", confirming the fix shipped in the upstream release. The CVE affects versions \"before 2.9.10.4, 2.8.11.6, and 2.7.9.7\" \u2014 all much older than 2.17.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 addresses a deserialization gadget vulnerability in jackson-databind related to br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.17.1-tuxcare.4) is NOT AFFECTED because the upstream fix was already present in version 2.17.1 when TuxCare onboarded it. The vulnerable class is blocklisted in SubTypeValidator.java at line 145, added by upstream commit 9f4e97019fb (author: tatu.saloranta@iki.fi) on 2020-02-29. This commit is an ancestor of TuxCare's first commit d1a4eb5f86 \"Onboard version 2.17.1\", confirming the fix shipped in the upstream release. The CVE affects versions \"before 2.9.10.4, 2.8.11.6, and 2.7.9.7\" \u2014 all much older than 2.17.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T15:15:32.499277+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2021-20190. The vulnerability required adding javax.swing.JTextPane to the deserialization blocklist. This fix was already present in the upstream jackson-databind 2.17.1 release, authored by Tatu Saloranta (upstream maintainer) in commit 7dbf51bf78. When TuxCare onboarded version 2.17.1, the fix came with it. The vulnerable code pattern (missing JTextPane in the blocklist) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "The target repository jackson-databind 2.17.1-tuxcare.4 is NOT AFFECTED by CVE-2021-20190. The vulnerability required adding javax.swing.JTextPane to the deserialization blocklist. This fix was already present in the upstream jackson-databind 2.17.1 release, authored by Tatu Saloranta (upstream maintainer) in commit 7dbf51bf78. When TuxCare onboarded version 2.17.1, the fix came with it. The vulnerable code pattern (missing JTextPane in the blocklist) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 affects jackson-databind versions 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1. The target version 2.17.1-tuxcare.4 is NOT affected. The upstream vendor fix (commit 3ccde7d938 by Tatu Saloranta, FasterXML maintainer) was already present in the upstream 2.17.1 release when TuxCare onboarded it. The vulnerable code pattern (unbounded allocation of byte[len] trusting attacker-controlled length) does not exist in HEAD. The fix (LONGEST_EAGER_ALLOC=100KB limit with incremental allocation via ByteArrayBuilder) is present in NodeSerialization.java lines 18 and 56-84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "CVE-2021-46877 affects jackson-databind versions 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1. The target version 2.17.1-tuxcare.4 is NOT affected. The upstream vendor fix (commit 3ccde7d938 by Tatu Saloranta, FasterXML maintainer) was already present in the upstream 2.17.1 release when TuxCare onboarded it. The vulnerable code pattern (unbounded allocation of byte[len] trusting attacker-controlled length) does not exist in HEAD. The fix (LONGEST_EAGER_ALLOC=100KB limit with incremental allocation via ByteArrayBuilder) is present in NodeSerialization.java lines 18 and 56-84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T16:46:51.408476+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.17.1-tuxcare.4 is not affected by CVE-2022-42003. The vulnerability (resource exhaustion via deep wrapper array nesting when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream version 2.14.0 by commit d78d00ee (author: tatu.saloranta@iki.fi). Since the target is based on upstream 2.17.1 (released after 2.14.0), the fix was already present in the onboarded upstream release. The defense mechanism (handleNestedArrayForSingle method and checks in all primitive deserializers) is confirmed present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "Target jackson-databind 2.17.1-tuxcare.4 is not affected by CVE-2022-42003. The vulnerability (resource exhaustion via deep wrapper array nesting when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream version 2.14.0 by commit d78d00ee (author: tatu.saloranta@iki.fi). Since the target is based on upstream 2.17.1 (released after 2.14.0), the fix was already present in the onboarded upstream release. The defense mechanism (handleNestedArrayForSingle method and checks in all primitive deserializers) is confirmed present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T14:59:04.617737+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 affects jackson-databind versions before 2.12.7.1 and 2.13.x before 2.13.4. The target is version 2.17.1-tuxcare.4, which already contains the upstream fix (commit 06318358) by Tatu Saloranta from August 2022. The fix adds a check in BeanDeserializer._deserializeFromArray() to reject deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, preventing resource exhaustion. This fix was shipped in the upstream 2.17.1 release before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "CVE-2022-42004 affects jackson-databind versions before 2.12.7.1 and 2.13.x before 2.13.4. The target is version 2.17.1-tuxcare.4, which already contains the upstream fix (commit 06318358) by Tatu Saloranta from August 2022. The fix adds a check in BeanDeserializer._deserializeFromArray() to reject deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, preventing resource exhaustion. This fix was shipped in the upstream 2.17.1 release before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-02T20:19:31.303832+00:00", "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 affects jackson-databind versions before 2.14.0. The vulnerability involves StackOverflowError/DoS when serializing deeply nested JsonNode structures via toString(). The fix (commit a1fa4ae4ec) replaced recursive serialization with iterative serialization using an explicit IteratorStack. This fix was authored by upstream maintainer Tatu Saloranta and was already included in upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50193" }, "impact_statement": "not_affected \u2014 CVE-2026-50193 affects jackson-databind versions before 2.14.0. The vulnerability involves StackOverflowError/DoS when serializing deeply nested JsonNode structures via toString(). The fix (commit a1fa4ae4ec) replaced recursive serialization with iterative serialization using an explicit IteratorStack. This fix was authored by upstream maintainer Tatu Saloranta and was already included in upstr..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-03T02:09:41.366702+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.17.1 is not affected by CVE-2026-54518. The vulnerability concerns @JsonView bypass for unwrapped creator parameters in UnwrappedPropertyHandler.processUnwrappedCreatorProperties(), but this feature does not exist in version 2.17.1. The version explicitly rejects @JsonUnwrapped on creator parameters as \"combination not yet supported\" (databind#265), and the vulnerable method pr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Target version 2.17.1 is not affected by CVE-2026-54518. The vulnerability concerns @JsonView bypass for unwrapped creator parameters in UnwrappedPropertyHandler.processUnwrappedCreatorProperties(), but this feature does not exist in version 2.17.1. The version explicitly rejects @JsonUnwrapped on creator parameters as \"combination not yet supported\" (databind#265), and the vulnerable method pr..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59888" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:31:00.115665+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:31:00.115665+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.17.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1-tuxcare.4" } } ], "timestamp": "2026-11-01T12:30:16.616704+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.17.1-tuxcare.4.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }