{ "@id": "urn:uuid:4aad1f3b-3e8d-4579-b0b9-6b5e298f929f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 64, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T10:44:15.465982+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:07:28.836714+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.18.2 already contains the upstream fix introduced in commit ddfddfba64 (Aug 17, 2017) by Tatu Saloranta. The SubTypeValidator class implements a comprehensive blacklist preventing deserialization of dangerous classes including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, and many others added for CVE-2017-15095. This fix was already present in the upstream release when TuxCare onboarded version 2.18.2 (commit 5c4f320f9d). The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.18.2 already contains the upstream fix introduced in commit ddfddfba64 (Aug 17, 2017) by Tatu Saloranta. The SubTypeValidator class implements a comprehensive blacklist preventing deserialization of dangerous classes including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, and many others added for CVE-2017-15095. This fix was already present in the upstream release when TuxCare onboarded version 2.18.2 (commit 5c4f320f9d). The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:42:44.997491+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.2-tuxcare.2 is not affected by CVE-2017-17485. The vulnerability required extended blacklist validation for dangerous deserialization gadget classes (Spring framework types, JDK classes like FileHandler/UnicastRemoteObject, C3P0, Tomcat DBCP, BCEL ClassLoader) plus sophisticated Spring class hierarchy checking. All these fixes (databind#1737 and databind#1855 from December 2017) were already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded. Fix commits e865a7a446 and 2235894210 (authored by upstream developers Andrew Tolbert and Tatu Saloranta) are ancestors of the first TuxCare onboarding commit, confirming the fixes shipped with the upstream release. SubTypeValidator.java contains all required defenses including blacklist entries and hierarchy checks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "Target jackson-databind 2.18.2-tuxcare.2 is not affected by CVE-2017-17485. The vulnerability required extended blacklist validation for dangerous deserialization gadget classes (Spring framework types, JDK classes like FileHandler/UnicastRemoteObject, C3P0, Tomcat DBCP, BCEL ClassLoader) plus sophisticated Spring class hierarchy checking. All these fixes (databind#1737 and databind#1855 from December 2017) were already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded. Fix commits e865a7a446 and 2235894210 (authored by upstream developers Andrew Tolbert and Tatu Saloranta) are ancestors of the first TuxCare onboarding commit, confirming the fixes shipped with the upstream release. SubTypeValidator.java contains all required defenses including blacklist entries and hierarchy checks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:26:13.547967+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.18.2-tuxcare.2 is not affected by CVE-2017-7525. The vulnerability was fixed in upstream jackson-databind versions 2.6.7.1, 2.7.9.1, and 2.8.9. The target version (2.18.2) is significantly newer and contains the comprehensive SubTypeValidator protection that blocks deserialization of dangerous classes including TemplatesImpl, InvokerTransformer, and 100+ other gadget classes. The fix was present in the upstream release before TuxCare onboarded version 2.18.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "Target version 2.18.2-tuxcare.2 is not affected by CVE-2017-7525. The vulnerability was fixed in upstream jackson-databind versions 2.6.7.1, 2.7.9.1, and 2.8.9. The target version (2.18.2) is significantly newer and contains the comprehensive SubTypeValidator protection that blocks deserialization of dangerous classes including TemplatesImpl, InvokerTransformer, and 100+ other gadget classes. The fix was present in the upstream release before TuxCare onboarded version 2.18.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:16:19.686333+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 concerns deserialization of the iBatis gadget class org.apache.ibatis.parsing.XPathParser with Jackson default typing, enabling data exfiltration. The target jackson-databind 2.18.2-tuxcare.2 is NOT affected because the upstream fix (adding XPathParser to the deserialization blacklist in SubTypeValidator) was already present in the upstream 2.18.2 release before TuxCare onboarded it. The blacklist entry exists at line 65 of SubTypeValidator.java, and the validation logic at lines 269-303 properly blocks deserialization of this gadget class, preventing the attack chain from reaching the goal (data exfiltration).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 concerns deserialization of the iBatis gadget class org.apache.ibatis.parsing.XPathParser with Jackson default typing, enabling data exfiltration. The target jackson-databind 2.18.2-tuxcare.2 is NOT affected because the upstream fix (adding XPathParser to the deserialization blacklist in SubTypeValidator) was already present in the upstream 2.18.2 release before TuxCare onboarded it. The blacklist entry exists at line 65 of SubTypeValidator.java, and the validation logic at lines 269-303 properly blocks deserialization of this gadget class, preventing the attack chain from reaching the goal (data exfiltration).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T17:17:09.184138+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target is version 2.18.2-tuxcare.3, which contains the upstream vendor's fix that blacklists the Jodd-db gadget class (jodd.db.connection.DataSourceConnectionProvider) along with Oracle JDBC classes. The fix was applied by upstream maintainer Tatu Saloranta in May 2018 (commit 7487cf7eb1) and was already present in version 2.18.2 when TuxCare onboarded it in September 2026. The vulnerable code pattern (absence of blacklist entries) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target is version 2.18.2-tuxcare.3, which contains the upstream vendor's fix that blacklists the Jodd-db gadget class (jodd.db.connection.DataSourceConnectionProvider) along with Oracle JDBC classes. The fix was applied by upstream maintainer Tatu Saloranta in May 2018 (commit 7487cf7eb1) and was already present in version 2.18.2 when TuxCare onboarded it in September 2026. The vulnerable code pattern (absence of blacklist entries) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:19:28.543087+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is not present in jackson-databind 2.18.2-tuxcare.2. The vulnerability concerns polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that enable JNDI/LDAP-based remote code execution when Default Typing is enabled. The upstream vendor (FasterXML) fixed this vulnerability by adding these Oracle JDBC classes to the SubTypeValidator blocklist in commit 28badf7ef6, which was already present in upstream release 2.18.2 before TuxCare onboarded it. The target repository contains this fix at SubTypeValidator.java lines 70-72, where both Oracle JDBC gadget classes are blocklisted and cannot be deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is not present in jackson-databind 2.18.2-tuxcare.2. The vulnerability concerns polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that enable JNDI/LDAP-based remote code execution when Default Typing is enabled. The upstream vendor (FasterXML) fixed this vulnerability by adding these Oracle JDBC classes to the SubTypeValidator blocklist in commit 28badf7ef6, which was already present in upstream release 2.18.2 before TuxCare onboarded it. The target repository contains this fix at SubTypeValidator.java lines 70-72, where both Oracle JDBC gadget classes are blocklisted and cannot be deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:46:23.146908+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.18.2-tuxcare.2. The vulnerability allowed arbitrary code execution via polymorphic deserialization of org.slf4j.ext.EventData. The upstream vendor (FasterXML) fixed this in commit 87d29af25e by adding org.slf4j.ext.EventData to the deserialization blocklist in SubTypeValidator. This fix was already included in upstream release 2.18.2, which TuxCare onboarded via commit 5c4f320f9d. The blocklist entry exists at SubTypeValidator.java:75 and is actively enforced by BeanDeserializerFactory._validateSubType() during all polymorphic deserialization operations. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.18.2-tuxcare.2. The vulnerability allowed arbitrary code execution via polymorphic deserialization of org.slf4j.ext.EventData. The upstream vendor (FasterXML) fixed this in commit 87d29af25e by adding org.slf4j.ext.EventData to the deserialization blocklist in SubTypeValidator. This fix was already included in upstream release 2.18.2, which TuxCare onboarded via commit 5c4f320f9d. The blocklist entry exists at SubTypeValidator.java:75 and is actively enforced by BeanDeserializerFactory._validateSubType() during all polymorphic deserialization operations. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:58:58.868131+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 due to missing blocklist entries for BlazeDS gadget classes (flex.messaging.*) that enable arbitrary code execution via polymorphic deserialization. The target version 2.18.2-tuxcare.2 is NOT affected because the upstream fix (commit 87d29af25e by Tatu Saloranta) was already included in the upstream 2.18.2 release that TuxCare onboarded. The fix adds flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 due to missing blocklist entries for BlazeDS gadget classes (flex.messaging.*) that enable arbitrary code execution via polymorphic deserialization. The target version 2.18.2-tuxcare.2 is NOT affected because the upstream fix (commit 87d29af25e by Tatu Saloranta) was already included in the upstream 2.18.2 release that TuxCare onboarded. The fix adds flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:07:13.542936+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.2-tuxcare.2 is NOT AFFECTED by CVE-2018-14720. The vulnerability affected versions before 2.9.7, allowing XXE attacks through polymorphic deserialization of dangerous classes. The upstream fix (commit 87d29af25e by Tatu Saloranta) added four classes to the deserialization blacklist: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. This fix was already present in upstream 2.18.2 when TuxCare onboarded it (commit 5c4f320f9). The blacklist is enforced by SubTypeValidator.validateSubType() which is called on all bean deserialization paths. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "Target jackson-databind 2.18.2-tuxcare.2 is NOT AFFECTED by CVE-2018-14720. The vulnerability affected versions before 2.9.7, allowing XXE attacks through polymorphic deserialization of dangerous classes. The upstream fix (commit 87d29af25e by Tatu Saloranta) added four classes to the deserialization blacklist: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. This fix was already present in upstream 2.18.2 when TuxCare onboarded it (commit 5c4f320f9). The blacklist is enforced by SubTypeValidator.validateSubType() which is called on all bean deserialization paths. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:35:16.615188+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.2-tuxcare.2 already contains the upstream fix for CVE-2018-14721. The dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl is blocked from polymorphic deserialization via the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix (commit 87d29af) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.18.2 that TuxCare onboarded, preventing SSRF attacks through axis2-jaxws deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "The target jackson-databind 2.18.2-tuxcare.2 already contains the upstream fix for CVE-2018-14721. The dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl is blocked from polymorphic deserialization via the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix (commit 87d29af) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.18.2 that TuxCare onboarded, preventing SSRF attacks through axis2-jaxws deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:45:34.333226+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.2 is not affected by CVE-2018-19360. The vulnerability (failure to block org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization) was fixed in upstream commit 72cd4025a2 (Nov 2018) by adding the class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix shipped in upstream release 2.9.8 and was already present when TuxCare onboarded version 2.18.2 in Sept 2026. The blocklist validation is enforced during bean deserializer creation via BeanDeserializerFactory._validateSubType() and cannot be bypassed through crafted JSON.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "The target jackson-databind 2.18.2 is not affected by CVE-2018-19360. The vulnerability (failure to block org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization) was fixed in upstream commit 72cd4025a2 (Nov 2018) by adding the class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix shipped in upstream release 2.9.8 and was already present when TuxCare onboarded version 2.18.2 in Sept 2026. The blocklist validation is enforced during bean deserializer creation via BeanDeserializerFactory._validateSubType() and cannot be bypassed through crafted JSON.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:55:18.943377+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is NOT present in jackson-databind 2.18.2. The vulnerability was fixed in the upstream release by adding openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) to the SubTypeValidator blocklist, preventing their polymorphic deserialization. The fix commit (72cd4025a2) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.18.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 is NOT present in jackson-databind 2.18.2. The vulnerability was fixed in the upstream release by adding openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) to the SubTypeValidator blocklist, preventing their polymorphic deserialization. The fix commit (72cd4025a2) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.18.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:24:04.222754+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT affecting jackson-databind 2.18.2-tuxcare.2. The vulnerability concerns polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The fix blocking this class was added by upstream maintainer Tatu Saloranta in commit 72cd4025a22 (2018-11-19) and was already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded. The target's SubTypeValidator.java line 81 contains the blocklist entry preventing deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 is NOT affecting jackson-databind 2.18.2-tuxcare.2. The vulnerability concerns polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The fix blocking this class was added by upstream maintainer Tatu Saloranta in commit 72cd4025a22 (2018-11-19) and was already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded. The target's SubTypeValidator.java line 81 contains the blocklist entry preventing deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.18.2-tuxcare.3. The vulnerability involves two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist in older versions. The fix adds these two class names to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. The target already contains this fix at lines 62-63, added by upstream commit 038b471e2e authored by Tatu Saloranta on 2018-01-21. This fix was included in the upstream release 2.18.2 that TuxCare onboarded (first TuxCare commit 5c4f320f9d \"Onboard version 2.18.2\"). The blacklist validation is actively enforced via BeanDeserializerFactory._validateSubType() during polymorphic deserialization, blocking instantiation of the gadget classes with a security exception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.18.2-tuxcare.3. The vulnerability involves two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist in older versions. The fix adds these two class names to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. The target already contains this fix at lines 62-63, added by upstream commit 038b471e2e authored by Tatu Saloranta on 2018-01-21. This fix was included in the upstream release 2.18.2 that TuxCare onboarded (first TuxCare commit 5c4f320f9d \"Onboard version 2.18.2\"). The blacklist validation is actively enforced via BeanDeserializerFactory._validateSubType() during polymorphic deserialization, blocking instantiation of the gadget classes with a security exception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:43:26.013143+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 affects jackson-databind versions before 2.7.9.3, 2.8.11.1, and 2.9.5 (February 2018). The target is version 2.18.2-tuxcare.2, which is significantly newer. The upstream fix (commit 6799f8f10c by Tatu Saloranta, dated 2018-02-10) was already present in the upstream 2.18.2 release when TuxCare onboarded it (commit 5c4f320f9d). The fix in SubTypeValidator.java (lines 288-297) blocks deserialization of any com.mchange.v2.c3p0.* class ending with DataSource, preventing the RCE exploitation path. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 affects jackson-databind versions before 2.7.9.3, 2.8.11.1, and 2.9.5 (February 2018). The target is version 2.18.2-tuxcare.2, which is significantly newer. The upstream fix (commit 6799f8f10c by Tatu Saloranta, dated 2018-02-10) was already present in the upstream 2.18.2 release when TuxCare onboarded it (commit 5c4f320f9d). The fix in SubTypeValidator.java (lines 288-297) blocks deserialization of any com.mchange.v2.c3p0.* class ending with DataSource, preventing the RCE exploitation path. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:31:30.745035+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target repository version 2.18.2 is NOT AFFECTED by CVE-2019-12086. The vulnerability requires the absence of validation for com.mysql.cj.jdbc.admin.MiniAdmin in the SubTypeValidator blacklist. The target already contains the fix at line 88 of SubTypeValidator.java, which blocks deserialization of the MiniAdmin gadget class. This fix was introduced by upstream Jackson maintainer Tatu Saloranta in commit dda513bd7251b4f32b7b60b1c13740e3b5a43024 and was already present in the upstream 2.18.2 release when TuxCare onboarded it via commit 5c4f320f9daf1e6dc27db563564e616ce918c4b5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "Target repository version 2.18.2 is NOT AFFECTED by CVE-2019-12086. The vulnerability requires the absence of validation for com.mysql.cj.jdbc.admin.MiniAdmin in the SubTypeValidator blacklist. The target already contains the fix at line 88 of SubTypeValidator.java, which blocks deserialization of the MiniAdmin gadget class. This fix was introduced by upstream Jackson maintainer Tatu Saloranta in commit dda513bd7251b4f32b7b60b1c13740e3b5a43024 and was already present in the upstream 2.18.2 release when TuxCare onboarded it via commit 5c4f320f9daf1e6dc27db563564e616ce918c4b5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to unsafe polymorphic deserialization of logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource. The target repository is version 2.18.2-tuxcare.2, which already contains the upstream fix from commit c9ef4a10d6. The fix adds the vulnerable class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to unsafe polymorphic deserialization of logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource. The target repository is version 2.18.2-tuxcare.2, which already contains the upstream fix from commit c9ef4a10d6. The fix adds the vulnerable class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target jackson-databind 2.18.2-tuxcare.2 is not affected by CVE-2019-12814. The vulnerability enables arbitrary file reading via JDOM XSLTransformer gadget deserialization when Default Typing is enabled. The upstream vendor (FasterXML) fixed this by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to SubTypeValidator's deserialization blocklist in commit 5f7c69bba...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 Target jackson-databind 2.18.2-tuxcare.2 is not affected by CVE-2019-12814. The vulnerability enables arbitrary file reading via JDOM XSLTransformer gadget deserialization when Default Typing is enabled. The upstream vendor (FasterXML) fixed this by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to SubTypeValidator's deserialization blocklist in commit 5f7c69bba..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:06:46.571739+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.2-tuxcare.1) is NOT affected by CVE-2019-14379. The vulnerability involved unsafe deserialization of the ehcache class `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` which could lead to remote code execution. The fix, which blacklists this dangerous class in SubTypeValidator.java, is present in the target at line 98. This fix was authored by upstream maintainer Tatu Saloranta and was already included in the upstream 2.18.2 release that TuxCare onboarded. The SubTypeValidator is actively enforced during bean deserialization (verified in BeanDeserializerFactory), ensuring the blacklist prevents exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "The target repository (jackson-databind 2.18.2-tuxcare.1) is NOT affected by CVE-2019-14379. The vulnerability involved unsafe deserialization of the ehcache class `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` which could lead to remote code execution. The fix, which blacklists this dangerous class in SubTypeValidator.java, is present in the target at line 98. This fix was authored by upstream maintainer Tatu Saloranta and was already included in the upstream 2.18.2 release that TuxCare onboarded. The SubTypeValidator is actively enforced during bean deserialization (verified in BeanDeserializerFactory), ensuring the blacklist prevents exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:30:30.768655+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 (and corresponding older branches). The vulnerability allows JNDI injection via the ch.qos.logback.core.db.JNDIConnectionSource class when Default Typing is enabled. The target version 2.18.2 includes the upstream fix committed by Tatu Saloranta (ad418eeb97) on July 25, 2019, which blacklists this class in SubTypeValidator. This fix was already present in the upstream 2.18.2 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 (and corresponding older branches). The vulnerability allows JNDI injection via the ch.qos.logback.core.db.JNDIConnectionSource class when Default Typing is enabled. The target version 2.18.2 includes the upstream fix committed by Tatu Saloranta (ad418eeb97) on July 25, 2019, which blacklists this class in SubTypeValidator. This fix was already present in the upstream 2.18.2 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:46:18.460067+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is not present in jackson-databind 2.18.2-tuxcare.3. The vulnerability affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target version 2.18.2 is significantly newer and already contains the upstream fix. The required blocklist entries for com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource are present in SubTypeValidator.java (lines 104-107) and properly enforced. The fix was authored by upstream maintainer Tatu Saloranta in commit d4983c740fec7d5576b207a8c30a63d3ea7443de (Aug 2019) and was already included in the upstream 2.18.2 release when TuxCare onboarded it via commit 5c4f320f9daf1e6dc27db563564e616ce918c4b5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 is not present in jackson-databind 2.18.2-tuxcare.3. The vulnerability affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target version 2.18.2 is significantly newer and already contains the upstream fix. The required blocklist entries for com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource are present in SubTypeValidator.java (lines 104-107) and properly enforced. The fix was authored by upstream maintainer Tatu Saloranta in commit d4983c740fec7d5576b207a8c30a63d3ea7443de (Aug 2019) and was already included in the upstream 2.18.2 release when TuxCare onboarded it via commit 5c4f320f9daf1e6dc27db563564e616ce918c4b5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:54:05.163421+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 addresses polymorphic deserialization of malicious commons-configuration JNDI classes that could enable arbitrary code execution. The fix adds two class names (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) to jackson-databind's SubTypeValidator blocklist. This fix was already present in upstream release 2.18.2, which TuxCare onboarded. The target version 2.18.2-tuxcare.2 contains the complete fix at lines 112-114 of SubTypeValidator.java. The blocklist mechanism is actively enforced during bean deserialization via BeanDeserializerFactory (line 1096), providing runtime protection against this attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 addresses polymorphic deserialization of malicious commons-configuration JNDI classes that could enable arbitrary code execution. The fix adds two class names (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) to jackson-databind's SubTypeValidator blocklist. This fix was already present in upstream release 2.18.2, which TuxCare onboarded. The target version 2.18.2-tuxcare.2 contains the complete fix at lines 112-114 of SubTypeValidator.java. The blocklist mechanism is actively enforced during bean deserialization via BeanDeserializerFactory (line 1096), providing runtime protection against this attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0, involving polymorphic deserialization of the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to remote code execution. The target repository is jackson-databind 2.18.2-tuxcare.3, which already contains the upstream fix. The fix (commit 998efd7082) adds the dangerous class to the SubTypeValidator blocklist, preventing its deserialization. This fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and was already present in the upstream release 2.18.2 that TuxCare onboarded. The vulnerable code pattern (absence of the blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0, involving polymorphic deserialization of the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to remote code execution. The target repository is jackson-databind 2.18.2-tuxcare.3, which already contains the upstream fix. The fix (commit 998efd7082) adds the dangerous class to the SubTypeValidator blocklist, preventing its deserialization. This fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and was already present in the upstream release 2.18.2 that TuxCare onboarded. The vulnerable code pattern (absence of the blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T17:03:25.795966+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 affects jackson-databind versions before 2.9.10/2.8.11.5/2.6.7.3 due to a polymorphic deserialization vulnerability related to com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.18.2-tuxcare.3) is NOT affected because the upstream fix was already present in version 2.18.2 before TuxCare onboarded it. The fix adds HikariDataSource to SubTypeValidator's blocklist, preventing unauthorized object instantiation during JSON deserialization. Commit 73c1c2cc76 by Tatu Saloranta (upstream maintainer) applied this fix, which shipped in the upstream 2.18.2 release that TuxCare later onboarded via commit 5c4f320f9d.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 affects jackson-databind versions before 2.9.10/2.8.11.5/2.6.7.3 due to a polymorphic deserialization vulnerability related to com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.18.2-tuxcare.3) is NOT affected because the upstream fix was already present in version 2.18.2 before TuxCare onboarded it. The fix adds HikariDataSource to SubTypeValidator's blocklist, preventing unauthorized object instantiation during JSON deserialization. Commit 73c1c2cc76 by Tatu Saloranta (upstream maintainer) applied this fix, which shipped in the upstream 2.18.2 release that TuxCare later onboarded via commit 5c4f320f9d.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:03:40.830954+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.18.2-tuxcare.2. The vulnerability concerns polymorphic deserialization of malicious gadget classes (org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource) that enable RCE when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in commit 9593e16cf5 (2019-09-28) by adding these classes to the SubTypeValidator blocklist. This fix was already present in the upstream 2.18.2 release that TuxCare onboarded, and is therefore not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.18.2-tuxcare.2. The vulnerability concerns polymorphic deserialization of malicious gadget classes (org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource) that enable RCE when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in commit 9593e16cf5 (2019-09-28) by adding these classes to the SubTypeValidator blocklist. This fix was already present in the upstream 2.18.2 release that TuxCare onboarded, and is therefore not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T17:13:05.282153+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.2-tuxcare.3) is not affected by CVE-2019-16943. The fix for this polymorphic typing deserialization vulnerability was already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded. The fix (commits 9593e16cf5, 328a0f833d) added com.p6spy.engine.spy.P6DataSource and related commons-dbcp DataSource classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization. This fix was authored by the upstream Jackson maintainer (tatu.saloranta@iki.fi) and shipped in the upstream 2.18.2 release before TuxCare's onboarding commit (5c4f320f9d).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "The target repository (jackson-databind 2.18.2-tuxcare.3) is not affected by CVE-2019-16943. The fix for this polymorphic typing deserialization vulnerability was already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded. The fix (commits 9593e16cf5, 328a0f833d) added com.p6spy.engine.spy.P6DataSource and related commons-dbcp DataSource classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization. This fix was authored by the upstream Jackson maintainer (tatu.saloranta@iki.fi) and shipped in the upstream 2.18.2 release before TuxCare's onboarding commit (5c4f320f9d).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:27:45.237635+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is not present in jackson-databind 2.18.2-tuxcare.2. The vulnerability involves polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The fix (commit 191a4cdf87) was already included in the upstream jackson-databind 2.18.2 release that TuxCare onboarded. The SubTypeValidator blocklist includes this class on line 99, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 is not present in jackson-databind 2.18.2-tuxcare.2. The vulnerability involves polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The fix (commit 191a4cdf87) was already included in the upstream jackson-databind 2.18.2 release that TuxCare onboarded. The SubTypeValidator blocklist includes this class on line 99, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:46:48.486669+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.18.2-tuxcare.2 is NOT AFFECTED by CVE-2019-17531. The upstream jackson-databind maintainer (Tatu Saloranta) added the two log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) to the deserialization blocklist in commit b5a304a98590b6bb766134f9261e6566dcbbb6d0. This fix was already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded, well before any TuxCare modifications. The vulnerable code pattern (missing blocklist entries for these JNDI-based classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "Target version 2.18.2-tuxcare.2 is NOT AFFECTED by CVE-2019-17531. The upstream jackson-databind maintainer (Tatu Saloranta) added the two log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) to the deserialization blocklist in commit b5a304a98590b6bb766134f9261e6566dcbbb6d0. This fix was already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded, well before any TuxCare modifications. The vulnerable code pattern (missing blocklist entries for these JNDI-based classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:05:53.304095+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.2-tuxcare.3) is NOT affected by CVE-2019-20330. The vulnerability requires missing blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that enable JNDI injection attacks. However, these blocklist entries are already present in the target at SubTypeValidator.java lines 134-135. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit fc4214a883d and was already included in the upstream 2.18.2 release before TuxCare onboarded it (first TuxCare commit: 5c4f320f9d \"Onboard version 2.18.2\"). Since the CVE affects versions before 2.9.10.2 and the target is version 2.18.2, the upstream vendor had already applied this security fix in their release cycle.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "The target repository (jackson-databind 2.18.2-tuxcare.3) is NOT affected by CVE-2019-20330. The vulnerability requires missing blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that enable JNDI injection attacks. However, these blocklist entries are already present in the target at SubTypeValidator.java lines 134-135. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit fc4214a883d and was already included in the upstream 2.18.2 release before TuxCare onboarded it (first TuxCare commit: 5c4f320f9d \"Onboard version 2.18.2\"). Since the CVE affects versions before 2.9.10.2 and the target is version 2.18.2, the upstream vendor had already applied this security fix in their release cycle.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T17:00:37.380050+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is not present in jackson-databind 2.18.2-tuxcare.3. The vulnerability involves unsafe deserialization of ignite-jta gadget classes that enable JNDI lookup exploitation. The upstream fix (commit a424c038ba by Tatu Saloranta) was already included in jackson-databind 2.18.2 when TuxCare onboarded this version. The fix adds three classes to the deserialization blocklist in SubTypeValidator.java: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider (lines 157-160). These blocklist entries prevent deserialization of these gadget classes, blocking the attack chain from malicious input to JNDI exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 is not present in jackson-databind 2.18.2-tuxcare.3. The vulnerability involves unsafe deserialization of ignite-jta gadget classes that enable JNDI lookup exploitation. The upstream fix (commit a424c038ba by Tatu Saloranta) was already included in jackson-databind 2.18.2 when TuxCare onboarded this version. The fix adds three classes to the deserialization blocklist in SubTypeValidator.java: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider (lines 157-160). These blocklist entries prevent deserialization of these gadget classes, blocking the attack chain from malicious input to JNDI exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The target (jackson-databind 2.18.2-tuxcare.3) is NOT AFFECTED because the upstream vendor fix is already present. The dangerous class is blocked in the DEFAULT_NO_DESER_CLASS_NAMES immutable blocklist (SubTypeValidator.java:163), preventing its deserialization. Fix commit 592872f423 by upstream maintainer Tatu Saloranta was already included in the upstream 2.18.2 release that TuxCare onboarded (commit 5c4f320f9d). The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The target (jackson-databind 2.18.2-tuxcare.3) is NOT AFFECTED because the upstream vendor fix is already present. The dangerous class is blocked in the DEFAULT_NO_DESER_CLASS_NAMES immutable blocklist (SubTypeValidator.java:163), preventing its deserialization. Fix commit 592872f423 by upstream maintainer Tatu Saloranta was already included in the upstream 2.18.2 release that TuxCare onboarded (commit 5c4f320f9d). The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:25:43.115991+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4, related to the deserialization gadget com.caucho.config.types.ResourceRef. The target repository is version 2.18.2-tuxcare.2, which already contains the upstream fix. The blocklist entry for \"com.caucho.config.types.ResourceRef\" is present at line 167 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta (commit 1645efbd) and was included in the upstream release 2.18.2 that TuxCare onboarded. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4, related to the deserialization gadget com.caucho.config.types.ResourceRef. The target repository is version 2.18.2-tuxcare.2, which already contains the upstream fix. The blocklist entry for \"com.caucho.config.types.ResourceRef\" is present at line 167 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta (commit 1645efbd) and was included in the upstream release 2.18.2 that TuxCare onboarded. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions that allow deserialization of the org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class. The target repository version 2.18.2 contains the upstream fix that adds this class to the deserialization blacklist (SubTypeValidator.java lines 170-171). The fix was authored by upstream FasterXML maintainer Tatu Saloranta in commit 05d7e0e13f4 (2020-03-25) and was already present in the upstream 2.18.2 release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 affects jackson-databind versions that allow deserialization of the org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class. The target repository version 2.18.2 contains the upstream fix that adds this class to the deserialization blacklist (SubTypeValidator.java lines 170-171). The fix was authored by upstream FasterXML maintainer Tatu Saloranta in commit 05d7e0e13f4 (2020-03-25) and was already present in the upstream 2.18.2 release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.2-tuxcare.3 is NOT AFFECTED by CVE-2020-10969. The vulnerability involves deserialization of javax.swing.JEditorPane as a serialization gadget. The fix (adding javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blacklist) is present at line 150 of SubTypeValidator.java. This fix was part of upstream version 2.18.2 before TuxCare onboarded it, authored by Tatu Saloranta in commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60. The vulnerable pattern (ability to deserialize this dangerous class) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "Target jackson-databind 2.18.2-tuxcare.3 is NOT AFFECTED by CVE-2020-10969. The vulnerability involves deserialization of javax.swing.JEditorPane as a serialization gadget. The fix (adding javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blacklist) is present at line 150 of SubTypeValidator.java. This fix was part of upstream version 2.18.2 before TuxCare onboarded it, authored by Tatu Saloranta in commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60. The vulnerable pattern (ability to deserialize this dangerous class) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.2-tuxcare.3) is not affected by CVE-2020-11111. The vulnerability involves deserialization of malicious org.apache.activemq.* classes to achieve arbitrary code execution. The fix (blocking these classes in SubTypeValidator) was already present in the upstream 2.18.2 release when TuxCare onboarded it. Lines 173-183 of SubTypeValidator.java contain all nine activemq class blocklist entries from the vendor patch. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commit c14c9f99ed (March 26, 2020), which predates the TuxCare onboarding commit 5c4f320f9d (September 20, 2026).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "The target repository (jackson-databind 2.18.2-tuxcare.3) is not affected by CVE-2020-11111. The vulnerability involves deserialization of malicious org.apache.activemq.* classes to achieve arbitrary code execution. The fix (blocking these classes in SubTypeValidator) was already present in the upstream 2.18.2 release when TuxCare onboarded it. Lines 173-183 of SubTypeValidator.java contain all nine activemq class blocklist entries from the vendor patch. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commit c14c9f99ed (March 26, 2020), which predates the TuxCare onboarding commit 5c4f320f9d (September 20, 2026).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.2-tuxcare.3 is NOT affected by CVE-2020-11112. The fix that blocks deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider was already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded. The blacklist entry exists at SubTypeValidator.java line 186, and the validation is properly enforced during bean deserialization at BeanDeserializerFactory line 141, preventing instantiation of the dangerous class with error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "The target jackson-databind 2.18.2-tuxcare.3 is NOT affected by CVE-2020-11112. The fix that blocks deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider was already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded. The blacklist entry exists at SubTypeValidator.java line 186, and the validation is properly enforced during bean deserialization at BeanDeserializerFactory line 141, preventing instantiation of the dangerous class with error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.2-tuxcare.3 is NOT AFFECTED by CVE-2020-11113. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime to achieve arbitrary code execution. The upstream fix (commit e2ba12d5d60) that blacklists this gadget class was already present in the upstream Jackson 2.18.2 release before TuxCare onboarded it. The vulnerable code pattern is not present because the defensive blacklist entry exists at SubTypeValidator.java:84 and is actively enforced by the validateSubType method at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "The target jackson-databind 2.18.2-tuxcare.3 is NOT AFFECTED by CVE-2020-11113. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime to achieve arbitrary code execution. The upstream fix (commit e2ba12d5d60) that blacklists this gadget class was already present in the upstream Jackson 2.18.2 release before TuxCare onboarded it. The vulnerable code pattern is not present because the defensive blacklist entry exists at SubTypeValidator.java:84 and is actively enforced by the validateSubType method at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is not present in jackson-databind 2.18.2-tuxcare.3. The vulnerability involves unsafe deserialization of Spring AOP gadget classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean). The fix adding these classes to the SubTypeValidator blocklist was authored by upstream maintainer Tatu Saloranta in commit 113e89fb08 (April 2020) and was already included in upstream version 2.18.2, which TuxCare onboarded. The target contains comprehensive defense: specific blocklist entries (lines 53-54) and hierarchical Spring class protection (lines 278-286).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 is not present in jackson-databind 2.18.2-tuxcare.3. The vulnerability involves unsafe deserialization of Spring AOP gadget classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean). The fix adding these classes to the SubTypeValidator blocklist was authored by upstream maintainer Tatu Saloranta in commit 113e89fb08 (April 2020) and was already included in upstream version 2.18.2, which TuxCare onboarded. The target contains comprehensive defense: specific blocklist entries (lines 53-54) and hierarchical Spring class protection (lines 278-286).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:24:45.618566+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.2-tuxcare.3 is not affected by CVE-2020-11620. The vulnerability involves jackson-databind's polymorphic deserialization allowing instantiation of the dangerous gadget class org.apache.commons.jelly.impl.Embedded, which could lead to arbitrary code execution. The fix (adding this class to the deserialization blacklist in SubTypeValidator) was already present in the upstream jackson-databind 2.18.2 release before TuxCare onboarded it. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 77040d85 and is active at line 189 of SubTypeValidator.java, where the class name is added to DEFAULT_NO_DESER_CLASS_NAMES and actively checked during deserialization validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "The target jackson-databind 2.18.2-tuxcare.3 is not affected by CVE-2020-11620. The vulnerability involves jackson-databind's polymorphic deserialization allowing instantiation of the dangerous gadget class org.apache.commons.jelly.impl.Embedded, which could lead to arbitrary code execution. The fix (adding this class to the deserialization blacklist in SubTypeValidator) was already present in the upstream jackson-databind 2.18.2 release before TuxCare onboarded it. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 77040d85 and is active at line 189 of SubTypeValidator.java, where the class name is added to DEFAULT_NO_DESER_CLASS_NAMES and actively checked during deserialization validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.2-tuxcare.3 is NOT AFFECTED by CVE-2020-14060. The vulnerability pattern (deserialization of gadget class \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\") is not present because the upstream vendor fix was already included in version 2.18.2 when TuxCare onboarded it. The fix commit d1c67a0396 (authored by Tatu Saloranta on 2020-04-24) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This is an upstream fix that shipped in the original 2.18.2 release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "The target jackson-databind version 2.18.2-tuxcare.3 is NOT AFFECTED by CVE-2020-14060. The vulnerability pattern (deserialization of gadget class \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\") is not present because the upstream vendor fix was already included in version 2.18.2 when TuxCare onboarded it. The fix commit d1c67a0396 (authored by Tatu Saloranta on 2020-04-24) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This is an upstream fix that shipped in the original 2.18.2 release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 affects jackson-databind versions before 2.9.10.5 due to missing blacklist entries for five Oracle JMS gadget classes. The target repository (jackson-databind 2.18.2) contains the fix in SubTypeValidator.java lines 200-204, where all five Oracle JMS classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix was introduced by upstream commit 5c8642aeae (author: tatu.saloranta@iki.fi) and was already present in the upstream 2.18.2 release that TuxCare onboarded. The vulnerable pattern (unblocked deserialization of these gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "CVE-2020-14061 affects jackson-databind versions before 2.9.10.5 due to missing blacklist entries for five Oracle JMS gadget classes. The target repository (jackson-databind 2.18.2) contains the fix in SubTypeValidator.java lines 200-204, where all five Oracle JMS classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix was introduced by upstream commit 5c8642aeae (author: tatu.saloranta@iki.fi) and was already present in the upstream 2.18.2 release that TuxCare onboarded. The vulnerable pattern (unblocked deserialization of these gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to missing blacklist entry for com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool, allowing polymorphic deserialization attacks. The target (jackson-databind 2.18.2-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream release 2.18.2 that TuxCare onboarded. The dangerous class is blacklisted in SubTypeValidator.java:119, preventing instantiation during deserialization. This fix was authored by upstream maintainer Tatu Saloranta (commit 840eae2ca81) on 2020-05-01 and shipped in upstream releases before the TuxCare onboarding commit (5c4f320f9daf).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to missing blacklist entry for com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool, allowing polymorphic deserialization attacks. The target (jackson-databind 2.18.2-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream release 2.18.2 that TuxCare onboarded. The dangerous class is blacklisted in SubTypeValidator.java:119, preventing instantiation during deserialization. This fix was authored by upstream maintainer Tatu Saloranta (commit 840eae2ca81) on 2020-05-01 and shipped in upstream releases before the TuxCare onboarding commit (5c4f320f9daf).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is NOT present in jackson-databind 2.18.2-tuxcare.3. The vulnerability concerns deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory. The target repository already contains the upstream fix: this class is blocklisted in SubTypeValidator.java at line 207. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit f6d9c664f6 on June 13, 2020, and was included in the upstream 2.18.2 release that TuxCare onboarded. The blocklist is enforced by validateSubType() which throws JsonMappingException when attempting to deserialize blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 is NOT present in jackson-databind 2.18.2-tuxcare.3. The vulnerability concerns deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory. The target repository already contains the upstream fix: this class is blocklisted in SubTypeValidator.java at line 207. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit f6d9c664f6 on June 13, 2020, and was included in the upstream 2.18.2 release that TuxCare onboarded. The blocklist is enforced by validateSubType() which throws JsonMappingException when attempting to deserialize blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:18:25.927574+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects Jackson-databind versions before 2.9.10.6. The target version 2.18.2 already contains the upstream fix that blacklists br.com.anteros.dbcp.AnterosDBCPDataSource in SubTypeValidator (line 147). This fix was present in the upstream release when TuxCare onboarded version 2.18.2 (commit 5c4f320f9d). The vulnerable deserialization pattern is not present; the dangerous class is blocked during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 affects Jackson-databind versions before 2.9.10.6. The target version 2.18.2 already contains the upstream fix that blacklists br.com.anteros.dbcp.AnterosDBCPDataSource in SubTypeValidator (line 147). This fix was present in the upstream release when TuxCare onboarded version 2.18.2 (commit 5c4f320f9d). The vulnerable deserialization pattern is not present; the dangerous class is blocked during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:14:13.800446+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is not present in jackson-databind 2.18.2-tuxcare.2. The upstream fix that blocks deserialization of com.pastdev.httpcomponents.configuration.JndiConfiguration was already included in the base 2.18.2 release from FasterXML. The blocklist entry is present at SubTypeValidator.java:210, preventing this deserialization gadget from being exploited.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 is not present in jackson-databind 2.18.2-tuxcare.2. The upstream fix that blocks deserialization of com.pastdev.httpcomponents.configuration.JndiConfiguration was already included in the base 2.18.2 release from FasterXML. The blocklist entry is present at SubTypeValidator.java:210, preventing this deserialization gadget from being exploited.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.18.2-tuxcare.3. The fix was already included in the upstream 2.18.2 release that TuxCare onboarded. The target code contains the necessary XXE protections: disallow-doctype-decl=true and load-external-dtd=false at lines 40-46 of DOMDeserializer.java. Fix commit 612f971b78 by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of the first TuxCare onboarding commit 5c4f320f9d, confirming the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.18.2-tuxcare.3. The fix was already included in the upstream 2.18.2 release that TuxCare onboarded. The target code contains the necessary XXE protections: disallow-doctype-decl=true and load-external-dtd=false at lines 40-46 of DOMDeserializer.java. Fix commit 612f971b78 by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of the first TuxCare onboarding commit 5c4f320f9d, confirming the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:20:14.370746+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for Apache Commons DBCP2 datasource gadget classes. The target repository (jackson-databind 2.18.2-tuxcare.2) contains the upstream vendor's fix from commit 41b8bdb5cc, which adds PerUserPoolDataSource and SharedPoolDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 217-218). This fix was authored by Tatu Saloranta (upstream maintainer) and was already present in the upstream release 2.18.2 before TuxCare onboarded it. The vulnerable pattern (deserialization of these gadget classes without validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for Apache Commons DBCP2 datasource gadget classes. The target repository (jackson-databind 2.18.2-tuxcare.2) contains the upstream vendor's fix from commit 41b8bdb5cc, which adds PerUserPoolDataSource and SharedPoolDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 217-218). This fix was authored by Tatu Saloranta (upstream maintainer) and was already present in the upstream release 2.18.2 before TuxCare onboarded it. The vulnerable pattern (deserialization of these gadget classes without validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:31:15.270922+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.2-tuxcare.2) is NOT vulnerable to CVE-2020-35491. The fix for this deserialization gadget vulnerability was already present in the upstream 2.18.2 release that TuxCare onboarded. The dangerous classes org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource are blocked from deserialization via the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 217-218). This fix was originally added to upstream jackson-databind by Tatu Saloranta in commit 41b8bdb5 (Dec 2020) as part of version 2.9.10.8, and was included in all subsequent releases including 2.18.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "The target repository (jackson-databind 2.18.2-tuxcare.2) is NOT vulnerable to CVE-2020-35491. The fix for this deserialization gadget vulnerability was already present in the upstream 2.18.2 release that TuxCare onboarded. The dangerous classes org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource are blocked from deserialization via the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 217-218). This fix was originally added to upstream jackson-databind by Tatu Saloranta in commit 41b8bdb5 (Dec 2020) as part of version 2.9.10.8, and was included in all subsequent releases including 2.18.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:54:00.210651+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.2-tuxcare.2 is not affected by CVE-2020-35728. The vulnerability was fixed upstream in version 2.9.10.8 (commit 1ca0388c2f by Tatu Saloranta) by adding com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool to the deserialization blocklist. This fix was already present in the upstream 2.18.2 release before TuxCare onboarding (commit 5c4f320f9d). The blocklist entry exists at SubTypeValidator.java:240 and is actively enforced during deserialization via validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "Target jackson-databind 2.18.2-tuxcare.2 is not affected by CVE-2020-35728. The vulnerability was fixed upstream in version 2.9.10.8 (commit 1ca0388c2f by Tatu Saloranta) by adding com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool to the deserialization blocklist. This fix was already present in the upstream 2.18.2 release before TuxCare onboarding (commit 5c4f320f9d). The blocklist entry exists at SubTypeValidator.java:240 and is actively enforced during deserialization via validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T13:22:33.360201+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 affects jackson-databind versions before 2.9.10.8, involving the deserialization gadget class 'oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS'. The target repository (jackson-databind 2.18.2-tuxcare.2) contains the upstream fix from commit 3ded28aece by Tatu Saloranta, which was already present in the upstream release 2.18.2 before TuxCare onboarding. All five DriverAdapterCPDS class variants are blocked in SubTypeValidator.java (lines 123, 193, 219, 228, 234), preventing their instantiation during polymorphic deserialization. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "CVE-2020-36179 affects jackson-databind versions before 2.9.10.8, involving the deserialization gadget class 'oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS'. The target repository (jackson-databind 2.18.2-tuxcare.2) contains the upstream fix from commit 3ded28aece by Tatu Saloranta, which was already present in the upstream release 2.18.2 before TuxCare onboarding. All five DriverAdapterCPDS class variants are blocked in SubTypeValidator.java (lines 123, 193, 219, 228, 234), preventing their instantiation during polymorphic deserialization. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:33:21.899203+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.2-tuxcare.2 is NOT affected by CVE-2020-36180. The vulnerability involves deserialization gadgets using DriverAdapterCPDS classes from various DBCP packages. The upstream fix (commit 3ded28aece) added five DriverAdapterCPDS class variants to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in the upstream 2.18.2 release that TuxCare onboarded, as confirmed by the fix commit being authored by the upstream maintainer (tatu.saloranta@iki.fi) and predating the first TuxCare commit (5c4f320f9d) by 3,247 commits. All five blacklist entries are present in the target's SubTypeValidator.java at lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "The target jackson-databind 2.18.2-tuxcare.2 is NOT affected by CVE-2020-36180. The vulnerability involves deserialization gadgets using DriverAdapterCPDS classes from various DBCP packages. The upstream fix (commit 3ded28aece) added five DriverAdapterCPDS class variants to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in the upstream 2.18.2 release that TuxCare onboarded, as confirmed by the fix commit being authored by the upstream maintainer (tatu.saloranta@iki.fi) and predating the first TuxCare commit (5c4f320f9d) by 3,247 commits. All five blacklist entries are present in the target's SubTypeValidator.java at lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:40:52.879992+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is not present in jackson-databind 2.18.2-tuxcare.3. The upstream fix (commit 3ded28aece by tatu.saloranta@iki.fi) was already included in the upstream 2.18.2 release that TuxCare onboarded. The fix adds five DriverAdapterCPDS class variants to the SubTypeValidator blocklist, preventing their deserialization. All blocklist entries are present in the target at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, and the validation logic correctly enforces the blocklist by rejecting any class in the illegal names set.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 is not present in jackson-databind 2.18.2-tuxcare.3. The upstream fix (commit 3ded28aece by tatu.saloranta@iki.fi) was already included in the upstream 2.18.2 release that TuxCare onboarded. The fix adds five DriverAdapterCPDS class variants to the SubTypeValidator blocklist, preventing their deserialization. All blocklist entries are present in the target at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, and the validation logic correctly enforces the blocklist by rejecting any class in the illegal names set.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:11:33.363226+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.2-tuxcare.2 is not affected by CVE-2020-36182. The upstream fix for this vulnerability (blocking deserialization of org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS) was already present in the upstream release 2.18.2 before TuxCare onboarded it. The dangerous class is blocklisted in SubTypeValidator.java and the validation is actively enforced during deserialization, preventing remote code execution via this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "The target jackson-databind version 2.18.2-tuxcare.2 is not affected by CVE-2020-36182. The upstream fix for this vulnerability (blocking deserialization of org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS) was already present in the upstream release 2.18.2 before TuxCare onboarded it. The dangerous class is blocklisted in SubTypeValidator.java and the validation is actively enforced during deserialization, preventing remote code execution via this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:20:29.978023+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not affecting this target. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of the JNDI gadget class \"org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool\". The upstream fix (commit 12e23c962f by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (5c4f320f9d). The blocklist entry is present at line 243 of SubTypeValidator.java in the current target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "CVE-2020-36183 is not affecting this target. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of the JNDI gadget class \"org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool\". The upstream fix (commit 12e23c962f by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (5c4f320f9d). The blocklist entry is present at line 243 of SubTypeValidator.java in the current target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:23:26.744347+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is not present in jackson-databind 2.18.2-tuxcare.2. The upstream fix (commit 567194c53ae by Tatu Saloranta) adding org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization deny list was already included in the upstream 2.18.2 release when TuxCare onboarded it. The vulnerable pattern has been removed by the upstream vendor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 is not present in jackson-databind 2.18.2-tuxcare.2. The upstream fix (commit 567194c53ae by Tatu Saloranta) adding org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization deny list was already included in the upstream 2.18.2 release when TuxCare onboarded it. The vulnerable pattern has been removed by the upstream vendor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:04:33.761797+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is NOT present in jackson-databind 2.18.2-tuxcare.2. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources (SharedPoolDataSource and PerUserPoolDataSource) that could enable arbitrary code execution. The upstream fix (commit 567194c53a by Tatu Saloranta on 2020-12-26) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in the upstream release 2.18.2 that TuxCare onboarded, as confirmed by git history showing the fix commit predates the first TuxCare commit (5c4f320f9d \"Onboard version 2.18.2\"). The blocklist entries are present in SubTypeValidator.java at lines 234-236 and actively prevent deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 is NOT present in jackson-databind 2.18.2-tuxcare.2. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources (SharedPoolDataSource and PerUserPoolDataSource) that could enable arbitrary code execution. The upstream fix (commit 567194c53a by Tatu Saloranta on 2020-12-26) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in the upstream release 2.18.2 that TuxCare onboarded, as confirmed by git history showing the fix commit predates the first TuxCare commit (5c4f320f9d \"Onboard version 2.18.2\"). The blocklist entries are present in SubTypeValidator.java at lines 234-236 and actively prevent deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:29:38.548798+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is not present in jackson-databind 2.18.2-tuxcare.2. The vulnerability relates to deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 3e8fa3beea) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was included in the upstream release 2.18.2 before TuxCare onboarded the version, so the vulnerable code pattern never existed in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "CVE-2020-36186 is not present in jackson-databind 2.18.2-tuxcare.2. The vulnerability relates to deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 3e8fa3beea) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was included in the upstream release 2.18.2 before TuxCare onboarded the version, so the vulnerable code pattern never existed in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:43:14.856496+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is NOT present in jackson-databind 2.18.2-tuxcare.2. The vulnerability relates to deserialization gadgets using org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource. The fix (adding these classes to the deserialization blacklist) was already present in the upstream jackson-databind 2.18.2 release before TuxCare onboarding. The target contains the complete defense: SubTypeValidator.java lines 229-230 block both vulnerable classes, preventing their deserialization and blocking the attack chain to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "CVE-2020-36187 is NOT present in jackson-databind 2.18.2-tuxcare.2. The vulnerability relates to deserialization gadgets using org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource. The fix (adding these classes to the deserialization blacklist) was already present in the upstream jackson-databind 2.18.2 release before TuxCare onboarding. The target contains the complete defense: SubTypeValidator.java lines 229-230 block both vulnerable classes, preventing their deserialization and blocking the attack chain to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:49:18.906233+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is not present in jackson-databind 2.18.2. The vulnerability affects versions before 2.9.10.8 and 2.6.7.5, allowing exploitation via deserialization of dangerous newrelic-agent gadget classes. The target version 2.18.2 already contains the upstream fix (commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 by Tatu Saloranta) that blocks these classes in SubTypeValidator.java. The fix was shipped in the upstream release that TuxCare onboarded, so no backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188 is not present in jackson-databind 2.18.2. The vulnerability affects versions before 2.9.10.8 and 2.6.7.5, allowing exploitation via deserialization of dangerous newrelic-agent gadget classes. The target version 2.18.2 already contains the upstream fix (commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 by Tatu Saloranta) that blocks these classes in SubTypeValidator.java. The fix was shipped in the upstream release that TuxCare onboarded, so no backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T12:58:17.463230+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is NOT a vulnerability in jackson-databind 2.18.2-tuxcare.2. The fix was already present in the upstream 2.18.2 release before TuxCare onboarded it. The vulnerable classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) are blocked in SubTypeValidator.java lines 223-224, preventing deserialization gadget exploitation. Fix commit 33d96c13fe by upstream author tatu.saloranta@iki.fi shipped in the upstream release and is an ancestor of the TuxCare onboarding commit 5c4f320f9d.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 is NOT a vulnerability in jackson-databind 2.18.2-tuxcare.2. The fix was already present in the upstream 2.18.2 release before TuxCare onboarded it. The vulnerable classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) are blocked in SubTypeValidator.java lines 223-224, preventing deserialization gadget exploitation. Fix commit 33d96c13fe by upstream author tatu.saloranta@iki.fi shipped in the upstream release and is an ancestor of the TuxCare onboarding commit 5c4f320f9d.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T14:15:42.590601+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target version 2.18.2-tuxcare.2 is not affected by CVE-2020-36518. The vulnerable recursive deserialization code has been replaced by a non-recursive implementation (UntypedObjectDeserializerNR) in upstream Jackson 2.14+. This upstream fix was already present in the 2.18.2 release that TuxCare onboarded, preventing stack overflow from deeply nested JSON through iterative processing instead of unbounded recursion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "The target version 2.18.2-tuxcare.2 is not affected by CVE-2020-36518. The vulnerable recursive deserialization code has been replaced by a non-recursive implementation (UntypedObjectDeserializerNR) in upstream Jackson 2.14+. This upstream fix was already present in the 2.18.2 release that TuxCare onboarded, preventing stack overflow from deeply nested JSON through iterative processing instead of unbounded recursion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:09:26.959129+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 fix is present in jackson-databind 2.18.2. The vulnerable class org.apache.xbean.propertyeditor.JndiConverter is blocked in SubTypeValidator.java line 138. This fix was introduced by upstream commit 9bb52c7122 (authored by Tatu Saloranta) and was already present in the upstream 2.18.2 release that TuxCare onboarded. The target version 2.18.2 is much newer than all affected versions listed in the CVE (2.6.7.4, 2.7.9.7, 2.8.11.5, 2.9.10.2).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 fix is present in jackson-databind 2.18.2. The vulnerable class org.apache.xbean.propertyeditor.JndiConverter is blocked in SubTypeValidator.java line 138. This fix was introduced by upstream commit 9bb52c7122 (authored by Tatu Saloranta) and was already present in the upstream 2.18.2 release that TuxCare onboarded. The target version 2.18.2 is much newer than all affected versions listed in the CVE (2.6.7.4, 2.7.9.7, 2.8.11.5, 2.9.10.2).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is not present in jackson-databind 2.18.2. The vulnerability concerns unsafe deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig that could lead to arbitrary code execution. The fix (blacklisting this class in SubTypeValidator) was added by upstream commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb and was already present in the upstream release 2.18.2 when TuxCare onboarded it. The blacklist entry exists at SubTypeValidator.java:141 and is actively enforced in the deserialization flow via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 is not present in jackson-databind 2.18.2. The vulnerability concerns unsafe deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig that could lead to arbitrary code execution. The fix (blacklisting this class in SubTypeValidator) was added by upstream commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb and was already present in the upstream release 2.18.2 when TuxCare onboarded it. The blacklist entry exists at SubTypeValidator.java:141 and is actively enforced in the deserialization flow via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:38:16.833370+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is NOT present in this target. The vulnerability involves unsafe polymorphic deserialization of the gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The fix (adding this class to the SubTypeValidator blocklist) was committed by upstream maintainer Tatu Saloranta on 2020-02-29 in commit 1e64db6a2f. This fix was already present in upstream release 2.18.2, which TuxCare onboarded on 2026-09-20 (commit 5c4f320f9d). The target's SubTypeValidator.java contains the blocklist entry at lines 143-145, preventing deserialization of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 is NOT present in this target. The vulnerability involves unsafe polymorphic deserialization of the gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The fix (adding this class to the SubTypeValidator blocklist) was committed by upstream maintainer Tatu Saloranta on 2020-02-29 in commit 1e64db6a2f. This fix was already present in upstream release 2.18.2, which TuxCare onboarded on 2026-09-20 (commit 5c4f320f9d). The target's SubTypeValidator.java contains the blocklist entry at lines 143-145, preventing deserialization of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:13:53.139556+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is not present in jackson-databind 2.18.2-tuxcare.2. The vulnerability concerns deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The upstream fix (commit 1e64db6a by Tatu Saloranta, Feb 29 2020) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.2 release before TuxCare onboarded it (first TuxCare commit 5c4f320f). The blocklist is actively enforced via BeanDeserializerFactory._validateSubType() during deserialization, preventing instantiation of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 is not present in jackson-databind 2.18.2-tuxcare.2. The vulnerability concerns deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The upstream fix (commit 1e64db6a by Tatu Saloranta, Feb 29 2020) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.2 release before TuxCare onboarded it (first TuxCare commit 5c4f320f). The blocklist is actively enforced via BeanDeserializerFactory._validateSubType() during deserialization, preventing instantiation of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T15:10:53.898872+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 affects jackson-databind versions before 2.9.10.7 due to missing gadget class denylists in SubTypeValidator. The target version 2.18.2-tuxcare.2 contains the upstream fix (commit 7dbf51bf78) that adds javax.swing.JTextPane and other dangerous classes to the denylist. This fix was shipped in the upstream jackson-databind 2.18.2 release before TuxCare onboarded it (first TuxCare commit: 5c4f320f9d). The vulnerable pattern (missing gadget denylists) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 affects jackson-databind versions before 2.9.10.7 due to missing gadget class denylists in SubTypeValidator. The target version 2.18.2-tuxcare.2 contains the upstream fix (commit 7dbf51bf78) that adds javax.swing.JTextPane and other dangerous classes to the denylist. This fix was shipped in the upstream jackson-databind 2.18.2 release before TuxCare onboarded it (first TuxCare commit: 5c4f320f9d). The vulnerable pattern (missing gadget denylists) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 is not present in jackson-databind 2.18.2. The vulnerability affected versions 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1. The upstream vendor (FasterXML) fixed this issue in commit 3ccde7d938 (Fix #3328) which shipped in versions 2.12.6 and 2.13.1. The target version 2.18.2 was released years after these fixes and contains the complete mitigation: NodeSerialization._read() limits eager allocation to 100KB and uses chunked reading for larger payloads, preventing the 2GB heap allocation DoS attack. The fix was already present in the upstream release 2.18.2 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "CVE-2021-46877 is not present in jackson-databind 2.18.2. The vulnerability affected versions 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1. The upstream vendor (FasterXML) fixed this issue in commit 3ccde7d938 (Fix #3328) which shipped in versions 2.12.6 and 2.13.1. The target version 2.18.2 was released years after these fixes and contains the complete mitigation: NodeSerialization._read() limits eager allocation to 100KB and uses chunked reading for larger payloads, preventing the 2GB heap allocation DoS attack. The fix was already present in the upstream release 2.18.2 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-03T16:43:30.480251+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003: Target jackson-databind 2.18.2 is NOT AFFECTED. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) has been fixed by upstream commits cd090979b7 and d78d00ee7b, which were already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded. The fix adds depth checks in primitive deserializers and BeanDeserializer to reject nested arrays (e.g., [[[123]]]) during unwrapping, preventing unbounded recursion. Both fix commits are ancestors of the first TuxCare commit (5c4f320f9d \"Onboard version 2.18.2\"), confirming the vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "CVE-2022-42003: Target jackson-databind 2.18.2 is NOT AFFECTED. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) has been fixed by upstream commits cd090979b7 and d78d00ee7b, which were already present in the upstream jackson-databind 2.18.2 release that TuxCare onboarded. The fix adds depth checks in primitive deserializers and BeanDeserializer to reject nested arrays (e.g., [[[123]]]) during unwrapping, preventing unbounded recursion. Both fix commits are ancestors of the first TuxCare commit (5c4f320f9d \"Onboard version 2.18.2\"), confirming the vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-05T14:18:02.736616+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Version 2.18.2 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-rgv9-q543-rqg4 (affected below 2.13.4), NVD (affected below 2.13.4), Snyk (affected below 2.13.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "Version 2.18.2 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-rgv9-q543-rqg4 (affected below 2.13.4), NVD (affected below 2.13.4), Snyk (affected below 2.13.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-06T10:44:00.043358+00:00", "status_notes": "Vulnerability CVE-2026-19032 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.2-tuxcare.4.", "vulnerability": { "name": "CVE-2026-19032" }, "action_statement": "Vulnerability CVE-2026-19032 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.2-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T20:18:00.112942+00:00", "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 (Jackson issue #3447) addresses stack overflow DoS when serializing deeply nested JsonNode structures via toString(). The fix converts recursive serialization to iterative serialization using an IteratorStack. This fix (commit a1fa4ae4ec by upstream author Tatu Saloranta) was already present in the upstream Jackson 2.18.2 release that TuxCare onboarded at commit 5c4f320f9d. The v...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50193" }, "impact_statement": "not_affected \u2014 CVE-2026-50193 (Jackson issue #3447) addresses stack overflow DoS when serializing deeply nested JsonNode structures via toString(). The fix converts recursive serialization to iterative serialization using an IteratorStack. This fix (commit a1fa4ae4ec by upstream author Tatu Saloranta) was already present in the upstream Jackson 2.18.2 release that TuxCare onboarded at commit 5c4f320f9d. The v..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-06T10:44:15.465982+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.2-tuxcare.4.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-06T10:44:10.736340+00:00", "status_notes": "Vulnerability CVE-2026-54518 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.2-tuxcare.4.", "vulnerability": { "name": "CVE-2026-54518" }, "action_statement": "Vulnerability CVE-2026-54518 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.2-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59888" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-06T10:44:10.736340+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.2-tuxcare.4.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.2-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:47.887293+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.18.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2-tuxcare.3" } } ], "timestamp": "2026-11-02T12:39:26.740566+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.18.2-tuxcare.3.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }