{ "@id": "urn:uuid:67d31274-240d-42f1-928a-83421b5a2b4e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 82, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:17:33.879237+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:20:11.775734+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4 due to unsafe polymorphic deserialization allowing arbitrary class instantiation. The target (jackson-databind 2.18.3-tuxcare.3) contains the complete fix: all six vulnerable classes identified in the CVE patches are protected via blacklist entries and pattern matching in SubTypeValidator.java. The fix was authored by upstream maintainer tatu.saloranta@iki.fi in commit 2235894210 (\"Fix #1855\") and was already present in the upstream release when TuxCare onboarded version 2.9.10.5 (first TuxCare commit d3e245d364). The target is not affected because the vulnerable code pattern was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4 due to unsafe polymorphic deserialization allowing arbitrary class instantiation. The target (jackson-databind 2.18.3-tuxcare.3) contains the complete fix: all six vulnerable classes identified in the CVE patches are protected via blacklist entries and pattern matching in SubTypeValidator.java. The fix was authored by upstream maintainer tatu.saloranta@iki.fi in commit 2235894210 (\"Fix #1855\") and was already present in the upstream release when TuxCare onboarded version 2.9.10.5 (first TuxCare commit d3e245d364). The target is not affected because the vulnerable code pattern was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:50:34.321769+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.18.3-tuxcare.4 contains the complete upstream fix that was shipped in the upstream 2.18.3 release before TuxCare onboarding. The fix introduces SubTypeValidator with a comprehensive blacklist of dangerous classes and sophisticated pattern matching for Spring framework types, blocking all exploitation paths described in the CVE. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.18.3-tuxcare.4 contains the complete upstream fix that was shipped in the upstream 2.18.3 release before TuxCare onboarding. The fix introduces SubTypeValidator with a comprehensive blacklist of dangerous classes and sophisticated pattern matching for Spring framework types, blocking all exploitation paths described in the CVE. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:39:42.552241+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is a Jackson deserialization vulnerability allowing arbitrary code execution via malicious JSON payloads containing polymorphic type metadata that specifies dangerous gadget classes (e.g., TemplatesImpl). The target jackson-databind 2.18.3 is NOT vulnerable because the upstream vendor's fix was already present in the release that TuxCare onboarded. The fix adds SubTypeValidator with a blocklist of dangerous classes, preventing their deserialization. Fix commit 60d459cedc by upstream author Tatu Saloranta was already an ancestor of the 2.18.3 upstream release before TuxCare onboarding commit 9a8ecec08.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 is a Jackson deserialization vulnerability allowing arbitrary code execution via malicious JSON payloads containing polymorphic type metadata that specifies dangerous gadget classes (e.g., TemplatesImpl). The target jackson-databind 2.18.3 is NOT vulnerable because the upstream vendor's fix was already present in the release that TuxCare onboarded. The fix adds SubTypeValidator with a blocklist of dangerous classes, preventing their deserialization. Fix commit 60d459cedc by upstream author Tatu Saloranta was already an ancestor of the 2.18.3 upstream release before TuxCare onboarding commit 9a8ecec08.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:26:57.486633+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.18.3-tuxcare.3. The vulnerability involves using Jackson default typing with the iBatis XPathParser gadget class to exfiltrate data via XML External Entity (XXE) processing. The fix (adding `org.apache.ibatis.parsing.XPathParser` to the deserialization blacklist) was already present in the upstream 2.18.3 release when TuxCare onboarded it. The blacklist entry exists at SubTypeValidator.java:65 and is actively enforced during deserialization by BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.18.3-tuxcare.3. The vulnerability involves using Jackson default typing with the iBatis XPathParser gadget class to exfiltrate data via XML External Entity (XXE) processing. The fix (adding `org.apache.ibatis.parsing.XPathParser` to the deserialization blacklist) was already present in the upstream 2.18.3 release when TuxCare onboarded it. The blacklist entry exists at SubTypeValidator.java:65 and is actively enforced during deserialization by BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is not present in jackson-databind version 2.18.3. The upstream fix that blocks deserialization of dangerous gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) was already shipped in version 2.7.9.4 (released June 2018). This fix is present in the current version's SubTypeValidator.java blacklist (lines 67-72) and is actively enforced during bean deserialization. The fix was authored by Tatu Saloranta (upstream maintainer) and predates TuxCare's onboarding of version 2.18.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 is not present in jackson-databind version 2.18.3. The upstream fix that blocks deserialization of dangerous gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) was already shipped in version 2.7.9.4 (released June 2018). This fix is present in the current version's SubTypeValidator.java blacklist (lines 67-72) and is actively enforced during bean deserialization. The fix was authored by Tatu Saloranta (upstream maintainer) and predates TuxCare's onboarding of version 2.18.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:29:44.182918+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, allowing arbitrary code execution via deserialization of Oracle JDBC gadget classes when Default Typing is enabled. The target version 2.18.3-tuxcare.4 already contains the upstream vendor fix from June 2018 (commit 28badf7ef6) which blacklists oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator. This fix was part of the upstream 2.18.3 release that TuxCare onboarded, not a TuxCare backport. The vulnerable pattern (unblocked Oracle JDBC deserialization) is not present in the current codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, allowing arbitrary code execution via deserialization of Oracle JDBC gadget classes when Default Typing is enabled. The target version 2.18.3-tuxcare.4 already contains the upstream vendor fix from June 2018 (commit 28badf7ef6) which blacklists oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator. This fix was part of the upstream 2.18.3 release that TuxCare onboarded, not a TuxCare backport. The vulnerable pattern (unblocked Oracle JDBC deserialization) is not present in the current codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:06:55.509750+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.3-tuxcare.4 is NOT vulnerable to CVE-2018-14718. This CVE allows remote code execution via polymorphic deserialization of the slf4j-ext class (org.slf4j.ext.EventData). The fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.18.3 when TuxCare onboarded it. The target contains the defense: org.slf4j.ext.EventData is in the deserialization blocklist at SubTypeValidator.java:75, preventing the vulnerable polymorphic deserialization pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "The target jackson-databind 2.18.3-tuxcare.4 is NOT vulnerable to CVE-2018-14718. This CVE allows remote code execution via polymorphic deserialization of the slf4j-ext class (org.slf4j.ext.EventData). The fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.18.3 when TuxCare onboarded it. The target contains the defense: org.slf4j.ext.EventData is in the deserialization blocklist at SubTypeValidator.java:75, preventing the vulnerable polymorphic deserialization pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:06:30.945793+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 by allowing remote code execution through unsafe polymorphic deserialization of BlazeDS classes (flex.messaging.*). The target version 2.18.3 is NOT vulnerable because the fix was already present in the upstream release that TuxCare onboarded. The dangerous class `flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor` and related classes are blocked in SubTypeValidator.java (lines 74-78), preventing their instantiation during deserialization. This fix was introduced by upstream commit 87d29af authored by Tatu Saloranta on Aug 16, 2018, which is an ancestor of TuxCare's onboarding commit 9a8ecec.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 by allowing remote code execution through unsafe polymorphic deserialization of BlazeDS classes (flex.messaging.*). The target version 2.18.3 is NOT vulnerable because the fix was already present in the upstream release that TuxCare onboarded. The dangerous class `flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor` and related classes are blocked in SubTypeValidator.java (lines 74-78), preventing their instantiation during deserialization. This fix was introduced by upstream commit 87d29af authored by Tatu Saloranta on Aug 16, 2018, which is an ancestor of TuxCare's onboarding commit 9a8ecec.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:12:02.519749+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not present in jackson-databind 2.18.3-tuxcare.4. The vulnerability concerns polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that enable XXE attacks and other exploits. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by tatu.saloranta@iki.fi) was already present in the upstream jackson-databind 2.18.3 release that TuxCare onboarded. All four classes are blacklisted in SubTypeValidator.java lines 75-78, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 is not present in jackson-databind 2.18.3-tuxcare.4. The vulnerability concerns polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that enable XXE attacks and other exploits. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by tatu.saloranta@iki.fi) was already present in the upstream jackson-databind 2.18.3 release that TuxCare onboarded. All four classes are blacklisted in SubTypeValidator.java lines 75-78, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:41:44.946655+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 affects jackson-databind versions before 2.9.7. The target version 2.18.3 includes the upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44) that blocks \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" from polymorphic deserialization. The blocklist entry is present in SubTypeValidator.java at line 78 and is actively enforced by the validateSubType() method. This fix was shipped in the upstream 2.18.3 release, predating TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 affects jackson-databind versions before 2.9.7. The target version 2.18.3 includes the upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44) that blocks \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" from polymorphic deserialization. The blocklist entry is present in SubTypeValidator.java at line 78 and is actively enforced by the validateSubType() method. This fix was shipped in the upstream 2.18.3 release, predating TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:02:11.032230+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. The target (version 2.18.3) contains the upstream fix that was shipped in the original upstream release. The blocklist entry is present at SubTypeValidator.java:85, preventing the vulnerable class from being deserialized. This fix was authored by upstream maintainer Tatu Saloranta in commit 72cd4025a2 (Nov 2018) and was already present when TuxCare onboarded version 2.18.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. The target (version 2.18.3) contains the upstream fix that was shipped in the original upstream release. The blocklist entry is present at SubTypeValidator.java:85, preventing the vulnerable class from being deserialized. This fix was authored by upstream maintainer Tatu Saloranta in commit 72cd4025a2 (Nov 2018) and was already present when TuxCare onboarded version 2.18.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T17:07:24.314148+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.3 is not affected by CVE-2018-19361. The vulnerability, which allowed polymorphic deserialization of dangerous openjpa classes (RegistryManagedRuntime, JNDIManagedRuntime), was fixed by upstream FasterXML in commit 72cd4025a2. This fix was already present in the upstream release 2.18.3 before TuxCare onboarded it. The SubTypeValidator class contains the openjpa classes in its DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 82-83), and this validation is integrated into the BeanDeserializerFactory deserialization flow (line 141), preventing the exploitation path described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "The target jackson-databind 2.18.3 is not affected by CVE-2018-19361. The vulnerability, which allowed polymorphic deserialization of dangerous openjpa classes (RegistryManagedRuntime, JNDIManagedRuntime), was fixed by upstream FasterXML in commit 72cd4025a2. This fix was already present in the upstream release 2.18.3 before TuxCare onboarded it. The SubTypeValidator class contains the openjpa classes in its DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 82-83), and this validation is integrated into the BeanDeserializerFactory deserialization flow (line 141), preventing the exploitation path described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:30:53.892571+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability affects jackson-databind versions before 2.9.8 due to missing blocklist entries for dangerous deserialization gadgets. The target version (2.18.3) already contains the upstream fix that adds org.jboss.util.propertyeditor.DocumentEditor and related classes to the SubTypeValidator blocklist. This fix was authored by upstream FasterXML maintainer Tatu Saloranta (commit 72cd4025a2) and was already present in the upstream 2.18.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability affects jackson-databind versions before 2.9.8 due to missing blocklist entries for dangerous deserialization gadgets. The target version (2.18.3) already contains the upstream fix that adds org.jboss.util.propertyeditor.DocumentEditor and related classes to the SubTypeValidator blocklist. This fix was authored by upstream FasterXML maintainer Tatu Saloranta (commit 72cd4025a2) and was already present in the upstream 2.18.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.18.3. The vulnerability involved two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist for polymorphic deserialization, enabling remote code execution. The upstream fix (commit 038b471e2e, issue #1899) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.18.3 release that TuxCare onboarded. The target version is much newer than the affected versions (through 2.8.11 and 2.9.x through 2.9.3), and the blacklist entries are present at lines 62-63 of SubTypeValidator.java, actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.18.3. The vulnerability involved two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist for polymorphic deserialization, enabling remote code execution. The upstream fix (commit 038b471e2e, issue #1899) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.18.3 release that TuxCare onboarded. The target version is much newer than the affected versions (through 2.8.11 and 2.9.x through 2.9.3), and the blacklist entries are present at lines 62-63 of SubTypeValidator.java, actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:06:14.080942+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is not present in jackson-databind 2.18.3-tuxcare.4. The vulnerability involved incomplete blacklisting of c3p0 gadget classes that could enable remote code execution via polymorphic deserialization. The upstream fix (commit 6799f8f10c by Tatu Saloranta) added pattern-based validation in SubTypeValidator.java to block all c3p0 classes ending with \"DataSource\". This fix was already present in the upstream jackson-databind 2.18.3 release when TuxCare onboarded it (first TuxCare commit 9a8ecec080 \"Onboard version 2.18.3\"). The defense is active at SubTypeValidator.java:288-298 and prevents deserialization of dangerous c3p0 classes matching the pattern \"com.mchange.v2.c3p0.*DataSource\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 is not present in jackson-databind 2.18.3-tuxcare.4. The vulnerability involved incomplete blacklisting of c3p0 gadget classes that could enable remote code execution via polymorphic deserialization. The upstream fix (commit 6799f8f10c by Tatu Saloranta) added pattern-based validation in SubTypeValidator.java to block all c3p0 classes ending with \"DataSource\". This fix was already present in the upstream jackson-databind 2.18.3 release when TuxCare onboarded it (first TuxCare commit 9a8ecec080 \"Onboard version 2.18.3\"). The defense is active at SubTypeValidator.java:288-298 and prevents deserialization of dangerous c3p0 classes matching the pattern \"com.mchange.v2.c3p0.*DataSource\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:38:23.121558+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.18.3-tuxcare.4 is NOT AFFECTED by CVE-2019-12086. This polymorphic deserialization vulnerability allows instantiation of the dangerous class com.mysql.cj.jdbc.admin.MiniAdmin, enabling arbitrary file read when Default Typing is enabled with mysql-connector-java in the classpath. The fix (blacklisting com.mysql.cj.jdbc.admin.MiniAdmin in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit dda513bd72 and shipped in upstream jackson-databind 2.18.3. TuxCare onboarded this version at commit 9a8ecec080, which is a descendant of the fix commit. The blacklist entry is present at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:88.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "The target repository jackson-databind 2.18.3-tuxcare.4 is NOT AFFECTED by CVE-2019-12086. This polymorphic deserialization vulnerability allows instantiation of the dangerous class com.mysql.cj.jdbc.admin.MiniAdmin, enabling arbitrary file read when Default Typing is enabled with mysql-connector-java in the classpath. The fix (blacklisting com.mysql.cj.jdbc.admin.MiniAdmin in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit dda513bd72 and shipped in upstream jackson-databind 2.18.3. TuxCare onboarded this version at commit 9a8ecec080, which is a descendant of the fix commit. The blacklist entry is present at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:88.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-01T18:57:00.102490+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1. The target repository is jackson-databind 2.18.3-tuxcare.4, which already contains the upstream fix from commit c9ef4a10d6 (June 2019). The fix adds ch.qos.logback.core.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java (line 91), preventing polymorphic deserialization of this logback-core g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1. The target repository is jackson-databind 2.18.3-tuxcare.4, which already contains the upstream fix from commit c9ef4a10d6 (June 2019). The fix adds ch.qos.logback.core.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java (line 91), preventing polymorphic deserialization of this logback-core g..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-02T07:41:00.094163+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind version 2.18.3-tuxcare.4 is NOT AFFECTED by CVE-2019-12814. The upstream vendor fix that blocks deserialization of org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer was already present in the upstream release 2.18.3 that TuxCare onboarded. The fix commit 5f7c69bba07a7155adde130d9dee2e54a54f1fa5 by upstream maintainer Tatu Saloranta adds these J...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 The target jackson-databind version 2.18.3-tuxcare.4 is NOT AFFECTED by CVE-2019-12814. The upstream vendor fix that blocks deserialization of org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer was already present in the upstream release 2.18.3 that TuxCare onboarded. The fix commit 5f7c69bba07a7155adde130d9dee2e54a54f1fa5 by upstream maintainer Tatu Saloranta adds these J..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T12:22:29.685630+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.18.3. The vulnerability involves missing blacklist entries for deserialization gadget classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that enable remote code execution through polymorphic deserialization. The fix was already included in the upstream 2.18.3 release that TuxCare onboarded. The target's SubTypeValidator.java contains the required blacklist entries (lines 98, 102) that block deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.18.3. The vulnerability involves missing blacklist entries for deserialization gadget classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that enable remote code execution through polymorphic deserialization. The fix was already included in the upstream 2.18.3 release that TuxCare onboarded. The target's SubTypeValidator.java contains the required blacklist entries (lines 98, 102) that block deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:54:41.040148+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in jackson-databind 2.18.3. The vulnerability involves polymorphic typing deserialization of dangerous logback and EHCache classes when Default Typing is enabled. The fix (blacklisting ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) was already present in upstream version 2.18.3 before TuxCare onboarded it. Both dangerous classes are blacklisted in SubTypeValidator.java, preventing their instantiation and blocking the attack chain from malicious JSON input to code execution/JNDI injection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 is NOT present in jackson-databind 2.18.3. The vulnerability involves polymorphic typing deserialization of dangerous logback and EHCache classes when Default Typing is enabled. The fix (blacklisting ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) was already present in upstream version 2.18.3 before TuxCare onboarded it. Both dangerous classes are blacklisted in SubTypeValidator.java, preventing their instantiation and blocking the attack chain from malicious JSON input to code execution/JNDI injection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:54:53.626272+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 fix was already present in upstream jackson-databind 2.18.3 before TuxCare onboarded it. The vulnerable classes (com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource) are blocklisted in SubTypeValidator.java at lines 104-107, preventing unsafe polymorphic deserialization. Fix authored by upstream maintainer Tatu Saloranta in commits d4983c740f and 73c1c2cc76, dating to Aug-Sep 2019.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 fix was already present in upstream jackson-databind 2.18.3 before TuxCare onboarded it. The vulnerable classes (com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource) are blocklisted in SubTypeValidator.java at lines 104-107, preventing unsafe polymorphic deserialization. Fix authored by upstream maintainer Tatu Saloranta in commits d4983c740f and 73c1c2cc76, dating to Aug-Sep 2019.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:02:25.196465+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2019-14892. The upstream fix (commit 41b7f9b901) that blacklists org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration was already included in version 2.18.3 before TuxCare onboarded it. The blacklist entries are present and functional at lines 113-114 in SubTypeValidator.java, preventing polymorphic deserialization of these dangerous JNDI classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "The target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2019-14892. The upstream fix (commit 41b7f9b901) that blacklists org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration was already included in version 2.18.3 before TuxCare onboarded it. The blacklist entries are present and functional at lines 113-114 in SubTypeValidator.java, preventing polymorphic deserialization of these dangerous JNDI classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.3-tuxcare.4 is NOT AFFECTED by CVE-2019-14893. The vulnerability (polymorphic deserialization of malicious xalan JNDI gadget class) is not present because the fix commit 998efd7082 was already included in the upstream jackson-databind 2.18.3 release that TuxCare onboarded. The xalan gadget class \"org.apache.xalan.lib.sql.JNDIConnectionPool\" is properly blocked in SubTypeValidator.java line 117, preventing arbitrary code execution via polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "The target jackson-databind 2.18.3-tuxcare.4 is NOT AFFECTED by CVE-2019-14893. The vulnerability (polymorphic deserialization of malicious xalan JNDI gadget class) is not present because the fix commit 998efd7082 was already included in the upstream jackson-databind 2.18.3 release that TuxCare onboarded. The xalan gadget class \"org.apache.xalan.lib.sql.JNDIConnectionPool\" is properly blocked in SubTypeValidator.java line 117, preventing arbitrary code execution via polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T17:11:01.996232+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic deserialization gadget involving com.zaxxer.hikari.HikariDataSource. The target repository is at version 2.18.3-tuxcare.4, which already contains the upstream fix. The vulnerable pattern is not present because HikariDataSource was added to the SubTypeValidator blocklist in upstream commit 73c1c2cc76 (September 2019) by Tatu Saloranta, the jackson-databind maintainer. This fix was already included in the 2.18.3 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic deserialization gadget involving com.zaxxer.hikari.HikariDataSource. The target repository is at version 2.18.3-tuxcare.4, which already contains the upstream fix. The vulnerable pattern is not present because HikariDataSource was added to the SubTypeValidator blocklist in upstream commit 73c1c2cc76 (September 2019) by Tatu Saloranta, the jackson-databind maintainer. This fix was already included in the 2.18.3 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:14:37.389349+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 (commons-dbcp deserialization gadgets) is NOT present in jackson-databind 2.18.3. The upstream fix adding blocklist entries for org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource was already shipped in the upstream 2.18.3 release before TuxCare onboarded it. The vulnerable pattern (absence of these blocklist entries) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 (commons-dbcp deserialization gadgets) is NOT present in jackson-databind 2.18.3. The upstream fix adding blocklist entries for org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource was already shipped in the upstream 2.18.3 release before TuxCare onboarded it. The vulnerable pattern (absence of these blocklist entries) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T17:22:22.486046+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is not present in jackson-databind 2.18.3-tuxcare.4. The vulnerability involved missing blocklist entries for three dangerous gadget classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource) that could enable RCE when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in commit 9593e16cf5 by adding these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.3 release that TuxCare onboarded, making the target repository not affected by the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 is not present in jackson-databind 2.18.3-tuxcare.4. The vulnerability involved missing blocklist entries for three dangerous gadget classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource) that could enable RCE when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in commit 9593e16cf5 by adding these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.3 release that TuxCare onboarded, making the target repository not affected by the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:31:44.936589+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2019-17267. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of the dangerous class \"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\" which could be exploited for arbitrary code execution. The fix (adding this class to the SubTypeValidator blocklist) was already present in the upstream release 2.18.3 that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta in September 2019 (commit 191a4cdf87).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "The target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2019-17267. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of the dangerous class \"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\" which could be exploited for arbitrary code execution. The fix (adding this class to the SubTypeValidator blocklist) was already present in the upstream release 2.18.3 that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta in September 2019 (commit 191a4cdf87).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:51:40.336684+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability concerns polymorphic deserialization of apache-log4j-extra (1.2.x) classes that enable JNDI-based code execution. The upstream vendor (FasterXML) fixed this by adding two log4j-extras class names to the deserialization blocklist in SubTypeValidator.java. This fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta, dated 2019-10-12) was already present in the upstream jackson-databind 2.18.3 release that TuxCare onboarded. The target contains the exact blocklist entries at lines 130-131: org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource. The defense is functional and blocks the attack chain from malicious JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability concerns polymorphic deserialization of apache-log4j-extra (1.2.x) classes that enable JNDI-based code execution. The upstream vendor (FasterXML) fixed this by adding two log4j-extras class names to the deserialization blocklist in SubTypeValidator.java. This fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta, dated 2019-10-12) was already present in the upstream jackson-databind 2.18.3 release that TuxCare onboarded. The target contains the exact blocklist entries at lines 130-131: org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource. The defense is functional and blocks the attack chain from malicious JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 affects jackson-databind versions before 2.9.10.2 due to missing blocklist entries for two ehcache JNDI selector classes. The target version 2.18.3 already contains the upstream fix (commit fc4214a883) that adds these classes to the deserialization blocklist. The fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.18.3 release when TuxCare onboarded it. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 affects jackson-databind versions before 2.9.10.2 due to missing blocklist entries for two ehcache JNDI selector classes. The target version 2.18.3 already contains the upstream fix (commit fc4214a883) that adds these classes to the deserialization blocklist. The fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.18.3 release when TuxCare onboarded it. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T17:10:09.687234+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.3-tuxcare.4) is NOT affected by CVE-2020-10650. The vulnerability was fixed in upstream version 2.9.10.4 by blocking deserialization of ignite-jta JNDI classes (CacheJndiTmLookup, CacheJndiTmFactory) and quartz-core JNDIConnectionProvider. The fix commit (a424c038ba) by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) is present in HEAD and predates the TuxCare onboarding commit, meaning it was already included in the upstream release. The dangerous classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:157-160, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "The target repository (jackson-databind 2.18.3-tuxcare.4) is NOT affected by CVE-2020-10650. The vulnerability was fixed in upstream version 2.9.10.4 by blocking deserialization of ignite-jta JNDI classes (CacheJndiTmLookup, CacheJndiTmFactory) and quartz-core JNDIConnectionProvider. The fix commit (a424c038ba) by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) is present in HEAD and predates the TuxCare onboarding commit, meaning it was already included in the upstream release. The dangerous classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:157-160, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2020-10672. The vulnerability concerns missing blocklist entries for deserialization gadgets org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and RecoverablePooledConnectionFactory. The upstream fix (commits 592872f423 and 08fbfacf89) that adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist was already present in upstream release 2.18.3, which TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java at lines 163-164, and the validation logic actively blocks deserialization of these gadget classes by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "The target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2020-10672. The vulnerability concerns missing blocklist entries for deserialization gadgets org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and RecoverablePooledConnectionFactory. The upstream fix (commits 592872f423 and 08fbfacf89) that adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist was already present in upstream release 2.18.3, which TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java at lines 163-164, and the validation logic actively blocks deserialization of these gadget classes by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:35:21.882986+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is not a vulnerability in jackson-databind 2.18.3-tuxcare.4. The fix that blocks deserialization of com.caucho.config.types.ResourceRef was already present in upstream release 2.18.3 before TuxCare onboarded the version. The deny-list entry is located at line 167 of SubTypeValidator.java and is enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 is not a vulnerability in jackson-databind 2.18.3-tuxcare.4. The fix that blocks deserialization of com.caucho.config.types.ResourceRef was already present in upstream release 2.18.3 before TuxCare onboarded the version. The deny-list entry is located at line 167 of SubTypeValidator.java and is enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 is NOT present in jackson-databind 2.18.3. The vulnerability affects versions 2.x before 2.9.10.4 and involves deserialization of dangerous gadget classes (org.aoju.bus.proxy.provider.remoting.RmiProvider). The fix was applied by upstream author Tatu Saloranta in commit 05d7e0e13f on 2020-03-25 and released in version 2.9.10.4. The target version 2.18.3 is significantly newer and already contained this fix when TuxCare onboarded it. The blocklist entries preventing deserialization of these classes are present at lines 170-171 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 is NOT present in jackson-databind 2.18.3. The vulnerability affects versions 2.x before 2.9.10.4 and involves deserialization of dangerous gadget classes (org.aoju.bus.proxy.provider.remoting.RmiProvider). The fix was applied by upstream author Tatu Saloranta in commit 05d7e0e13f on 2020-03-25 and released in version 2.9.10.4. The target version 2.18.3 is significantly newer and already contained this fix when TuxCare onboarded it. The blocklist entries preventing deserialization of these classes are present at lines 170-171 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability concerns deserialization of javax.swing.JEditorPane as a serialization gadget. The upstream vendor (FasterXML) fixed this by adding javax.swing.JEditorPane to the SubTypeValidator denylist in commit 4d038c9de0 (Fix #2642) by Tatu Saloranta. This fix was already included in the upstream 2.18.3 release that TuxCare onboarded, predating all TuxCare commits on this branch. The vulnerable pattern (unrestricted deserialization of javax.swing.JEditorPane) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "CVE-2020-10969 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability concerns deserialization of javax.swing.JEditorPane as a serialization gadget. The upstream vendor (FasterXML) fixed this by adding javax.swing.JEditorPane to the SubTypeValidator denylist in commit 4d038c9de0 (Fix #2642) by Tatu Saloranta. This fix was already included in the upstream 2.18.3 release that TuxCare onboarded, predating all TuxCare commits on this branch. The vulnerable pattern (unrestricted deserialization of javax.swing.JEditorPane) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 affects jackson-databind 2.x before 2.9.10.4, related to deserialization gadgets in org.apache.activemq.* classes. The target version 2.18.3-tuxcare.4 is significantly newer than the fix version (2.9.10.4). The vendor's fix\u2014adding nine ActiveMQ connection factory classes to the SubTypeValidator blacklist\u2014was already present in the upstream release 2.18.3 that TuxCare onboarded (commit 9a8ecec080). The vulnerable pattern is not present; the blacklist entries prevent deserialization of these dangerous classes at lines 173-183 of SubTypeValidator.java. Original upstream fix by Tatu Saloranta (tatu.saloranta@iki.fi) in commit c14c9f99ed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 affects jackson-databind 2.x before 2.9.10.4, related to deserialization gadgets in org.apache.activemq.* classes. The target version 2.18.3-tuxcare.4 is significantly newer than the fix version (2.9.10.4). The vendor's fix\u2014adding nine ActiveMQ connection factory classes to the SubTypeValidator blacklist\u2014was already present in the upstream release 2.18.3 that TuxCare onboarded (commit 9a8ecec080). The vulnerable pattern is not present; the blacklist entries prevent deserialization of these dangerous classes at lines 173-183 of SubTypeValidator.java. Original upstream fix by Tatu Saloranta (tatu.saloranta@iki.fi) in commit c14c9f99ed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 affects Jackson-databind's polymorphic deserialization, allowing arbitrary code execution via the org.apache.commons.proxy.provider.remoting.RmiProvider gadget class. The target repository (jackson-databind 2.18.3-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream release 2.18.3 that TuxCare onboarded. The upstream fix (commit 05d7e0e13f by Tatu Saloranta, March 25, 2020) added the dangerous class to SubTypeValidator's blocklist at line 186, preventing instantiation during polymorphic deserialization. The fix predates TuxCare's onboarding commit (9a8ecec080, \"Onboard version 2.18.3\"), confirming it shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 affects Jackson-databind's polymorphic deserialization, allowing arbitrary code execution via the org.apache.commons.proxy.provider.remoting.RmiProvider gadget class. The target repository (jackson-databind 2.18.3-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream release 2.18.3 that TuxCare onboarded. The upstream fix (commit 05d7e0e13f by Tatu Saloranta, March 25, 2020) added the dangerous class to SubTypeValidator's blocklist at line 186, preventing instantiation during polymorphic deserialization. The fix predates TuxCare's onboarding commit (9a8ecec080, \"Onboard version 2.18.3\"), confirming it shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 does not affect jackson-databind 2.18.3-tuxcare.4. The vulnerability relates to missing blocklist entry for org.apache.openjpa.ee.WASRegistryManagedRuntime, allowing deserialization gadget exploitation. The fix (adding this class to DEFAULT_NO_DESER_CLASS_NAMES blocklist) is present at line 84 of SubTypeValidator.java. This fix was included in upstream release 2.18.3 (commit e2ba12d5d6 by Tatu Saloranta, March 2020), before TuxCare onboarded the version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 does not affect jackson-databind 2.18.3-tuxcare.4. The vulnerability relates to missing blocklist entry for org.apache.openjpa.ee.WASRegistryManagedRuntime, allowing deserialization gadget exploitation. The fix (adding this class to DEFAULT_NO_DESER_CLASS_NAMES blocklist) is present at line 84 of SubTypeValidator.java. This fix was included in upstream release 2.18.3 (commit e2ba12d5d6 by Tatu Saloranta, March 2020), before TuxCare onboarded the version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability involves missing blacklist entries for org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean in SubTypeValidator, which allowed exploitation via polymorphic deserialization. The fix (upstream commit 113e89fb08 by Tatu Saloranta) was already included in the upstream 2.18.3 release that TuxCare onboarded. The required blacklist entries are present and active in SubTypeValidator.java at lines 53-54.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability involves missing blacklist entries for org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean in SubTypeValidator, which allowed exploitation via polymorphic deserialization. The fix (upstream commit 113e89fb08 by Tatu Saloranta) was already included in the upstream 2.18.3 release that TuxCare onboarded. The required blacklist entries are present and active in SubTypeValidator.java at lines 53-54.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.18.3-tuxcare.4) is not vulnerable because the fix was already present in the upstream release 2.18.3 that TuxCare onboarded. The blocklist entry for \"org.apache.commons.jelly.impl.Embedded\" exists at line 189 of SubTypeValidator.java, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.18.3-tuxcare.4) is not vulnerable because the fix was already present in the upstream release 2.18.3 that TuxCare onboarded. The blocklist entry for \"org.apache.commons.jelly.impl.Embedded\" exists at line 189 of SubTypeValidator.java, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability involves deserialization of the JNDI gadget class \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\" which could enable arbitrary code execution. The upstream vendor (FasterXML) fixed this in version 2.9.10.5 (April 2020) by adding the gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream 2.18.3 when TuxCare onboarded it (commit 9a8ecec0). The blocklist is enforced during deserialization via the validateSubType method, which rejects any attempt to deserialize blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability involves deserialization of the JNDI gadget class \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\" which could enable arbitrary code execution. The upstream vendor (FasterXML) fixed this in version 2.9.10.5 (April 2020) by adding the gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream 2.18.3 when TuxCare onboarded it (commit 9a8ecec0). The blocklist is enforced during deserialization via the validateSubType method, which rejects any attempt to deserialize blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.3 is not affected by CVE-2020-14061. The vulnerability requires the absence of oracle.jms.* class blacklist entries in SubTypeValidator, but these defensive entries were added in upstream commit 5c8642aeae by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in version 2.9.10.5 (April 2020), well before the 2.18.3 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "Target jackson-databind 2.18.3 is not affected by CVE-2020-14061. The vulnerability requires the absence of oracle.jms.* class blacklist entries in SubTypeValidator, but these defensive entries were added in upstream commit 5c8642aeae by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in version 2.9.10.5 (April 2020), well before the 2.18.3 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2020-14062. The vulnerability concerns deserialization of the com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool gadget class that could lead to remote code execution. The fix (adding this class to the SubTypeValidator blocklist) was already present in upstream release 2.18.3 when TuxCare onboarded it. The blocklist entry exists at line 119 of SubTypeValidator.java, added by upstream commit 840eae2ca8 authored by Tatu Saloranta (FasterXML maintainer). CVE affects versions before 2.9.10.5; target version 2.18.3 is well beyond the affected range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "Target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2020-14062. The vulnerability concerns deserialization of the com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool gadget class that could lead to remote code execution. The fix (adding this class to the SubTypeValidator blocklist) was already present in upstream release 2.18.3 when TuxCare onboarded it. The blocklist entry exists at line 119 of SubTypeValidator.java, added by upstream commit 840eae2ca8 authored by Tatu Saloranta (FasterXML maintainer). CVE affects versions before 2.9.10.5; target version 2.18.3 is well beyond the affected range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.3-tuxcare.4 is NOT affected by CVE-2020-14195. The vulnerability involves deserialization of the dangerous gadget class org.jsecurity.realm.jndi.JndiRealmFactory, which can lead to remote code execution via JNDI lookups. The fix (adding this class to the SubTypeValidator blocklist) is already present in the target at SubTypeValidator.java:206-207. This fix was authored by upstream (tatu.saloranta@iki.fi) in commit f6d9c664f6d481703138319f6a0f1fdbddb3a259 and was already included in the upstream jackson-databind 2.18.3 release that TuxCare onboarded. The target version (2.18.3) is greater than the CVE's fixed version (2.9.10.5), confirming the fix is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "The target jackson-databind version 2.18.3-tuxcare.4 is NOT affected by CVE-2020-14195. The vulnerability involves deserialization of the dangerous gadget class org.jsecurity.realm.jndi.JndiRealmFactory, which can lead to remote code execution via JNDI lookups. The fix (adding this class to the SubTypeValidator blocklist) is already present in the target at SubTypeValidator.java:206-207. This fix was authored by upstream (tatu.saloranta@iki.fi) in commit f6d9c664f6d481703138319f6a0f1fdbddb3a259 and was already included in the upstream jackson-databind 2.18.3 release that TuxCare onboarded. The target version (2.18.3) is greater than the CVE's fixed version (2.9.10.5), confirming the fix is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:23:14.032161+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a missing blocklist entry for the serialization gadget br.com.anteros.dbcp.AnterosDBCPDataSource. The target version 2.18.3-tuxcare.4 is not affected because the upstream fix (commit 3d97153944 by Tatu Saloranta) was already included in the upstream release 2.18.3. The blocklist entry is present at SubTypeValidator.java:147 and prevents deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a missing blocklist entry for the serialization gadget br.com.anteros.dbcp.AnterosDBCPDataSource. The target version 2.18.3-tuxcare.4 is not affected because the upstream fix (commit 3d97153944 by Tatu Saloranta) was already included in the upstream release 2.18.3. The blocklist entry is present at SubTypeValidator.java:147 and prevents deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:18:37.633690+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 affects jackson-databind versions before 2.9.10.6 and 2.6.7.5, allowing deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration to achieve RCE via JNDI injection. The target version 2.18.3 contains the upstream fix that adds this class to the deserialization blocklist in SubTypeValidator.java (line 210). The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 6cc9f1a1 and was already present in upstream release 2.18.3 when TuxCare onboarded it (commit 9a8ecec0). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 affects jackson-databind versions before 2.9.10.6 and 2.6.7.5, allowing deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration to achieve RCE via JNDI injection. The target version 2.18.3 contains the upstream fix that adds this class to the deserialization blocklist in SubTypeValidator.java (line 210). The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 6cc9f1a1 and was already present in upstream release 2.18.3 when TuxCare onboarded it (commit 9a8ecec0). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in Jackson Databind DOMDeserializer) is NOT affecting target version 2.18.3. The upstream fix was already included in the Jackson Databind 2.18.3 release that TuxCare onboarded. The fix adds two XML parser security features: (1) disallow-doctype-decl set to true, and (2) load-external-dtd set to false. These features prevent XML external entity (XXE) attacks by blocking DOCTYPE declarations and external DTD loading. Fix commit 612f971b78 by Tatu Saloranta was already an ancestor of TuxCare's initial onboarding commit 9a8ecec080, confirming this is an upstream-shipped fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE vulnerability in Jackson Databind DOMDeserializer) is NOT affecting target version 2.18.3. The upstream fix was already included in the Jackson Databind 2.18.3 release that TuxCare onboarded. The fix adds two XML parser security features: (1) disallow-doctype-decl set to true, and (2) load-external-dtd set to false. These features prevent XML external entity (XXE) attacks by blocking DOCTYPE declarations and external DTD loading. Fix commit 612f971b78 by Tatu Saloranta was already an ancestor of TuxCare's initial onboarding commit 9a8ecec080, confirming this is an upstream-shipped fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:23:41.009963+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2020-35490. The vulnerability concerns deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream vendor (FasterXML) fixed this in commit 41b8bdb5cc by adding these classes to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.18.3 release that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "The target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2020-35490. The vulnerability concerns deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream vendor (FasterXML) fixed this in commit 41b8bdb5cc by adding these classes to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.18.3 release that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T12:55:53.618169+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is not present in jackson-databind 2.18.3. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 41b8bdb5cc) added these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was already included in the upstream 2.18.3 release before TuxCare onboarded it, so the vulnerable pattern has never been present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "CVE-2020-35491 is not present in jackson-databind 2.18.3. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 41b8bdb5cc) added these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was already included in the upstream 2.18.3 release before TuxCare onboarded it, so the vulnerable pattern has never been present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:56:12.360360+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2020-35728. The vulnerability fix (blocking deserialization of the dangerous gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) was already present in the upstream 2.18.3 release before TuxCare onboarded it. The fix is actively enforced by SubTypeValidator during polymorphic type resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "The target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2020-35728. The vulnerability fix (blocking deserialization of the dangerous gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) was already present in the upstream 2.18.3 release before TuxCare onboarded it. The fix is actively enforced by SubTypeValidator during polymorphic type resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:26:57.486633+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5, related to the deserialization gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS`. The target version 2.18.3-tuxcare.4 is NOT AFFECTED because the upstream fix (commit 3ded28aece by Tatu Saloranta) was already included in the upstream release 2.18.3 when TuxCare onboarded it. The dangerous class is blocked in SubTypeValidator.java at line 193, preventing malicious deserialization. The vulnerable code pattern never existed in the TuxCare target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "CVE-2020-36179 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5, related to the deserialization gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS`. The target version 2.18.3-tuxcare.4 is NOT AFFECTED because the upstream fix (commit 3ded28aece by Tatu Saloranta) was already included in the upstream release 2.18.3 when TuxCare onboarded it. The dangerous class is blocked in SubTypeValidator.java at line 193, preventing malicious deserialization. The vulnerable code pattern never existed in the TuxCare target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:43:48.993875+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability was already fixed by the upstream vendor (FasterXML) in commit 3ded28aece before TuxCare onboarded version 2.18.3. All five DriverAdapterCPDS gadget class blocklist entries are present in SubTypeValidator.java with the exact [databind#3004] reference. The fix shipped in the upstream release and was inherited by TuxCare during onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "CVE-2020-36180 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability was already fixed by the upstream vendor (FasterXML) in commit 3ded28aece before TuxCare onboarded version 2.18.3. All five DriverAdapterCPDS gadget class blocklist entries are present in SubTypeValidator.java with the exact [databind#3004] reference. The fix shipped in the upstream release and was inherited by TuxCare during onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:48:02.879946+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.3-tuxcare.4 is not affected by CVE-2020-36181. The vulnerability pattern (missing blocklist entries for DriverAdapterCPDS deserialization gadgets) was fixed by upstream commit 3ded28aece in December 2020 and included in jackson-databind 2.12.1 and all subsequent versions. The fix was already present in the upstream 2.18.3 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (9a8ecec080a6). All five DriverAdapterCPDS class variants are properly blocked in SubTypeValidator.java at lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "The target jackson-databind version 2.18.3-tuxcare.4 is not affected by CVE-2020-36181. The vulnerability pattern (missing blocklist entries for DriverAdapterCPDS deserialization gadgets) was fixed by upstream commit 3ded28aece in December 2020 and included in jackson-databind 2.12.1 and all subsequent versions. The fix was already present in the upstream 2.18.3 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (9a8ecec080a6). All five DriverAdapterCPDS class variants are properly blocked in SubTypeValidator.java at lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:14:27.541438+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5. The target is version 2.18.3-tuxcare.4, which already contains the upstream fix. The dangerous class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS (and related variants) are blocklisted in SubTypeValidator.java, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.18.3 release, predating TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "CVE-2020-36182 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5. The target is version 2.18.3-tuxcare.4, which already contains the upstream fix. The dangerous class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS (and related variants) are blocklisted in SubTypeValidator.java, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.18.3 release, predating TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:23:22.459243+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.3-tuxcare.4 is NOT AFFECTED by CVE-2020-36183. The upstream fix (adding org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool to the SubTypeValidator blacklist) was already present in the upstream Jackson 2.18.3 release when TuxCare onboarded it. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 12e23c962ffb on Dec 31, 2020, well before the 2.18.3 release. The vulnerable deserialization gadget class is blacklisted and cannot be instantiated during JSON deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "Target jackson-databind 2.18.3-tuxcare.4 is NOT AFFECTED by CVE-2020-36183. The upstream fix (adding org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool to the SubTypeValidator blacklist) was already present in the upstream Jackson 2.18.3 release when TuxCare onboarded it. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 12e23c962ffb on Dec 31, 2020, well before the 2.18.3 release. The vulnerable deserialization gadget class is blacklisted and cannot be instantiated during JSON deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T12:43:54.437566+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is not present in jackson-databind 2.18.3-tuxcare.3. The vulnerability concerns deserialization gadget classes in org.apache.tomcat.dbcp.dbcp2.datasources (PerUserPoolDataSource and SharedPoolDataSource) that were not blocked by Jackson's SubTypeValidator. The upstream fix by Tatu Saloranta (commit 567194c53a) added these classes to the blocklist, and this fix was already included in the upstream 2.18.3 release that TuxCare onboarded. The target's SubTypeValidator.java contains the required blocklist entries at lines 234-236, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 is not present in jackson-databind 2.18.3-tuxcare.3. The vulnerability concerns deserialization gadget classes in org.apache.tomcat.dbcp.dbcp2.datasources (PerUserPoolDataSource and SharedPoolDataSource) that were not blocked by Jackson's SubTypeValidator. The upstream fix by Tatu Saloranta (commit 567194c53a) added these classes to the blocklist, and this fix was already included in the upstream 2.18.3 release that TuxCare onboarded. The target's SubTypeValidator.java contains the required blocklist entries at lines 234-236, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:10:12.627525+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is not present in jackson-databind 2.18.3. The vulnerability concerns deserialization of malicious gadget classes org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) blocking these classes was already present in the upstream release 2.18.3 when TuxCare onboarded it. The target version is far newer than the affected range (2.x before 2.9.10.8), and the blocklist entries are present and actively enforced in SubTypeValidator.java lines 234-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 is not present in jackson-databind 2.18.3. The vulnerability concerns deserialization of malicious gadget classes org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) blocking these classes was already present in the upstream release 2.18.3 when TuxCare onboarded it. The target version is far newer than the affected range (2.x before 2.9.10.8), and the blocklist entries are present and actively enforced in SubTypeValidator.java lines 234-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:40:05.423100+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is a deserialization gadget vulnerability in jackson-databind versions before 2.9.10.8, involving org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target repository (jackson-databind 2.18.3-tuxcare.4) is not affected because the upstream fix (commit 3e8fa3beea by Tatu Saloranta) was already present in the 2.18.3 release when TuxCare onboarded it. The fix adds these class names to the deserialization blacklist in SubTypeValidator.java, preventing their exploitation as gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "CVE-2020-36186 is a deserialization gadget vulnerability in jackson-databind versions before 2.9.10.8, involving org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target repository (jackson-databind 2.18.3-tuxcare.4) is not affected because the upstream fix (commit 3e8fa3beea by Tatu Saloranta) was already present in the 2.18.3 release when TuxCare onboarded it. The fix adds these class names to the deserialization blacklist in SubTypeValidator.java, preventing their exploitation as gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:50:46.310411+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 does not affect jackson-databind 2.18.3-tuxcare.4. The vulnerability involves unsafe deserialization of tomcat-dbcp datasource classes (SharedPoolDataSource, PerUserPoolDataSource) that could lead to remote code execution via gadget chains. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta, Dec 26 2020) added these classes to a blocklist in SubTypeValidator.java. This fix was already present in upstream jackson-databind 2.18.3 when TuxCare onboarded it (commit 9a8ecec080a6343f2a25de9823898e789b0a7a1e, Sep 21 2026). The vulnerable pattern (missing blocklist entries) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "CVE-2020-36187 does not affect jackson-databind 2.18.3-tuxcare.4. The vulnerability involves unsafe deserialization of tomcat-dbcp datasource classes (SharedPoolDataSource, PerUserPoolDataSource) that could lead to remote code execution via gadget chains. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta, Dec 26 2020) added these classes to a blocklist in SubTypeValidator.java. This fix was already present in upstream jackson-databind 2.18.3 when TuxCare onboarded it (commit 9a8ecec080a6343f2a25de9823898e789b0a7a1e, Sep 21 2026). The vulnerable pattern (missing blocklist entries) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:58:22.317135+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability involves Jackson deserialization gadgets allowing JNDI injection through com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. The upstream fix (commit 33d96c13fe by Tatu Saloranta, 2020-12-26) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in the upstream 2.18.3 release when TuxCare onboarded it (first TuxCare commit: 9a8ecec080, \"Onboard version 2.18.3\"). The blocklist entries exist at SubTypeValidator.java:223-224 and are enforced via a non-bypassable static singleton that validates all bean deserializations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188 is NOT present in jackson-databind 2.18.3-tuxcare.4. The vulnerability involves Jackson deserialization gadgets allowing JNDI injection through com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. The upstream fix (commit 33d96c13fe by Tatu Saloranta, 2020-12-26) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in the upstream 2.18.3 release when TuxCare onboarded it (first TuxCare commit: 9a8ecec080, \"Onboard version 2.18.3\"). The blocklist entries exist at SubTypeValidator.java:223-224 and are enforced via a non-bypassable static singleton that validates all bean deserializations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:09:44.726673+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is NOT AFFECTING this target. The vulnerability involves deserialization gadgets (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) that could enable remote code execution. The fix (blocklisting these dangerous classes) was already present in the upstream jackson-databind 2.18.3 release that TuxCare onboarded. The blocklist entries appear at lines 223-224 in SubTypeValidator.java and are actively enforced during deserialization via BeanDeserializerFactory line 1103.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 is NOT AFFECTING this target. The vulnerability involves deserialization gadgets (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) that could enable remote code execution. The fix (blocklisting these dangerous classes) was already present in the upstream jackson-databind 2.18.3 release that TuxCare onboarded. The blocklist entries appear at lines 223-224 in SubTypeValidator.java and are actively enforced during deserialization via BeanDeserializerFactory line 1103.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:19:24.952513+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Version 2.18.3 is not affected by CVE-2020-36518. The vulnerable recursive deserialization code that enabled stack overflow attacks was replaced with a non-recursive, iteration-based implementation (UntypedObjectDeserializerNR) in upstream commit 8238ab41d0 (May 31, 2022) by Tatu Saloranta. This fix shipped in the upstream release before TuxCare onboarding (commit 9a8ecec080), making it an upstream vendor fix rather than a TuxCare backport. The non-recursive deserializer uses a while-loop with Scope objects to track nesting context, preventing stack overflow by avoiding recursive method calls entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "Version 2.18.3 is not affected by CVE-2020-36518. The vulnerable recursive deserialization code that enabled stack overflow attacks was replaced with a non-recursive, iteration-based implementation (UntypedObjectDeserializerNR) in upstream commit 8238ab41d0 (May 31, 2022) by Tatu Saloranta. This fix shipped in the upstream release before TuxCare onboarding (commit 9a8ecec080), making it an upstream vendor fix rather than a TuxCare backport. The non-recursive deserializer uses a while-loop with Scope objects to track nesting context, preventing stack overflow by avoiding recursive method calls entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:17:47.656427+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2020-8840. The vulnerability requires the absence of xbean-reflect/JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target already contains the upstream fix (commit 914e7c9f from Feb 2020) which blocks this class from deserialization. This fix was part of the upstream 2.18.3 release that TuxCare onboarded, making the target immune to this polymorphic deserialization gadget attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "Target jackson-databind 2.18.3-tuxcare.4 is not affected by CVE-2020-8840. The vulnerability requires the absence of xbean-reflect/JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target already contains the upstream fix (commit 914e7c9f from Feb 2020) which blocks this class from deserialization. This fix was part of the upstream 2.18.3 release that TuxCare onboarded, making the target immune to this polymorphic deserialization gadget attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 concerns a Jackson-databind deserialization gadget vulnerability where attackers could exploit polymorphic type handling to instantiate the dangerous class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target repository jackson-databind version 2.18.3-tuxcare.4 is NOT AFFECTED because the upstream vendor fix (commit 1e64db6a2f by Tatu Saloranta, dated Feb 29, 2020) that adds this class to the deserialization blacklist was already present in upstream release 2.10.4. TuxCare onboarded version 2.18.3 which included this fix. The blacklist entry is present at line 141 of SubTypeValidator.java and is actively enforced by the validateSubType method, blocking deserialization with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 concerns a Jackson-databind deserialization gadget vulnerability where attackers could exploit polymorphic type handling to instantiate the dangerous class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target repository jackson-databind version 2.18.3-tuxcare.4 is NOT AFFECTED because the upstream vendor fix (commit 1e64db6a2f by Tatu Saloranta, dated Feb 29, 2020) that adds this class to the deserialization blacklist was already present in upstream release 2.10.4. TuxCare onboarded version 2.18.3 which included this fix. The blacklist entry is present at line 141 of SubTypeValidator.java and is actively enforced by the validateSubType method, blocking deserialization with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:47:06.064229+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing denylist entry for the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target version 2.18.3-tuxcare.4 contains the upstream fix that was shipped in the 2.18.3 release. The vulnerable gadget class is present in the denylist at SubTypeValidator.java:144, preventing its deserialization. This is an upstream fix (authored by Tatu Saloranta, committed Feb 29, 2020) that was already included in the upstream 2.18.3 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing denylist entry for the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target version 2.18.3-tuxcare.4 contains the upstream fix that was shipped in the 2.18.3 release. The vulnerable gadget class is present in the denylist at SubTypeValidator.java:144, preventing its deserialization. This is an upstream fix (authored by Tatu Saloranta, committed Feb 29, 2020) that was already included in the upstream 2.18.3 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:21:06.039557+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7, concerning deserialization gadgets related to br.com.anteros.dbcp.AnterosDBCPConfig. The target version 2.18.3 already contains the upstream vendor fix (commit 1e64db6a2f by Tatu Saloranta) that adds this class to the SubTypeValidator blacklist, preventing its deserialization. The fix was shipped in the upstream release 2.18.3 before TuxCare onboarded it, therefore the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7, concerning deserialization gadgets related to br.com.anteros.dbcp.AnterosDBCPConfig. The target version 2.18.3 already contains the upstream vendor fix (commit 1e64db6a2f by Tatu Saloranta) that adds this class to the SubTypeValidator blacklist, preventing its deserialization. The fix was shipped in the upstream release 2.18.3 before TuxCare onboarded it, therefore the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:18:09.376674+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 affects jackson-databind versions before 2.9.10.7 and 2.6.7.5 due to deserialization gadgets (specifically javax.swing.JTextPane and javax.swing.JEditorPane from issue #2854). The target repository (jackson-databind 2.18.3-tuxcare.4) is NOT AFFECTED because the fix was already present in upstream release 2.18.3. The dangerous gadget classes are properly blocked in SubTypeValidator.java lines 149-151. The fix was authored by upstream developers (Tatu Saloranta and qxo) and shipped with the upstream release before TuxCare's onboarding commit (9a8ecec080). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 affects jackson-databind versions before 2.9.10.7 and 2.6.7.5 due to deserialization gadgets (specifically javax.swing.JTextPane and javax.swing.JEditorPane from issue #2854). The target repository (jackson-databind 2.18.3-tuxcare.4) is NOT AFFECTED because the fix was already present in upstream release 2.18.3. The dangerous gadget classes are properly blocked in SubTypeValidator.java lines 149-151. The fix was authored by upstream developers (Tatu Saloranta and qxo) and shipped with the upstream release before TuxCare's onboarding commit (9a8ecec080). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.3 is NOT vulnerable to CVE-2021-46877. The upstream fix (commit 3ccde7d938) was already included in the upstream 2.18.3 release before TuxCare onboarded it. The vulnerable code pattern (direct allocation of untrusted length in NodeSerialization.readExternal) has been replaced with protected chunked reading using ByteArrayBuilder for payloads exceeding 100KB. This is an upstream fix by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "The target jackson-databind version 2.18.3 is NOT vulnerable to CVE-2021-46877. The upstream fix (commit 3ccde7d938) was already included in the upstream 2.18.3 release before TuxCare onboarded it. The vulnerable code pattern (direct allocation of untrusted length in NodeSerialization.readExternal) has been replaced with protected chunked reading using ByteArrayBuilder for payloads exceeding 100KB. This is an upstream fix by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:51:09.392901+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 is NOT present in jackson-databind 2.18.3-tuxcare.4. The upstream fix was already included in the jackson-databind 2.18.3 release when TuxCare onboarded it. The fix prevents resource exhaustion from deeply nested JSON arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled by adding depth checks in primitive deserializers and BeanDeserializer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "CVE-2022-42003 is NOT present in jackson-databind 2.18.3-tuxcare.4. The upstream fix was already included in the jackson-databind 2.18.3 release when TuxCare onboarded it. The fix prevents resource exhaustion from deeply nested JSON arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled by adding depth checks in primitive deserializers and BeanDeserializer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:03:40.830954+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.3-tuxcare.4 is NOT AFFECTED by CVE-2022-42004. The upstream fix for preventing deeply nested array exhaustion when UNWRAP_SINGLE_VALUE_ARRAYS is enabled was already present in the upstream 2.18.3 release that TuxCare onboarded. The defense code at BeanDeserializer.java:650-659 checks for nested START_ARRAY tokens and rejects them with an error message, preventing unbounded recursive unwrapping that would lead to resource exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "The target jackson-databind 2.18.3-tuxcare.4 is NOT AFFECTED by CVE-2022-42004. The upstream fix for preventing deeply nested array exhaustion when UNWRAP_SINGLE_VALUE_ARRAYS is enabled was already present in the upstream 2.18.3 release that TuxCare onboarded. The defense code at BeanDeserializer.java:650-659 checks for nested START_ARRAY tokens and rejects them with an error message, preventing unbounded recursive unwrapping that would lead to resource exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-10-28T01:07:55.976356+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-05T10:36:00.485686+00:00", "status_notes": "Vulnerability CVE-2026-19032 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.5.", "vulnerability": { "name": "CVE-2026-19032" }, "action_statement": "Vulnerability CVE-2026-19032 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.5." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-02T20:23:31.994912+00:00", "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.18.3 is NOT AFFECTED by CVE-2026-50193. The vulnerability (stack overflow from recursive JsonNode serialization) was fixed in upstream version 2.14.0 via commit a1fa4ae4ec by Tatu Saloranta. Since 2.18.3 > 2.14.0, the fix was already present in the upstream release that TuxCare onboarded. The vulnerable recursive serialization pattern has been replaced with iterati...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50193" }, "impact_statement": "not_affected \u2014 The target jackson-databind 2.18.3 is NOT AFFECTED by CVE-2026-50193. The vulnerability (stack overflow from recursive JsonNode serialization) was fixed in upstream version 2.14.0 via commit a1fa4ae4ec by Tatu Saloranta. Since 2.18.3 > 2.14.0, the fix was already present in the upstream release that TuxCare onboarded. The vulnerable recursive serialization pattern has been replaced with iterati..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-10-30T13:04:00.119789+00:00", "status_notes": "Vulnerability CVE-2026-54512 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.3.", "vulnerability": { "name": "CVE-2026-54512" }, "action_statement": "Vulnerability CVE-2026-54512 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-10-30T13:04:00.119789+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.3.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-10-30T13:04:00.119789+00:00", "status_notes": "Vulnerability CVE-2026-54515 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.3.", "vulnerability": { "name": "CVE-2026-54515" }, "action_statement": "Vulnerability CVE-2026-54515 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-10T04:17:33.879237+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because unwrapped creator parameters are rejected during deserializer construction, preventing the vulnerable binding. src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:1020 rejects an unwrapped CreatorProperty, and src/main/java/com/fasterxml/jackson/databind/DeserializationContext.java:1887 throws InvalidDefinitionException.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because unwrapped creator parameters are rejected during deserializer construction, preventing the vulnerable binding. src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:1020 rejects an unwrapped CreatorProperty, and src/main/java/com/fasterxml/jackson/databind/DeserializationContext.java:1887 throws InvalidDefinitionException." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59888" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-10-30T13:04:00.119789+00:00", "status_notes": "Vulnerability CVE-2026-59889 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.3.", "vulnerability": { "name": "CVE-2026-59889" }, "action_statement": "Vulnerability CVE-2026-59889 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-01T14:01:00.116302+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.4.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-09T14:17:00.053533+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.6.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-05T10:36:00.485686+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.5.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-01T14:01:00.116302+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.4.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-11-05T10:36:00.485686+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.5.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" }, "action_statement": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.18.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.3-tuxcare.5." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3-tuxcare.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.18.3-tuxcare.2.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }