{ "@id": "urn:uuid:60874510-ffe0-4b16-b51d-f97876054b55", "role": "Document Creator", "author": "https://tuxcare.com", "version": 80, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:17:33.879237+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T13:19:28.539186+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.18.4-tuxcare.3, which already contains the upstream fix from 2017. The vulnerability allowed arbitrary code execution through polymorphic deserialization of malicious class names. The fix introduced a blacklist (DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator) that blocks dangerous classes. All classes from CVE-2017-15095 (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, and C3P0 DataSource classes) are present in the target's blacklist. The fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.18.4-tuxcare.3, which already contains the upstream fix from 2017. The vulnerability allowed arbitrary code execution through polymorphic deserialization of malicious class names. The fix introduced a blacklist (DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator) that blocks dangerous classes. All classes from CVE-2017-15095 (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, and C3P0 DataSource classes) are present in the target's blacklist. The fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T15:50:08.266665+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.18.4 contains the complete fix that was shipped in upstream releases 2.8.11 and 2.9.4. The fix adds Spring framework classes (AbstractPointcutAdvisor, AbstractApplicationContext, PropertyPathFactoryBean), C3P0 connection pool classes, JDK types (FileHandler, UnicastRemoteObject), and others to the deserialization blacklist in SubTypeValidator. The fix was authored by upstream maintainers and was already present when TuxCare onboarded version 2.18.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.18.4 contains the complete fix that was shipped in upstream releases 2.8.11 and 2.9.4. The fix adds Spring framework classes (AbstractPointcutAdvisor, AbstractApplicationContext, PropertyPathFactoryBean), C3P0 connection pool classes, JDK types (FileHandler, UnicastRemoteObject), and others to the deserialization blacklist in SubTypeValidator. The fix was authored by upstream maintainers and was already present when TuxCare onboarded version 2.18.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T14:39:42.552241+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9 due to unsafe deserialization of gadget classes that enable remote code execution. The target repository (jackson-databind 2.18.4-tuxcare.3) is not affected because the upstream vendor already shipped the fix in version 2.8.11 (December 2017), which introduced SubTypeValidator with a comprehensive blocklist of dangerous classes including all those exploited by CVE-2017-7525. This defense has been part of upstream jackson-databind for 7+ years and was present in the 2.18.4 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9 due to unsafe deserialization of gadget classes that enable remote code execution. The target repository (jackson-databind 2.18.4-tuxcare.3) is not affected because the upstream vendor already shipped the fix in version 2.8.11 (December 2017), which introduced SubTypeValidator with a comprehensive blocklist of dangerous classes including all those exploited by CVE-2017-7525. This defense has been part of upstream jackson-databind for 7+ years and was present in the 2.18.4 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T13:24:51.671524+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.18.4-tuxcare.3 is not affected by CVE-2018-11307. The vulnerability affects jackson-databind 2.0.0 through 2.9.5 and was fixed in upstream versions 2.7.9.4, 2.8.11.2, and 2.9.6. The target version (2.18.4) is significantly newer and contains the upstream fix. The fix (commit 27b4defc27 by tatu.saloranta@iki.fi, May 2018) blacklists org.apache.ibatis.parsing.XPathParser in SubTypeValidator.java line 65, preventing deserialization of the dangerous iBatis gadget class. This fix was already present in the upstream 2.18.4 release that TuxCare onboarded in September 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "Target version 2.18.4-tuxcare.3 is not affected by CVE-2018-11307. The vulnerability affects jackson-databind 2.0.0 through 2.9.5 and was fixed in upstream versions 2.7.9.4, 2.8.11.2, and 2.9.6. The target version (2.18.4) is significantly newer and contains the upstream fix. The fix (commit 27b4defc27 by tatu.saloranta@iki.fi, May 2018) blacklists org.apache.ibatis.parsing.XPathParser in SubTypeValidator.java line 65, preventing deserialization of the dangerous iBatis gadget class. This fix was already present in the upstream 2.18.4 release that TuxCare onboarded in September 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target is version 2.18.4-tuxcare.3, which is significantly newer. The vulnerability involved polymorphic deserialization gadgets (Jodd-db and Oracle JDBC classes) that enabled JNDI/LDAP injection leading to RCE when Default Typing was enabled. The upstream fix added three class names to SubTypeValidator's blocklist. This fix is present in the target at SubTypeValidator.java lines 67-72, having been applied by upstream maintainer Tatu Saloranta in June 2018 (commit 28badf7ef6). The fix shipped in upstream release 2.7.9.4 and was already present when TuxCare onboarded version 2.18.4 in September 2026, 8+ years later.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target is version 2.18.4-tuxcare.3, which is significantly newer. The vulnerability involved polymorphic deserialization gadgets (Jodd-db and Oracle JDBC classes) that enabled JNDI/LDAP injection leading to RCE when Default Typing was enabled. The upstream fix added three class names to SubTypeValidator's blocklist. This fix is present in the target at SubTypeValidator.java lines 67-72, having been applied by upstream maintainer Tatu Saloranta in June 2018 (commit 28badf7ef6). The fix shipped in upstream release 2.7.9.4 and was already present when TuxCare onboarded version 2.18.4 in September 2026, 8+ years later.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T16:28:57.615729+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.18.4. The vulnerability involved polymorphic deserialization of Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled, enabling JNDI/LDAP injection for remote code execution. The upstream fix (commit 28badf7ef6) added these classes to the SubTypeValidator blacklist and was already included in jackson-databind 2.18.4 when TuxCare onboarded that version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.18.4. The vulnerability involved polymorphic deserialization of Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled, enabling JNDI/LDAP injection for remote code execution. The upstream fix (commit 28badf7ef6) added these classes to the SubTypeValidator blacklist and was already included in jackson-databind 2.18.4 when TuxCare onboarded that version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T14:06:14.080942+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability requires jackson-databind to allow polymorphic deserialization of org.slf4j.ext.EventData and related dangerous classes. The target contains the upstream fix (commit 87d29af25e) which adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 74-78). This blocklist prevents deserialization of the dangerous classes by throwing a JsonMappingException with \"Illegal type to deserialize: prevented for security reasons\". The fix was present in upstream release 2.18.4 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability requires jackson-databind to allow polymorphic deserialization of org.slf4j.ext.EventData and related dangerous classes. The target contains the upstream fix (commit 87d29af25e) which adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 74-78). This blocklist prevents deserialization of the dangerous classes by throwing a JsonMappingException with \"Illegal type to deserialize: prevented for security reasons\". The fix was present in upstream release 2.18.4 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T16:06:30.945793+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves missing blocklist entries for dangerous BlazeDS classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and others) that enable arbitrary code execution via polymorphic deserialization. The target already contains the upstream fix from commit 87d29af by Tatu Saloranta, which adds these four classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. This fix was shipped in the upstream 2.18.4 release before TuxCare onboarding (first TuxCare commit: 60252728ea).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves missing blocklist entries for dangerous BlazeDS classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and others) that enable arbitrary code execution via polymorphic deserialization. The target already contains the upstream fix from commit 87d29af by Tatu Saloranta, which adds these four classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. This fix was shipped in the upstream 2.18.4 release before TuxCare onboarding (first TuxCare commit: 60252728ea).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T14:12:30.909844+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 targets jackson-databind versions before 2.9.7, allowing XXE attacks via polymorphic deserialization of unblocked JDK classes. The target (jackson-databind 2.18.4-tuxcare.3) contains the upstream fix that blocks the four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES. The fix was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 and was already present in the upstream 2.18.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 targets jackson-databind versions before 2.9.7, allowing XXE attacks via polymorphic deserialization of unblocked JDK classes. The target (jackson-databind 2.18.4-tuxcare.3) contains the upstream fix that blocks the four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES. The fix was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 and was already present in the upstream 2.18.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T14:41:24.721852+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl enabling SSRF attacks. The fix (blocklist entry for this class) was included in upstream release 2.9.7, and the target version 2.18.4 is 9 major versions newer. The defense is present in SubTypeValidator.java line 78 and enforced unconditionally during deserialization at BeanDeserializerFactory.java line 1103. Fix commit 0899726ec34 by upstream maintainer Tatu Saloranta was already present when TuxCare onboarded version 2.18.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl enabling SSRF attacks. The fix (blocklist entry for this class) was included in upstream release 2.9.7, and the target version 2.18.4 is 9 major versions newer. The defense is present in SubTypeValidator.java line 78 and enforced unconditionally during deserialization at BeanDeserializerFactory.java line 1103. Fix commit 0899726ec34 by upstream maintainer Tatu Saloranta was already present when TuxCare onboarded version 2.18.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T13:01:12.948527+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is not present in jackson-databind 2.18.4. The vulnerability involves polymorphic deserialization of the org.apache.axis2.transport.jms.JMSOutTransportInfo gadget class. The fix (adding this class to the SubTypeValidator blocklist) was implemented by upstream author Tatu Saloranta in commit 72cd4025a2 and was already present in the upstream release that TuxCare onboarded. The blocklist entry exists at line 85 of SubTypeValidator.java, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 is not present in jackson-databind 2.18.4. The vulnerability involves polymorphic deserialization of the org.apache.axis2.transport.jms.JMSOutTransportInfo gadget class. The fix (adding this class to the SubTypeValidator blocklist) was implemented by upstream author Tatu Saloranta in commit 72cd4025a2 and was already present in the upstream release that TuxCare onboarded. The blocklist entry exists at line 85 of SubTypeValidator.java, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T17:06:16.056250+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.4-tuxcare.3 is not affected by CVE-2018-19361. The vulnerability concerns polymorphic deserialization of dangerous openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime). The fix\u2014adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java\u2014was already present in upstream release 2.18.4 that TuxCare onboarded. The blocklist is active by default and automatically invoked during bean deserialization, preventing instantiation of these dangerous classes. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "The target jackson-databind 2.18.4-tuxcare.3 is not affected by CVE-2018-19361. The vulnerability concerns polymorphic deserialization of dangerous openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime). The fix\u2014adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java\u2014was already present in upstream release 2.18.4 that TuxCare onboarded. The blocklist is active by default and automatically invoked during bean deserialization, preventing instantiation of these dangerous classes. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T15:30:53.892571+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability concerns the ability to exploit polymorphic deserialization using the jboss-common-core class `org.jboss.util.propertyeditor.DocumentEditor`. The upstream fix (commit 72cd4025a2 from November 2018) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.18.4 when TuxCare onboarded it in commit 60252728ea. The target code at line 81 of SubTypeValidator.java contains the blocklist entry, and the validateSubType method (lines 269-303) actively enforces this blocklist by rejecting deserialization attempts with \"prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability concerns the ability to exploit polymorphic deserialization using the jboss-common-core class `org.jboss.util.propertyeditor.DocumentEditor`. The upstream fix (commit 72cd4025a2 from November 2018) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.18.4 when TuxCare onboarded it in commit 60252728ea. The target code at line 81 of SubTypeValidator.java contains the blocklist entry, and the validateSubType method (lines 269-303) actively enforces this blocklist by rejecting deserialization attempts with \"prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability allowed RCE via two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed the deserialization blacklist. The fix, which adds these classes to the blacklist in SubTypeValidator.java, was already present in the upstream release 2.18.4 before TuxCare onboarding (commit 038b471e2ef by upstream maintainer Tatu Saloranta, dated 2018-01-21). The blacklist entries are present at lines 62-63 and are enforced in the core deserialization path via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability allowed RCE via two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed the deserialization blacklist. The fix, which adds these classes to the blacklist in SubTypeValidator.java, was already present in the upstream release 2.18.4 before TuxCare onboarding (commit 038b471e2ef by upstream maintainer Tatu Saloranta, dated 2018-01-21). The blacklist entries are present at lines 62-63 and are enforced in the core deserialization path via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T14:04:52.776712+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target repository jackson-databind 2.18.4-tuxcare.3 is NOT AFFECTED by CVE-2018-7489. The vulnerability (incomplete fix for CVE-2017-7525 allowing c3p0 gadget exploitation) was fixed in upstream commit 6799f8f10c (Fix #1931) which shipped in the upstream release 2.7.9.3 (February 2018). The target version 2.18.4 is much newer and already contains the fix in SubTypeValidator.java. The fix blocks deserialization of classes under `com.mchange.v2.c3p0.` prefix ending with \"DataSource\". This is an upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "Target repository jackson-databind 2.18.4-tuxcare.3 is NOT AFFECTED by CVE-2018-7489. The vulnerability (incomplete fix for CVE-2017-7525 allowing c3p0 gadget exploitation) was fixed in upstream commit 6799f8f10c (Fix #1931) which shipped in the upstream release 2.7.9.3 (February 2018). The target version 2.18.4 is much newer and already contains the fix in SubTypeValidator.java. The fix blocks deserialization of classes under `com.mchange.v2.c3p0.` prefix ending with \"DataSource\". This is an upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T16:38:23.121558+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves polymorphic deserialization of the MySQL connector gadget class `com.mysql.cj.jdbc.admin.MiniAdmin`. The fix (adding MiniAdmin to the SubTypeValidator blocklist) was implemented by the upstream FasterXML maintainer (Tatu Saloranta) in commit dda513bd725 and shipped in the upstream release 2.18.4, which TuxCare subsequently onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves polymorphic deserialization of the MySQL connector gadget class `com.mysql.cj.jdbc.admin.MiniAdmin`. The fix (adding MiniAdmin to the SubTypeValidator blocklist) was implemented by the upstream FasterXML maintainer (Tatu Saloranta) in commit dda513bd725 and shipped in the upstream release 2.18.4, which TuxCare subsequently onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-01T18:57:00.102490+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 by allowing polymorphic deserialization of the dangerous class ch.qos.logback.core.db.DriverManagerConnectionSource, potentially leading to arbitrary code execution. The target version 2.18.4-tuxcare.3 already includes the upstream fix: the class is present in the deserialization blocklist at SubTypeValidator.java line 91. This fix...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 by allowing polymorphic deserialization of the dangerous class ch.qos.logback.core.db.DriverManagerConnectionSource, potentially leading to arbitrary code execution. The target version 2.18.4-tuxcare.3 already includes the upstream fix: the class is present in the deserialization blocklist at SubTypeValidator.java line 91. This fix..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-02T07:36:00.279006+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes that can lead to arbitrary file reads. The upstream vendor (FasterXML) fixed this in commit 5f7c69bba07 (June 2019) by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeV...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes that can lead to arbitrary file reads. The upstream vendor (FasterXML) fixed this in commit 5f7c69bba07 (June 2019) by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeV..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T12:21:26.071673+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves missing blacklist entries for dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that could enable remote code execution via polymorphic deserialization. The fix was applied in upstream commit ad418eeb97 (July 2019) and was already present in upstream version 2.18.4 when TuxCare onboarded it. The target contains the complete fix: both dangerous classes are blacklisted in SubTypeValidator.java lines 98 and 102, and the validation is mandatory and cannot be disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves missing blacklist entries for dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that could enable remote code execution via polymorphic deserialization. The fix was applied in upstream commit ad418eeb97 (July 2019) and was already present in upstream version 2.18.4 when TuxCare onboarded it. The target contains the complete fix: both dangerous classes are blacklisted in SubTypeValidator.java lines 98 and 102, and the validation is mandatory and cannot be disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T13:52:54.438603+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.4-tuxcare.3) is not affected by CVE-2019-14439. The vulnerability was fixed in the upstream release by adding the dangerous class ch.qos.logback.core.db.JNDIConnectionSource to the deserialization blacklist in SubTypeValidator.java. This fix was already present when TuxCare onboarded version 2.18.4, as confirmed by git ancestry analysis showing the fix commit (ad418eeb97) predates the first TuxCare onboarding commit (60252728ea).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "The target repository (jackson-databind 2.18.4-tuxcare.3) is not affected by CVE-2019-14439. The vulnerability was fixed in the upstream release by adding the dangerous class ch.qos.logback.core.db.JNDIConnectionSource to the deserialization blacklist in SubTypeValidator.java. This fix was already present when TuxCare onboarded version 2.18.4, as confirmed by git ancestry analysis showing the fix commit (ad418eeb97) predates the first TuxCare onboarding commit (60252728ea).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T16:54:24.400671+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10 due to a polymorphic typing vulnerability related to com.zaxxer.hikari.HikariConfig. The target version (2.18.4-tuxcare.3) is NOT affected because the upstream fix was already present in the upstream release 2.18.4 that TuxCare onboarded. Both HikariConfig and HikariDataSource are in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 105, 107), preventing their polymorphic deserialization. The fix commits (d4983c740f, 73c1c2cc76) were authored by upstream maintainer Tatu Saloranta and are ancestors of the first TuxCare commit (60252728ea \"Onboard version 2.18.4\"), confirming this is an upstream fix that shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10 due to a polymorphic typing vulnerability related to com.zaxxer.hikari.HikariConfig. The target version (2.18.4-tuxcare.3) is NOT affected because the upstream fix was already present in the upstream release 2.18.4 that TuxCare onboarded. Both HikariConfig and HikariDataSource are in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 105, 107), preventing their polymorphic deserialization. The fix commits (d4983c740f, 73c1c2cc76) were authored by upstream maintainer Tatu Saloranta and are ancestors of the first TuxCare commit (60252728ea \"Onboard version 2.18.4\"), confirming this is an upstream fix that shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T16:01:48.562174+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.18.4-tuxcare.3 is NOT affected by CVE-2019-14892. The vulnerability was fixed in upstream commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af (September 19, 2019) by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator denylist. This fix was already present in the upstream 2.18.4 release when TuxCare onboarded it on September 21, 2026 (commit 60252728ea). The target's SubTypeValidator.java contains the fix at lines 112-114, preventing polymorphic deserialization of these dangerous JNDI classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "The target repository jackson-databind 2.18.4-tuxcare.3 is NOT affected by CVE-2019-14892. The vulnerability was fixed in upstream commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af (September 19, 2019) by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator denylist. This fix was already present in the upstream 2.18.4 release when TuxCare onboarded it on September 21, 2026 (commit 60252728ea). The target's SubTypeValidator.java contains the fix at lines 112-114, preventing polymorphic deserialization of these dangerous JNDI classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.18.4-tuxcare.3 is NOT vulnerable to CVE-2019-14893. The vulnerability, which allowed arbitrary code execution via polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool), was fixed in upstream commit 998efd708284778f29d83d7962a9bd935c228317. This fix added the dangerous class to the deserialization blocklist in SubTypeValidator.java and was already present in the upstream release 2.18.4 before TuxCare onboarded it. The blocklist defense is active and enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "The target repository jackson-databind version 2.18.4-tuxcare.3 is NOT vulnerable to CVE-2019-14893. The vulnerability, which allowed arbitrary code execution via polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool), was fixed in upstream commit 998efd708284778f29d83d7962a9bd935c228317. This fix added the dangerous class to the deserialization blocklist in SubTypeValidator.java and was already present in the upstream release 2.18.4 before TuxCare onboarded it. The blocklist defense is active and enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T17:10:39.097044+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 concerns polymorphic deserialization of com.zaxxer.hikari.HikariDataSource in jackson-databind. The target repository (jackson-databind 2.18.4-tuxcare.3) already contains the upstream fix (commit 73c1c2cc76e) that adds HikariDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was shipped in the upstream 2.18.4 release before TuxCare onboarded it, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 concerns polymorphic deserialization of com.zaxxer.hikari.HikariDataSource in jackson-databind. The target repository (jackson-databind 2.18.4-tuxcare.3) already contains the upstream fix (commit 73c1c2cc76e) that adds HikariDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was shipped in the upstream 2.18.4 release before TuxCare onboarded it, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T15:14:13.800446+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind 2.0.0 through 2.9.10 due to unsafe deserialization of org.apache.commons.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource classes. The target version 2.18.4-tuxcare.3 contains the upstream fix (commit 9593e16cf5) that was committed on September 28, 2019 by Tatu Saloranta. Both dangerous classes are present in the deserialization blocklist in SubTypeValidator.java (lines 124-125), preventing their instantiation even when Default Typing is enabled. This fix was already included in the upstream 2.18.4 release that TuxCare onboarded, confirmed by verifying the fix commit is an ancestor of the first TuxCare commit (60252728ea).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 affects jackson-databind 2.0.0 through 2.9.10 due to unsafe deserialization of org.apache.commons.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource classes. The target version 2.18.4-tuxcare.3 contains the upstream fix (commit 9593e16cf5) that was committed on September 28, 2019 by Tatu Saloranta. Both dangerous classes are present in the deserialization blocklist in SubTypeValidator.java (lines 124-125), preventing their instantiation even when Default Typing is enabled. This fix was already included in the upstream 2.18.4 release that TuxCare onboarded, confirmed by verifying the fix commit is an ancestor of the first TuxCare commit (60252728ea).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T17:22:22.486046+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 affects jackson-databind's polymorphic typing feature when Default Typing is enabled, allowing deserialization of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp classes) that can lead to remote code execution. The target repository (jackson-databind 2.18.4-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already included in the 2.18.4 release that TuxCare onboarded. The fix adds the dangerous class names to a blacklist in SubTypeValidator.java (lines 124-127), preventing their deserialization. The defense is actively enforced via validateSubType() during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 affects jackson-databind's polymorphic typing feature when Default Typing is enabled, allowing deserialization of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp classes) that can lead to remote code execution. The target repository (jackson-databind 2.18.4-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already included in the 2.18.4 release that TuxCare onboarded. The fix adds the dangerous class names to a blacklist in SubTypeValidator.java (lines 124-127), preventing their deserialization. The defense is actively enforced via validateSubType() during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T15:30:53.892571+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is NOT present in jackson-databind 2.18.4-tuxcare.3. The fix (blocklisting net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup in SubTypeValidator.java line 99) was included in the upstream 2.18.4 release that TuxCare onboarded. The vulnerability affects versions before 2.9.10/2.8.11.5, and the fix first appeared in upstream version 2.10.0. The target version 2.18.4 is 8 major versions newer and contains the upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 191a4cdf87.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 is NOT present in jackson-databind 2.18.4-tuxcare.3. The fix (blocklisting net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup in SubTypeValidator.java line 99) was included in the upstream 2.18.4 release that TuxCare onboarded. The vulnerability affects versions before 2.9.10/2.8.11.5, and the fix first appeared in upstream version 2.10.0. The target version 2.18.4 is 8 major versions newer and contains the upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 191a4cdf87.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T14:51:40.336684+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability concerns deserialization of dangerous log4j-extras classes (JNDIConnectionSource, DriverManagerConnectionSource) that can trigger JNDI-based code execution. The fix (commit b5a304a985) that adds these classes to SubTypeValidator's blocklist was already included in upstream version 2.18.4 before TuxCare onboarded it. The blocklist entries are present at lines 130-131 of SubTypeValidator.java and actively prevent deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability concerns deserialization of dangerous log4j-extras classes (JNDIConnectionSource, DriverManagerConnectionSource) that can trigger JNDI-based code execution. The fix (commit b5a304a985) that adds these classes to SubTypeValidator's blocklist was already included in upstream version 2.18.4 before TuxCare onboarded it. The blocklist entries are present at lines 130-131 of SubTypeValidator.java and actively prevent deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is not present in jackson-databind 2.18.4. The vulnerability involves missing deserialization blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that could enable JNDI injection attacks. The fix was already included in the upstream release 2.18.4 via commit fc4214a883, authored by Tatu Saloranta (tatu.saloranta@iki.fi), before TuxCare onboarded this version. The blocklist entries are present in SubTypeValidator.java at lines 133-135.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 is not present in jackson-databind 2.18.4. The vulnerability involves missing deserialization blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that could enable JNDI injection attacks. The fix was already included in the upstream release 2.18.4 via commit fc4214a883, authored by Tatu Saloranta (tatu.saloranta@iki.fi), before TuxCare onboarded this version. The blocklist entries are present in SubTypeValidator.java at lines 133-135.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T17:09:41.975072+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.4-tuxcare.3 is NOT AFFECTED by CVE-2020-10650. The vulnerability was fixed in upstream version 2.9.10.4 (released March 2020) by adding three ignite-jta and quartz classes to the deserialization blocklist in SubTypeValidator.java. The target version 2.18.4 already contains this upstream fix (commit a424c038ba0c0d65e579e22001dec925902ac0ef by Tatu Saloranta), which was shipped in the upstream release before TuxCare onboarding. The vulnerable code pattern (ability to deserialize CacheJndiTmLookup, CacheJndiTmFactory, and JNDIConnectionProvider) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "The target jackson-databind version 2.18.4-tuxcare.3 is NOT AFFECTED by CVE-2020-10650. The vulnerability was fixed in upstream version 2.9.10.4 (released March 2020) by adding three ignite-jta and quartz classes to the deserialization blocklist in SubTypeValidator.java. The target version 2.18.4 already contains this upstream fix (commit a424c038ba0c0d65e579e22001dec925902ac0ef by Tatu Saloranta), which was shipped in the upstream release before TuxCare onboarding. The vulnerable code pattern (ability to deserialize CacheJndiTmLookup, CacheJndiTmFactory, and JNDIConnectionProvider) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entries for deserialization gadget classes org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and RecoverablePooledConnectionFactory. The target repository (jackson-databind 2.18.4-tuxcare.3) is NOT AFFECTED because the upstream vendor (FasterXML) fixed this vulnerability in March 2020 (commits 592872f4235 and 1645efbd392), and the fix was already present in the upstream 2.18.4 release that TuxCare onboarded in October 2024. The vulnerable gadget classes are blacklisted in SubTypeValidator.java at lines 162-164, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entries for deserialization gadget classes org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and RecoverablePooledConnectionFactory. The target repository (jackson-databind 2.18.4-tuxcare.3) is NOT AFFECTED because the upstream vendor (FasterXML) fixed this vulnerability in March 2020 (commits 592872f4235 and 1645efbd392), and the fix was already present in the upstream 2.18.4 release that TuxCare onboarded in October 2024. The vulnerable gadget classes are blacklisted in SubTypeValidator.java at lines 162-164, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T16:36:34.248507+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.4-tuxcare.3 is not affected by CVE-2020-10673. The vulnerability concerns deserialization of the gadget class com.caucho.config.types.ResourceRef, which could lead to arbitrary code execution. However, this class is already present in the blocklist (DEFAULT_NO_DESER_CLASS_NAMES) at line 167 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta (commit 1645efbd39) and was already included in the upstream release 2.18.4 before TuxCare onboarded it. The CVE affected versions \"before 2.9.10.4\", and version 2.18.4 is well beyond that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "The target jackson-databind version 2.18.4-tuxcare.3 is not affected by CVE-2020-10673. The vulnerability concerns deserialization of the gadget class com.caucho.config.types.ResourceRef, which could lead to arbitrary code execution. However, this class is already present in the blocklist (DEFAULT_NO_DESER_CLASS_NAMES) at line 167 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta (commit 1645efbd39) and was already included in the upstream release 2.18.4 before TuxCare onboarded it. The CVE affected versions \"before 2.9.10.4\", and version 2.18.4 is well beyond that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability allowed deserialization of dangerous gadget classes (org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider) leading to RCE. The upstream fix, which blocks these classes in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, was already present in the jackson-databind 2.18.4 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in commit 05d7e0e13f4 (March 2020), which predates the first TuxCare commit by 3,355 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability allowed deserialization of dangerous gadget classes (org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider) leading to RCE. The upstream fix, which blocks these classes in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, was already present in the jackson-databind 2.18.4 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in commit 05d7e0e13f4 (March 2020), which predates the first TuxCare commit by 3,355 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.18.4-tuxcare.3 is NOT affected by CVE-2020-10969. The upstream fix that blocks deserialization of javax.swing.JEditorPane was already present in the upstream release 2.18.4 before TuxCare onboarded it. The vulnerable pattern (unrestricted deserialization of the JEditorPane gadget class) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "The target repository jackson-databind version 2.18.4-tuxcare.3 is NOT affected by CVE-2020-10969. The upstream fix that blocks deserialization of javax.swing.JEditorPane was already present in the upstream release 2.18.4 before TuxCare onboarded it. The vulnerable pattern (unrestricted deserialization of the JEditorPane gadget class) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 concerns jackson-databind's deserialization of org.apache.activemq.* classes as serialization gadgets. The target version 2.18.4-tuxcare.3 already contains the upstream fix that blocklists all 9 activemq connection factory classes in SubTypeValidator.java (lines 173-183). The fix was introduced by upstream commit c14c9f99ed (author: tatu.saloranta@iki.fi) and shipped in the upstream 2.18.4 release before TuxCare onboarding. The vulnerable pattern (deserializing activemq classes without blocklist protection) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "CVE-2020-11111 concerns jackson-databind's deserialization of org.apache.activemq.* classes as serialization gadgets. The target version 2.18.4-tuxcare.3 already contains the upstream fix that blocklists all 9 activemq connection factory classes in SubTypeValidator.java (lines 173-183). The fix was introduced by upstream commit c14c9f99ed (author: tatu.saloranta@iki.fi) and shipped in the upstream 2.18.4 release before TuxCare onboarding. The vulnerable pattern (deserializing activemq classes without blocklist protection) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.18.4 is not affected by CVE-2020-11112. The vulnerability involves deserialization of the gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The fix (commit 05d7e0e13f) adds this class to the SubTypeValidator blocklist at line 186, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.18.4 that TuxCare onboarded, not added by TuxCare as a backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "Target version 2.18.4 is not affected by CVE-2020-11112. The vulnerability involves deserialization of the gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The fix (commit 05d7e0e13f) adds this class to the SubTypeValidator blocklist at line 186, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.18.4 that TuxCare onboarded, not added by TuxCare as a backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.4-tuxcare.3 is NOT AFFECTED by CVE-2020-11113. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime through Jackson's polymorphic type handling, which could lead to remote code execution. The fix (blocking this class in SubTypeValidator) is present in the target at line 84 of SubTypeValidator.java. This fix was introduced in upstream jackson-databind 2.9.10.4 (commit e2ba12d5d6, March 2020) by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), and was already included in the upstream 2.18.4 release that TuxCare onboarded. The target version 2.18.4 is much newer than the affected versions (2.x before 2.9.10.4), and the blocklist defense is active by default in SubTypeValidator.validateSubType(), which rejects deserialization with \"Illegal type to deserialize: prevented for security reasons\" when this gadget class is encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "Target jackson-databind 2.18.4-tuxcare.3 is NOT AFFECTED by CVE-2020-11113. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime through Jackson's polymorphic type handling, which could lead to remote code execution. The fix (blocking this class in SubTypeValidator) is present in the target at line 84 of SubTypeValidator.java. This fix was introduced in upstream jackson-databind 2.9.10.4 (commit e2ba12d5d6, March 2020) by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), and was already included in the upstream 2.18.4 release that TuxCare onboarded. The target version 2.18.4 is much newer than the affected versions (2.x before 2.9.10.4), and the blocklist defense is active by default in SubTypeValidator.validateSubType(), which rejects deserialization with \"Illegal type to deserialize: prevented for security reasons\" when this gadget class is encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.4-tuxcare.3 is NOT affected by CVE-2020-11619. The vulnerability pattern (missing blocklist for Spring deserialization gadgets MethodLocatingFactoryBean and BeanReferenceFactoryBean) was removed by upstream vendor in commit 113e89fb08 (April 6, 2020), which shipped in upstream release 2.10.4 and all later versions including 2.18.4. The TuxCare onboarding inherited this fix from upstream. The blocklist entries are present at SubTypeValidator.java:52-54, preventing instantiation of these gadget classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "The target jackson-databind 2.18.4-tuxcare.3 is NOT affected by CVE-2020-11619. The vulnerability pattern (missing blocklist for Spring deserialization gadgets MethodLocatingFactoryBean and BeanReferenceFactoryBean) was removed by upstream vendor in commit 113e89fb08 (April 6, 2020), which shipped in upstream release 2.10.4 and all later versions including 2.18.4. The TuxCare onboarding inherited this fix from upstream. The blocklist entries are present at SubTypeValidator.java:52-54, preventing instantiation of these gadget classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 does not affect this target. The vulnerability involves Jackson's deserialization of the gadget class org.apache.commons.jelly.impl.Embedded. The fix (blocking this class in SubTypeValidator) is present at line 189 of SubTypeValidator.java. This fix was part of upstream Jackson 2.18.4 release (commit 77040d85e3 by Tatu Saloranta), included before TuxCare onboarded the version. The validation logic is active and enforced in the deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 does not affect this target. The vulnerability involves Jackson's deserialization of the gadget class org.apache.commons.jelly.impl.Embedded. The fix (blocking this class in SubTypeValidator) is present at line 189 of SubTypeValidator.java. This fix was part of upstream Jackson 2.18.4 release (commit 77040d85e3 by Tatu Saloranta), included before TuxCare onboarded the version. The validation logic is active and enforced in the deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not present in jackson-databind 2.18.4. The vulnerability involves deserialization of the dangerous gadget class 'oadd.org.apache.xalan.lib.sql.JNDIConnectionPool' which can lead to remote code execution via JNDI injection. The fix (adding this class to the SubTypeValidator blocklist) was authored by upstream maintainer Tatu Saloranta in commit d1c67a0396 on 2020-04-24 and shipped in the upstream 2.18.4 release. The blocklist entry is present at SubTypeValidator.java:192, preventing deserialization of this gadget class. Target version 2.18.4 is well above the affected range (before 2.9.10.5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 is not present in jackson-databind 2.18.4. The vulnerability involves deserialization of the dangerous gadget class 'oadd.org.apache.xalan.lib.sql.JNDIConnectionPool' which can lead to remote code execution via JNDI injection. The fix (adding this class to the SubTypeValidator blocklist) was authored by upstream maintainer Tatu Saloranta in commit d1c67a0396 on 2020-04-24 and shipped in the upstream 2.18.4 release. The blocklist entry is present at SubTypeValidator.java:192, preventing deserialization of this gadget class. Target version 2.18.4 is well above the affected range (before 2.9.10.5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 affects jackson-databind 2.x before 2.9.10.5 via oracle.jms deserialization gadgets. The target version 2.18.4-tuxcare.3 already contains the upstream fix (commit 5c8642aeae by Tatu Saloranta, April 2020) which adds oracle.jms.AQjms* classes to the SubTypeValidator blacklist. This fix shipped in the upstream release 2.18.4 that TuxCare onboarded, predating all TuxCare commits on this branch. The vulnerable pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "CVE-2020-14061 affects jackson-databind 2.x before 2.9.10.5 via oracle.jms deserialization gadgets. The target version 2.18.4-tuxcare.3 already contains the upstream fix (commit 5c8642aeae by Tatu Saloranta, April 2020) which adds oracle.jms.AQjms* classes to the SubTypeValidator blacklist. This fix shipped in the upstream release 2.18.4 that TuxCare onboarded, predating all TuxCare commits on this branch. The vulnerable pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is NOT present in jackson-databind 2.18.4. The vulnerability concerns deserialization of the gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The upstream fix (commit 840eae2ca8 by Tatu Saloranta, May 2020) added this class to the deserialization blacklist in SubTypeValidator.java, and this fix was already included in the upstream jackson-databind 2.18.4 release that TuxCare onboarded. The blacklist entry is present at line 119 and is enforced during deserialization via BeanDeserializerFactory, preventing instantiation of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 is NOT present in jackson-databind 2.18.4. The vulnerability concerns deserialization of the gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The upstream fix (commit 840eae2ca8 by Tatu Saloranta, May 2020) added this class to the deserialization blacklist in SubTypeValidator.java, and this fix was already included in the upstream jackson-databind 2.18.4 release that TuxCare onboarded. The blacklist entry is present at line 119 and is enforced during deserialization via BeanDeserializerFactory, preventing instantiation of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.4-tuxcare.3 is NOT affected by CVE-2020-14195. The vulnerability involves deserialization of the org.jsecurity.realm.jndi.JndiRealmFactory gadget class leading to JNDI injection and RCE. The upstream fix (commit f6d9c664f6 by Tatu Saloranta, June 2020) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.18.4 when TuxCare onboarded it (commit 60252728ea), so the vulnerable pattern has never existed in the TuxCare-maintained branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "Target jackson-databind 2.18.4-tuxcare.3 is NOT affected by CVE-2020-14195. The vulnerability involves deserialization of the org.jsecurity.realm.jndi.JndiRealmFactory gadget class leading to JNDI injection and RCE. The upstream fix (commit f6d9c664f6 by Tatu Saloranta, June 2020) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.18.4 when TuxCare onboarded it (commit 60252728ea), so the vulnerable pattern has never existed in the TuxCare-maintained branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T14:23:14.032161+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to missing blocklist entry for the deserialization gadget class `br.com.anteros.dbcp.AnterosDBCPDataSource`. The target (jackson-databind 2.18.4-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in the release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:147, added by upstream commit 3d97153944 (author: tatu.saloranta@iki.fi) in release 2.9.10.6. This fix predates the first TuxCare commit (60252728ea \"Onboard version 2.18.4\"), confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to missing blocklist entry for the deserialization gadget class `br.com.anteros.dbcp.AnterosDBCPDataSource`. The target (jackson-databind 2.18.4-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in the release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:147, added by upstream commit 3d97153944 (author: tatu.saloranta@iki.fi) in release 2.9.10.6. This fix predates the first TuxCare commit (60252728ea \"Onboard version 2.18.4\"), confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T15:18:37.633690+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves unsafe deserialization of the com.pastdev.httpcomponents.configuration.JndiConfiguration gadget class. The upstream fix (adding JndiConfiguration to the deserialization blocklist in SubTypeValidator.java) was already present in the upstream 2.18.4 release that TuxCare onboarded. The dangerous class is blocked at line 210 of SubTypeValidator.java, preventing the deserialization attack vector. This is an upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 6cc9f1a1af, which shipped before TuxCare's first commit (onboarding at 60252728ea).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "CVE-2020-24750 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves unsafe deserialization of the com.pastdev.httpcomponents.configuration.JndiConfiguration gadget class. The upstream fix (adding JndiConfiguration to the deserialization blocklist in SubTypeValidator.java) was already present in the upstream 2.18.4 release that TuxCare onboarded. The dangerous class is blocked at line 210 of SubTypeValidator.java, preventing the deserialization attack vector. This is an upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 6cc9f1a1af, which shipped before TuxCare's first commit (onboarding at 60252728ea).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 is NOT present in jackson-databind 2.18.4. The XXE vulnerability fix was already included in the upstream 2.18.4 release. The DOMDeserializer class contains the required XXE protections (disallow-doctype-decl=true and load-external-dtd=false) at lines 40-46, preventing XML external entity attacks. The fix commit (612f971b78) by upstream maintainer Tatu Saloranta was already present when TuxCare onboarded version 2.18.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 is NOT present in jackson-databind 2.18.4. The XXE vulnerability fix was already included in the upstream 2.18.4 release. The DOMDeserializer class contains the required XXE protections (disallow-doctype-decl=true and load-external-dtd=false) at lines 40-46, preventing XML external entity attacks. The fix commit (612f971b78) by upstream maintainer Tatu Saloranta was already present when TuxCare onboarded version 2.18.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T14:23:41.009963+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.4-tuxcare.3) is NOT affected by CVE-2020-35490. The vulnerability involves unsafe deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource classes, which could lead to remote code execution. The upstream vendor (FasterXML) fixed this vulnerability in commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d by adding these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.4 release before TuxCare onboarded it, so the vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "The target repository (jackson-databind 2.18.4-tuxcare.3) is NOT affected by CVE-2020-35490. The vulnerability involves unsafe deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource classes, which could lead to remote code execution. The upstream vendor (FasterXML) fixed this vulnerability in commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d by adding these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.4 release before TuxCare onboarded it, so the vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T12:53:41.382779+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability concerns deserialization gadgets in org.apache.commons.dbcp2.datasources classes (SharedPoolDataSource and PerUserPoolDataSource). The upstream vendor fix, which blocklists these classes in SubTypeValidator, was already present in upstream jackson-databind 2.18.4 when TuxCare onboarded it. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 41b8bdb5cc and shipped with the upstream 2.18.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "CVE-2020-35491 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability concerns deserialization gadgets in org.apache.commons.dbcp2.datasources classes (SharedPoolDataSource and PerUserPoolDataSource). The upstream vendor fix, which blocklists these classes in SubTypeValidator, was already present in upstream jackson-databind 2.18.4 when TuxCare onboarded it. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 41b8bdb5cc and shipped with the upstream 2.18.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T14:55:46.062749+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves deserialization of the gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool which could enable JNDI injection attacks leading to arbitrary code execution. The upstream fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by Tatu Saloranta, December 26, 2020) added this class to the deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.18.4 release when TuxCare onboarded it (commit 60252728ea, October 2026), making the target not affected. The vulnerable code pattern does not exist in the current version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "CVE-2020-35728 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves deserialization of the gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool which could enable JNDI injection attacks leading to arbitrary code execution. The upstream fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by Tatu Saloranta, December 26, 2020) added this class to the deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.18.4 release when TuxCare onboarded it (commit 60252728ea, October 2026), making the target not affected. The vulnerable code pattern does not exist in the current version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T13:26:57.486633+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entry for the deserialization gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS`. The target repository (jackson-databind 2.18.4-tuxcare.3) contains the upstream fix commit 3ded28aece from December 2020 by Tatu Saloranta, which added this class to SubTypeValidator's blocklist. The fix was already present in the upstream 2.18.4 release that TuxCare onboarded, making this an upstream-authored fix rather than a TuxCare backport. The vulnerable pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "CVE-2020-36179 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entry for the deserialization gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS`. The target repository (jackson-databind 2.18.4-tuxcare.3) contains the upstream fix commit 3ded28aece from December 2020 by Tatu Saloranta, which added this class to SubTypeValidator's blocklist. The fix was already present in the upstream 2.18.4 release that TuxCare onboarded, making this an upstream-authored fix rather than a TuxCare backport. The vulnerable pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T15:43:48.993875+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.4-tuxcare.3 is NOT AFFECTED by CVE-2020-36180. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS, which can lead to JNDI injection attacks. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) added this class and its variants to SubTypeValidator's blocklist. This fix was already present in the upstream 2.18.4 release that TuxCare onboarded, making the vulnerable code pattern absent from the target. The blocklist entries are present at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, blocking all variants including commons-dbcp 1.x, commons-dbcp 2.x, and embedded versions in Tomcat and Apache Drill.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "The target jackson-databind 2.18.4-tuxcare.3 is NOT AFFECTED by CVE-2020-36180. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS, which can lead to JNDI injection attacks. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) added this class and its variants to SubTypeValidator's blocklist. This fix was already present in the upstream 2.18.4 release that TuxCare onboarded, making the vulnerable code pattern absent from the target. The blocklist entries are present at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, blocking all variants including commons-dbcp 1.x, commons-dbcp 2.x, and embedded versions in Tomcat and Apache Drill.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T16:46:51.408476+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability relates to unsafe deserialization of the `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS` gadget class, which could enable remote code execution through JNDI injection. The fix (blacklisting this class in SubTypeValidator) was implemented by upstream maintainer Tatu Saloranta in commit 3ded28aece on December 31, 2020. This fix shipped in the original upstream jackson-databind 2.18.4 release that TuxCare onboarded, so no additional backport was needed for this version. The blacklist is actively enforced during deserialization via BeanDeserializerFactory, which calls SubTypeValidator.validateSubType() and blocks any attempt to deserialize the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "CVE-2020-36181 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability relates to unsafe deserialization of the `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS` gadget class, which could enable remote code execution through JNDI injection. The fix (blacklisting this class in SubTypeValidator) was implemented by upstream maintainer Tatu Saloranta in commit 3ded28aece on December 31, 2020. This fix shipped in the original upstream jackson-databind 2.18.4 release that TuxCare onboarded, so no additional backport was needed for this version. The blacklist is actively enforced during deserialization via BeanDeserializerFactory, which calls SubTypeValidator.validateSubType() and blocks any attempt to deserialize the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T14:14:08.658611+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves missing blocklist entries for DBCP-related gadget classes (specifically org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS) that could enable remote code execution through polymorphic deserialization. The fix was already included in upstream FasterXML release 2.18.4, which predates TuxCare's onboarding. All required blocklist entries are present in SubTypeValidator.java (lines 123, 193, 219, 228, 234), blocking deserialization of the dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves missing blocklist entries for DBCP-related gadget classes (specifically org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS) that could enable remote code execution through polymorphic deserialization. The fix was already included in upstream FasterXML release 2.18.4, which predates TuxCare's onboarding. All required blocklist entries are present in SubTypeValidator.java (lines 123, 193, 219, 228, 234), blocking deserialization of the dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T15:23:04.955983+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not present in jackson-databind 2.18.4. The vulnerability involves polymorphic deserialization of the JNDI gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, which can lead to remote code execution via JNDI injection. The upstream vendor (FasterXML) fixed this by adding the class to a blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.4 release (commit 12e23c962ff by Tatu Saloranta, 2020-12-31) before TuxCare onboarded the version. The blocklist entry at line 243 prevents deserialization of this gadget class, blocking the attack chain from Input (polymorphic JSON with gadget type reference) to Goal (RCE via JNDI lookup).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "CVE-2020-36183 is not present in jackson-databind 2.18.4. The vulnerability involves polymorphic deserialization of the JNDI gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, which can lead to remote code execution via JNDI injection. The upstream vendor (FasterXML) fixed this by adding the class to a blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.4 release (commit 12e23c962ff by Tatu Saloranta, 2020-12-31) before TuxCare onboarded the version. The blocklist entry at line 243 prevents deserialization of this gadget class, blocking the attack chain from Input (polymorphic JSON with gadget type reference) to Goal (RCE via JNDI lookup).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T12:42:09.520685+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.18.4-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in commit 567194c53a (Dec 26, 2020) by adding org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.18.4 when TuxCare onboarded it (first TuxCare commit: 60252728ea, \"Onboard version 2.18.4\" by amoniatovskiy@cloudlinux.com). The target contains the complete defense mechanism and is not vulnerable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.18.4-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in commit 567194c53a (Dec 26, 2020) by adding org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.18.4 when TuxCare onboarded it (first TuxCare commit: 60252728ea, \"Onboard version 2.18.4\" by amoniatovskiy@cloudlinux.com). The target contains the complete defense mechanism and is not vulnerable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T16:09:26.959129+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.4-tuxcare.3 is NOT vulnerable to CVE-2020-36185. The upstream fix (commit 567194c53a) that adds org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist was already present in upstream release 2.18.4 before TuxCare onboarded it. The vulnerable classes are blocked in SubTypeValidator.java lines 235-236, and deserialization attempts trigger \"Illegal type to deserialize: prevented for security reasons\" errors. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "The target jackson-databind version 2.18.4-tuxcare.3 is NOT vulnerable to CVE-2020-36185. The upstream fix (commit 567194c53a) that adds org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist was already present in upstream release 2.18.4 before TuxCare onboarded it. The vulnerable classes are blocked in SubTypeValidator.java lines 235-236, and deserialization attempts trigger \"Illegal type to deserialize: prevented for security reasons\" errors. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T14:39:42.552241+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target version 2.18.4-tuxcare.3 is NOT AFFECTED by CVE-2020-36186. The vulnerability concerns the absence of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource from Jackson's deserialization blacklist, allowing JNDI injection attacks. This class was added to the blacklist in upstream commit 3e8fa3beea4 by Tatu Saloranta on 2020-12-26 (fixing databind#2997), which shipped in upstream release 2.18.4 before TuxCare onboarded it. The blacklist entry is present at SubTypeValidator.java:229 and is actively enforced by BeanDeserializerFactory during deserialization, throwing JsonMappingException when the dangerous class is detected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "The target version 2.18.4-tuxcare.3 is NOT AFFECTED by CVE-2020-36186. The vulnerability concerns the absence of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource from Jackson's deserialization blacklist, allowing JNDI injection attacks. This class was added to the blacklist in upstream commit 3e8fa3beea4 by Tatu Saloranta on 2020-12-26 (fixing databind#2997), which shipped in upstream release 2.18.4 before TuxCare onboarded it. The blacklist entry is present at SubTypeValidator.java:229 and is actively enforced by BeanDeserializerFactory during deserialization, throwing JsonMappingException when the dangerous class is detected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T14:50:17.320852+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerable classes (org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) are blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java (lines 229-230). The fix was introduced by upstream commit 3e8fa3beea by Tatu Saloranta and was already present in the upstream release 2.18.4 when TuxCare onboarded it. The defense mechanism actively rejects deserialization of these classes via the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "CVE-2020-36187 is not present in jackson-databind 2.18.4-tuxcare.3. The vulnerable classes (org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) are blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java (lines 229-230). The fix was introduced by upstream commit 3e8fa3beea by Tatu Saloranta and was already present in the upstream release 2.18.4 when TuxCare onboarded it. The defense mechanism actively rejects deserialization of these classes via the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T15:57:36.777269+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource classes. The fix (commit 33d96c13fe) adds these classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and was already present in upstream version 2.18.4 when TuxCare onboarded it (first TuxCare commit 60252728ea \"Onboard version 2.18.4\"). The blocklist entries are present at SubTypeValidator.java:223-224, and the validation is enforced in BeanDeserializerFactory.createBeanDeserializer() before any deserializer instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource classes. The fix (commit 33d96c13fe) adds these classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and was already present in upstream version 2.18.4 when TuxCare onboarded it (first TuxCare commit 60252728ea \"Onboard version 2.18.4\"). The blocklist entries are present at SubTypeValidator.java:223-224, and the validation is enforced in BeanDeserializerFactory.createBeanDeserializer() before any deserializer instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T13:08:56.260651+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource. The upstream fix (commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 by Tatu Saloranta) adds these classes to the SubTypeValidator denylist. Version 2.18.4 is not affected because this fix was already included in the upstream release when TuxCare onboarded it (commit 60252728ea5bc82e65471ba618af086d38ef16c6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource. The upstream fix (commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 by Tatu Saloranta) adds these classes to the SubTypeValidator denylist. Version 2.18.4 is not affected because this fix was already included in the upstream release when TuxCare onboarded it (commit 60252728ea5bc82e65471ba618af086d38ef16c6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T14:18:25.927574+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 describes stack overflow DoS via deeply nested JSON. The target jackson-databind 2.18.4-tuxcare.3 contains two upstream fixes that shipped in the base release: (1) fcfc4998ec added MAX_DEPTH=1000 limit to the recursive deserializer (March 2022), (2) 8238ab41d0 re-implemented with non-recursive UntypedObjectDeserializerNR eliminating stack overflow entirely (May 2022). Both fixes authored by upstream maintainers (Taylor S. Marks, Tatu Saloranta), both ancestors of first TuxCare commit (60252728ea Onboard 2.18.4). Target code at UntypedObjectDeserializer.java:199 routes to the non-recursive implementation. Vulnerable pattern not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "CVE-2020-36518 describes stack overflow DoS via deeply nested JSON. The target jackson-databind 2.18.4-tuxcare.3 contains two upstream fixes that shipped in the base release: (1) fcfc4998ec added MAX_DEPTH=1000 limit to the recursive deserializer (March 2022), (2) 8238ab41d0 re-implemented with non-recursive UntypedObjectDeserializerNR eliminating stack overflow entirely (May 2022). Both fixes authored by upstream maintainers (Taylor S. Marks, Tatu Saloranta), both ancestors of first TuxCare commit (60252728ea Onboard 2.18.4). Target code at UntypedObjectDeserializer.java:199 routes to the non-recursive implementation. Vulnerable pattern not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T16:17:04.637381+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is not affecting this target. The vulnerability involves deserialization of the gadget class org.apache.xbean.propertyeditor.JndiConverter which enables JNDI injection attacks. The upstream fix (commit 9bb52c7122) adds this class to jackson-databind's deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.18.4, which TuxCare onboarded (commit 60252728ea). The blocklist entry exists at line 138 and is enforced via validateSubType() during bean deserialization, preventing instantiation of the malicious class. The fix was authored by upstream maintainer Tatu Saloranta, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 is not affecting this target. The vulnerability involves deserialization of the gadget class org.apache.xbean.propertyeditor.JndiConverter which enables JNDI injection attacks. The upstream fix (commit 9bb52c7122) adds this class to jackson-databind's deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.18.4, which TuxCare onboarded (commit 60252728ea). The blocklist entry exists at line 138 and is enforced via validateSubType() during bean deserialization, preventing instantiation of the malicious class. The fix was authored by upstream maintainer Tatu Saloranta, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.18.4-tuxcare.3 is NOT affected by CVE-2020-9546. The vulnerability involves deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The fix, which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 141), was included in the upstream release 2.9.10.4 (February 2020) and is present in this version. The fix was authored by upstream maintainer Tatu Saloranta and shipped with the upstream release that TuxCare onboarded as version 2.18.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "The target repository jackson-databind version 2.18.4-tuxcare.3 is NOT affected by CVE-2020-9546. The vulnerability involves deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The fix, which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 141), was included in the upstream release 2.9.10.4 (February 2020) and is present in this version. The fix was authored by upstream maintainer Tatu Saloranta and shipped with the upstream release that TuxCare onboarded as version 2.18.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T15:47:06.064229+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involved a deserialization gadget class (com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig) that could be exploited through Jackson's polymorphic type handling. The upstream vendor (Tatu Saloranta) fixed this by adding the gadget class to a blocklist in SubTypeValidator.java (commit 1e64db6a2f, issue #2634). This fix shipped in jackson-databind versions 2.7.9.7, 2.8.11.6, and 2.9.10.4 - the exact versions mentioned in the CVE as the first patched releases. The target version 2.18.4 inherited this fix from the upstream release that TuxCare onboarded. The blocklist entry exists at line 144 of SubTypeValidator.java and is actively enforced during deserialization through BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involved a deserialization gadget class (com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig) that could be exploited through Jackson's polymorphic type handling. The upstream vendor (Tatu Saloranta) fixed this by adding the gadget class to a blocklist in SubTypeValidator.java (commit 1e64db6a2f, issue #2634). This fix shipped in jackson-databind versions 2.7.9.7, 2.8.11.6, and 2.9.10.4 - the exact versions mentioned in the CVE as the first patched releases. The target version 2.18.4 inherited this fix from the upstream release that TuxCare onboarded. The blocklist entry exists at line 144 of SubTypeValidator.java and is actively enforced during deserialization through BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T16:21:06.039557+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.18.4-tuxcare.3 is NOT AFFECTED by CVE-2020-9548. The vulnerability pattern (ability to deserialize the gadget class br.com.anteros.dbcp.AnterosDBCPConfig) is not present because this class is on the blocklist in SubTypeValidator.java line 145. The fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.18.4 release when TuxCare onboarded it (commit 60252728ea). This is NOT a TuxCare backport but rather an upstream fix that shipped with the base version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "The target repository jackson-databind version 2.18.4-tuxcare.3 is NOT AFFECTED by CVE-2020-9548. The vulnerability pattern (ability to deserialize the gadget class br.com.anteros.dbcp.AnterosDBCPConfig) is not present because this class is on the blocklist in SubTypeValidator.java line 145. The fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.18.4 release when TuxCare onboarded it (commit 60252728ea). This is NOT a TuxCare backport but rather an upstream fix that shipped with the base version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T15:17:47.351003+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves deserialization of the javax.swing.JTextPane gadget class. The fix (adding JTextPane to the blocklist in SubTypeValidator.java line 151) was already present in the upstream FasterXML 2.18.4 release that TuxCare onboarded. The upstream commit 4b66d3fbc506 by tatu.saloranta@iki.fi included this fix, which was then imported via the TuxCare onboarding commit 60252728ea. The vulnerable pattern (missing JTextPane from DEFAULT_NO_DESER_CLASS_NAMES) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability involves deserialization of the javax.swing.JTextPane gadget class. The fix (adding JTextPane to the blocklist in SubTypeValidator.java line 151) was already present in the upstream FasterXML 2.18.4 release that TuxCare onboarded. The upstream commit 4b66d3fbc506 by tatu.saloranta@iki.fi included this fix, which was then imported via the TuxCare onboarding commit 60252728ea. The vulnerable pattern (missing JTextPane from DEFAULT_NO_DESER_CLASS_NAMES) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 affects jackson-databind versions 2.10.x-2.12.x (before 2.12.6) and 2.13.x (before 2.13.1). The target repository is jackson-databind version 2.18.4-tuxcare.3. The vulnerability involved unbounded heap allocation in NodeSerialization.readExternal() during JDK deserialization. The upstream fix (commit 3ccde7d938f) was applied by Tatu Saloranta on 2021-12-03, nearly 5 years before TuxCare onboarded version 2.18.4 (2026-09-21). The fix is present in the target at src/main/java/com/fasterxml/jackson/databind/node/NodeSerialization.java with the LONGEST_EAGER_ALLOC constant and chunked reading logic. Since the fix was already in the upstream 2.18.4 release (not a TuxCare backport), the verdict is not_affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "CVE-2021-46877 affects jackson-databind versions 2.10.x-2.12.x (before 2.12.6) and 2.13.x (before 2.13.1). The target repository is jackson-databind version 2.18.4-tuxcare.3. The vulnerability involved unbounded heap allocation in NodeSerialization.readExternal() during JDK deserialization. The upstream fix (commit 3ccde7d938f) was applied by Tatu Saloranta on 2021-12-03, nearly 5 years before TuxCare onboarded version 2.18.4 (2026-09-21). The fix is present in the target at src/main/java/com/fasterxml/jackson/databind/node/NodeSerialization.java with the LONGEST_EAGER_ALLOC constant and chunked reading logic. Since the fix was already in the upstream 2.18.4 release (not a TuxCare backport), the verdict is not_affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T16:50:26.784780+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 (resource exhaustion via deep wrapper array nesting) is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability was fixed in upstream version 2.14.0 (released 2022-11-05), and the target version 2.18.4 (released 2024-10-02) shipped with this fix already integrated. The fix adds depth checks in primitive value deserializers to prevent unbounded recursion when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. TuxCare onboarded the already-fixed upstream 2.18.4 release on commit 60252728ea, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "CVE-2022-42003 (resource exhaustion via deep wrapper array nesting) is NOT present in jackson-databind 2.18.4-tuxcare.3. The vulnerability was fixed in upstream version 2.14.0 (released 2022-11-05), and the target version 2.18.4 (released 2024-10-02) shipped with this fix already integrated. The fix adds depth checks in primitive value deserializers to prevent unbounded recursion when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. TuxCare onboarded the already-fixed upstream 2.18.4 release on commit 60252728ea, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T15:02:41.455639+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.4 is NOT affected by CVE-2022-42004. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed by upstream maintainer Tatu Saloranta in commit 063183589. This fix was already present in the upstream 2.18.4 release that TuxCare onboarded, confirmed by the fix commit being an ancestor of TuxCare's first onboarding commit (60252728ea). The defense code at BeanDeserializer.java:651-659 prevents deeply nested array processing by rejecting any input with more than one level of array wrapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "Target jackson-databind 2.18.4 is NOT affected by CVE-2022-42004. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed by upstream maintainer Tatu Saloranta in commit 063183589. This fix was already present in the upstream 2.18.4 release that TuxCare onboarded, confirmed by the fix commit being an ancestor of TuxCare's first onboarding commit (60252728ea). The defense code at BeanDeserializer.java:651-659 prevents deeply nested array processing by rejecting any input with more than one level of array wrapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-28T01:07:55.976356+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-28T11:04:57.213240+00:00", "status_notes": "Vulnerability CVE-2026-19032 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-19032" }, "action_statement": "Vulnerability CVE-2026-19032 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-02T20:23:00.112323+00:00", "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 affects jackson-databind versions with recursive JsonNode.toString() serialization that can cause DoS with deeply nested JSON. The vulnerability is NOT present in version 2.18.4-tuxcare.3. The upstream fix (commit a1fa4ae4ec by Tatu Saloranta, 2022-05-04) replaced recursive serialization with non-recursive stack-based iteration in InternalNodeMapper.WrapperForSerializer, preventi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50193" }, "impact_statement": "not_affected \u2014 CVE-2026-50193 affects jackson-databind versions with recursive JsonNode.toString() serialization that can cause DoS with deeply nested JSON. The vulnerability is NOT present in version 2.18.4-tuxcare.3. The upstream fix (commit a1fa4ae4ec by Tatu Saloranta, 2022-05-04) replaced recursive serialization with non-recursive stack-based iteration in InternalNodeMapper.WrapperForSerializer, preventi..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-28T11:04:57.213240+00:00", "status_notes": "Vulnerability CVE-2026-54512 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-54512" }, "action_statement": "Vulnerability CVE-2026-54512 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-28T11:04:57.213240+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-20T17:23:00.086728+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-28T11:04:57.213240+00:00", "status_notes": "Vulnerability CVE-2026-54515 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-54515" }, "action_statement": "Vulnerability CVE-2026-54515 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-03T03:24:14.959781+00:00", "status_notes": "Vulnerability CVE-2026-54516 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.18.4-tuxcare.3 predates the vulnerable behavior introduced by #5398 fix. The CVE-2026-54516 vulnerability chain requires property renaming logic that allows properties with @JsonProperty on getter and @JsonIgnore on setter to be renamed. The target has pre-#5398 code (simple continue at line 1386) that skips ALL ignored properties from renaming, preventing the attack path where...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54516" }, "impact_statement": "not_affected \u2014 Target version 2.18.4-tuxcare.3 predates the vulnerable behavior introduced by #5398 fix. The CVE-2026-54516 vulnerability chain requires property renaming logic that allows properties with @JsonProperty on getter and @JsonIgnore on setter to be renamed. The target has pre-#5398 code (simple continue at line 1386) that skips ALL ignored properties from renaming, preventing the attack path where..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-11-10T04:17:33.879237+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the vulnerable constructor replay feature and rejects unwrapped creator parameters before they can be populated. Unnamed parameters are rejected at src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:540, and named properties at src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:1020. Supported field and setter replay skips properties outside the active view at src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java:61.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the vulnerable constructor replay feature and rejects unwrapped creator parameters before they can be populated. Unnamed parameters are rejected at src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:540, and named properties at src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:1020. Supported field and setter replay skips properties outside the active view at src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java:61." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-20T17:23:00.086728+00:00", "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59888" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-28T11:04:57.213240+00:00", "status_notes": "Vulnerability CVE-2026-59889 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.2.", "vulnerability": { "name": "CVE-2026-59889" }, "action_statement": "Vulnerability CVE-2026-59889 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-30T12:57:27.256283+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.3.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-20T17:23:00.086728+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-30T12:57:27.256283+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.3.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-30T12:57:27.256283+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.3.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-30T12:57:27.256283+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.3.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-28T11:04:57.213240+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.2.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" }, "action_statement": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.18.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.4-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4-tuxcare.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.18.4-tuxcare.1.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }