{ "@id": "urn:uuid:efd0862b-0b77-4c84-8e92-5d2e320ddfb0", "role": "Document Creator", "author": "https://tuxcare.com", "version": 58, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:23:21.346897+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T13:23:14.873847+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.21.2, which is far beyond the vulnerable range. The upstream fix (blacklist entries for vulnerable gadget classes from issues #1680 and #1737) was already present in the upstream jackson-databind 2.21.2 release when TuxCare onboarded it. The SubTypeValidator.java file contains an extensive denylist including all required entries (com.sun.rowset.JdbcRowSetImpl, java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and many more), and the validation is actively called during bean deserialization via BeanDeserializerFactory._validateSubType(). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.21.2, which is far beyond the vulnerable range. The upstream fix (blacklist entries for vulnerable gadget classes from issues #1680 and #1737) was already present in the upstream jackson-databind 2.21.2 release when TuxCare onboarded it. The SubTypeValidator.java file contains an extensive denylist including all required entries (com.sun.rowset.JdbcRowSetImpl, java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and many more), and the validation is actively called during bean deserialization via BeanDeserializerFactory._validateSubType(). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:53:08.340092+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3 due to incomplete deserialization blacklist when Spring libraries are present. Target version 2.21.2 contains upstream fixes (commits e865a7a446 for #1737, 2235894210 for #1855) that shipped in the 2.21.2 release. SubTypeValidator class implements comprehensive blacklist validation blocking dangerous classes (FileHandler, UnicastRemoteObject, Spring framework types, C3P0, Tomcat DBCP, BCEL ClassLoader) before bean deserialization. Validation is integrated at BeanDeserializerFactory:142. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3 due to incomplete deserialization blacklist when Spring libraries are present. Target version 2.21.2 contains upstream fixes (commits e865a7a446 for #1737, 2235894210 for #1855) that shipped in the 2.21.2 release. SubTypeValidator class implements comprehensive blacklist validation blocking dangerous classes (FileHandler, UnicastRemoteObject, Spring framework types, C3P0, Tomcat DBCP, BCEL ClassLoader) before bean deserialization. Validation is integrated at BeanDeserializerFactory:142. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:41:24.721852+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.21.2-tuxcare.2 is not affected by CVE-2017-7525. The upstream fix (SubTypeValidator blacklist) was already present in the upstream release 2.21.2 before TuxCare onboarded it. The vulnerable deserialization pattern is not present because BeanDeserializerFactory validates all bean types against a comprehensive blacklist of dangerous gadget classes, including all classes mentioned in CVE-2017-7525.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "Target version 2.21.2-tuxcare.2 is not affected by CVE-2017-7525. The upstream fix (SubTypeValidator blacklist) was already present in the upstream release 2.21.2 before TuxCare onboarded it. The vulnerable deserialization pattern is not present because BeanDeserializerFactory validates all bean types against a comprehensive blacklist of dangerous gadget classes, including all classes mentioned in CVE-2017-7525.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T13:26:57.486633+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.21.2. The vulnerability involved deserialization gadgets (specifically org.apache.ibatis.parsing.XPathParser) that could be exploited via Jackson's default typing feature to exfiltrate data. The upstream vendor (FasterXML) fixed this in commit 27b4defc27 by blacklisting the XPathParser class in SubTypeValidator.java. This fix was already present in the upstream 2.21.2 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of TuxCare's first onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.21.2. The vulnerability involved deserialization gadgets (specifically org.apache.ibatis.parsing.XPathParser) that could be exploited via Jackson's default typing feature to exfiltrate data. The upstream vendor (FasterXML) fixed this in commit 27b4defc27 by blacklisting the XPathParser class in SubTypeValidator.java. This fix was already present in the upstream 2.21.2 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of TuxCare's first onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The vulnerability allows attackers to execute malicious payloads via polymorphic deserialization of Jodd-db or Oracle JDBC classes with LDAP exploitation when Default Typing is enabled. The target repository (version 2.21.2-tuxcare.3) contains the upstream fix that adds these dangerous class names to the deserialization blocklist in SubTypeValidator.java. The fix (commit 28badf7ef6) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.21.2 release before TuxCare onboarded it. The vulnerable pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The vulnerability allows attackers to execute malicious payloads via polymorphic deserialization of Jodd-db or Oracle JDBC classes with LDAP exploitation when Default Typing is enabled. The target repository (version 2.21.2-tuxcare.3) contains the upstream fix that adds these dangerous class names to the deserialization blocklist in SubTypeValidator.java. The fix (commit 28badf7ef6) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.21.2 release before TuxCare onboarded it. The vulnerable pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:32:27.596761+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.21.2. The vulnerability involves polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that can trigger JNDI/LDAP lookups leading to remote code execution when Default Typing is enabled. The vendor fix adds these classes to a deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.21.2 release that TuxCare onboarded, committed by upstream maintainer Tatu Saloranta in commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a (dated 2018-06-07, for release 2.7.9.4). The target version 2.21.2 is much newer than the fixed versions (2.7.9.4, 2.8.11.2, 2.9.6) and inherits the protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.21.2. The vulnerability involves polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that can trigger JNDI/LDAP lookups leading to remote code execution when Default Typing is enabled. The vendor fix adds these classes to a deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.21.2 release that TuxCare onboarded, committed by upstream maintainer Tatu Saloranta in commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a (dated 2018-06-07, for release 2.7.9.4). The target version 2.21.2 is much newer than the fixed versions (2.7.9.4, 2.8.11.2, 2.9.6) and inherits the protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:08:25.826245+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.21.2-tuxcare.2. The vulnerability concerns polymorphic deserialization gadget classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that allow arbitrary code execution. All four classes are blocked in SubTypeValidator.java lines 75-78 via DEFAULT_NO_DESER_CLASS_NAMES. The fix (commit 87d29af25e by upstream author Tatu Saloranta) was already present in the upstream jackson-databind 2.21.2 release that TuxCare onboarded, not added as a separate backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.21.2-tuxcare.2. The vulnerability concerns polymorphic deserialization gadget classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that allow arbitrary code execution. All four classes are blocked in SubTypeValidator.java lines 75-78 via DEFAULT_NO_DESER_CLASS_NAMES. The fix (commit 87d29af25e by upstream author Tatu Saloranta) was already present in the upstream jackson-databind 2.21.2 release that TuxCare onboarded, not added as a separate backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:08:45.993587+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 due to missing blocklist entries for BlazeDS classes (flex.messaging.*) that can be exploited for remote code execution via polymorphic deserialization. The target version 2.21.2-tuxcare.2 is NOT affected because the upstream fix (commit 87d29af25e, applied in 2018) was already present in the upstream v2.21.2 release that TuxCare onboarded. The required blocklist entry 'flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor' is present in SubTypeValidator.java line 76, preventing deserialization of the dangerous BlazeDS class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 due to missing blocklist entries for BlazeDS classes (flex.messaging.*) that can be exploited for remote code execution via polymorphic deserialization. The target version 2.21.2-tuxcare.2 is NOT affected because the upstream fix (commit 87d29af25e, applied in 2018) was already present in the upstream v2.21.2 release that TuxCare onboarded. The required blocklist entry 'flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor' is present in SubTypeValidator.java line 76, preventing deserialization of the dangerous BlazeDS class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:13:29.562378+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.21.2-tuxcare.2. The vulnerability involved missing blocklist entries for four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks via polymorphic deserialization. The upstream fix (commit 87d29af25e by Tatu Saloranta) was already included in the upstream release 2.21.2 before TuxCare onboarding. All four classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 75-78), preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.21.2-tuxcare.2. The vulnerability involved missing blocklist entries for four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks via polymorphic deserialization. The upstream fix (commit 87d29af25e by Tatu Saloranta) was already included in the upstream release 2.21.2 before TuxCare onboarding. All four classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 75-78), preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:42:07.121820+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 does NOT affect jackson-databind version 2.21.2-tuxcare.2. The vulnerability allows SSRF attacks via polymorphic deserialization of the org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl class. The fix (commit 87d29af25e by Tatu Saloranta) adds this class to a blocklist in SubTypeValidator.java:78, preventing its deserialization. This fix was already present in the upstream jackson-databind 2.21.2 release that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 does NOT affect jackson-databind version 2.21.2-tuxcare.2. The vulnerability allows SSRF attacks via polymorphic deserialization of the org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl class. The fix (commit 87d29af25e by Tatu Saloranta) adds this class to a blocklist in SubTypeValidator.java:78, preventing its deserialization. This fix was already present in the upstream jackson-databind 2.21.2 release that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T13:06:00.441936+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is NOT present in jackson-databind 2.21.2. The vulnerability required blocking org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization. This fix was implemented by upstream in commit 72cd4025a2 (Nov 2018) and first released in version 2.9.8. The target version 2.21.2 is significantly newer and contains the fix as part of the upstream release that TuxCare onboarded. The blacklist entry is present at SubTypeValidator.java:85 and actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 is NOT present in jackson-databind 2.21.2. The vulnerability required blocking org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization. This fix was implemented by upstream in commit 72cd4025a2 (Nov 2018) and first released in version 2.9.8. The target version 2.21.2 is significantly newer and contains the fix as part of the upstream release that TuxCare onboarded. The blacklist entry is present at SubTypeValidator.java:85 and actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T17:09:41.975072+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 addresses a polymorphic deserialization vulnerability in jackson-databind where attackers could leverage openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) as gadgets for arbitrary code execution. The target repository at version 2.21.2-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 72cd4025a2) was already included in the upstream release 2.21.2 that TuxCare onboarded. The fix adds these openjpa classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization. The vulnerable pattern (absence of these blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 addresses a polymorphic deserialization vulnerability in jackson-databind where attackers could leverage openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) as gadgets for arbitrary code execution. The target repository at version 2.21.2-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 72cd4025a2) was already included in the upstream release 2.21.2 that TuxCare onboarded. The fix adds these openjpa classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization. The vulnerable pattern (absence of these blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:31:44.936589+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.21.2-tuxcare.2 is not affected by CVE-2018-19362. The vulnerability required blocking the jboss-common-core class (org.jboss.util.propertyeditor.DocumentEditor) from polymorphic deserialization. This fix was implemented in upstream commit 72cd4025a2 by Tatu Saloranta on 2018-11-19 and was already included in the upstream 2.21.2 release when TuxCare onboarded it. The blocklist entry is present at line 81 of SubTypeValidator.java and is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "The target jackson-databind 2.21.2-tuxcare.2 is not affected by CVE-2018-19362. The vulnerability required blocking the jboss-common-core class (org.jboss.util.propertyeditor.DocumentEditor) from polymorphic deserialization. This fix was implemented in upstream commit 72cd4025a2 by Tatu Saloranta on 2018-11-19 and was already included in the upstream 2.21.2 release when TuxCare onboarded it. The blocklist entry is present at line 81 of SubTypeValidator.java and is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.21.2-tuxcare.3. The vulnerability involved two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed the blacklist. The upstream vendor (Tatu Saloranta) fixed this in commit 038b471e2e on 2018-01-21 by adding these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix was already present in upstream version 2.21.2 when TuxCare onboarded it on 2026-10-24 (commit d58835759e). The target code contains the fix at SubTypeValidator.java lines 62-63, and the validation is properly integrated into the deserialization flow via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.21.2-tuxcare.3. The vulnerability involved two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed the blacklist. The upstream vendor (Tatu Saloranta) fixed this in commit 038b471e2e on 2018-01-21 by adding these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix was already present in upstream version 2.21.2 when TuxCare onboarded it on 2026-10-24 (commit d58835759e). The target code contains the fix at SubTypeValidator.java lines 62-63, and the validation is properly integrated into the deserialization flow via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:07:52.803278+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.21.2-tuxcare.2 is NOT affected by CVE-2018-7489. The vulnerability allows remote code execution via c3p0 gadget classes when default typing is enabled. The fix (blocking deserialization of com.mchange.v2.c3p0.*DataSource classes) was introduced by upstream maintainer Tatu Saloranta in commit 6799f8f10c (jackson-databind issue #1931, Feb 2018, released in 2.7.9.3). This fix was already present in upstream jackson-databind 2.21.2 when TuxCare onboarded it (commit d58835759e). The defense code in SubTypeValidator.java:288-297 blocks all c3p0 DataSource classes matching the CVE's gadget chain pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "Target version 2.21.2-tuxcare.2 is NOT affected by CVE-2018-7489. The vulnerability allows remote code execution via c3p0 gadget classes when default typing is enabled. The fix (blocking deserialization of com.mchange.v2.c3p0.*DataSource classes) was introduced by upstream maintainer Tatu Saloranta in commit 6799f8f10c (jackson-databind issue #1931, Feb 2018, released in 2.7.9.3). This fix was already present in upstream jackson-databind 2.21.2 when TuxCare onboarded it (commit d58835759e). The defense code in SubTypeValidator.java:288-297 blocks all c3p0 DataSource classes matching the CVE's gadget chain pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:40:52.879992+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind 2.21.2-tuxcare.3. The vulnerability required the ability to deserialize the class `com.mysql.cj.jdbc.admin.MiniAdmin` via polymorphic typing to abuse JDBC connections for arbitrary file read. The upstream fix (commit dda513bd by Tatu Saloranta) added this class to the SubTypeValidator blocklist in version 2.9.9. Since the target version 2.21.2 is much newer than 2.9.9, it already contains this upstream fix, which was present when TuxCare onboarded version 2.21.2 via commit d5883575.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind 2.21.2-tuxcare.3. The vulnerability required the ability to deserialize the class `com.mysql.cj.jdbc.admin.MiniAdmin` via polymorphic typing to abuse JDBC connections for arbitrary file read. The upstream fix (commit dda513bd by Tatu Saloranta) added this class to the SubTypeValidator blocklist in version 2.9.9. Since the target version 2.21.2 is much newer than 2.9.9, it already contains this upstream fix, which was present when TuxCare onboarded version 2.21.2 via commit d5883575.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T18:59:42.240644+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.21.2-tuxcare.2 is not affected by CVE-2019-12384. The vulnerability involves unsafe polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to arbitrary code execution. The fix (blocklist entry) was introduced in upstream commit c9ef4a10d6 by Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 Target version 2.21.2-tuxcare.2 is not affected by CVE-2019-12384. The vulnerability involves unsafe polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to arbitrary code execution. The fix (blocklist entry) was introduced in upstream commit c9ef4a10d6 by Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-02T07:40:03.984203+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.21.2-tuxcare.2. The vulnerability exploits polymorphic deserialization of JDOM XSLTransformer classes to read arbitrary files. The upstream fix (commit 5f7c69bba0 by Tatu Saloranta) blocks these classes in SubTypeValidator.java and was already included in upstream release 2.21.2 that TuxCare onboarded. The blocklist contains both org.jdom.tran...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.21.2-tuxcare.2. The vulnerability exploits polymorphic deserialization of JDOM XSLTransformer classes to read arbitrary files. The upstream fix (commit 5f7c69bba0 by Tatu Saloranta) blocks these classes in SubTypeValidator.java and was already included in upstream release 2.21.2 that TuxCare onboarded. The blocklist contains both org.jdom.tran..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T12:25:55.953386+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is not affecting jackson-databind version 2.21.2. The fix (blocklisting net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) was already present in the upstream 2.21.2 release before TuxCare onboarded it. The vulnerable class is blocked at line 98 of SubTypeValidator.java, preventing deserialization-based RCE. The fix was committed by upstream maintainer Tatu Saloranta in July 2019 (commit ad418eeb), years before version 2.21.2 was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is not affecting jackson-databind version 2.21.2. The fix (blocklisting net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) was already present in the upstream 2.21.2 release before TuxCare onboarded it. The vulnerable class is blocked at line 98 of SubTypeValidator.java, preventing deserialization-based RCE. The fix was committed by upstream maintainer Tatu Saloranta in July 2019 (commit ad418eeb), years before version 2.21.2 was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:00:42.857553+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.21.2-tuxcare.2) is NOT AFFECTED by CVE-2019-14439. The vulnerability involves polymorphic typing deserialization of ch.qos.logback.core.db.JNDIConnectionSource leading to potential JNDI injection and remote code execution. The upstream fix (commit ad418eeb97) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing its deserialization. This fix was included in upstream version 2.21.2 before TuxCare onboarded it, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "The target repository (jackson-databind 2.21.2-tuxcare.2) is NOT AFFECTED by CVE-2019-14439. The vulnerability involves polymorphic typing deserialization of ch.qos.logback.core.db.JNDIConnectionSource leading to potential JNDI injection and remote code execution. The upstream fix (commit ad418eeb97) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing its deserialization. This fix was included in upstream version 2.21.2 before TuxCare onboarded it, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:56:06.275906+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is NOT present in jackson-databind 2.21.2-tuxcare.3. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes, which could lead to exploitation. The target contains the upstream vendor's fix: both classes are blacklisted in SubTypeValidator.java (lines 105-107), blocking their deserialization. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commits d4983c740 and 73c1c2cc76, which were already present in the jackson-databind 2.21.2 release when TuxCare onboarded it (commit d58835759e). The blacklist is actively enforced in BeanDeserializerFactory.java line 142 during the core deserialization flow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 is NOT present in jackson-databind 2.21.2-tuxcare.3. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes, which could lead to exploitation. The target contains the upstream vendor's fix: both classes are blacklisted in SubTypeValidator.java (lines 105-107), blocking their deserialization. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commits d4983c740 and 73c1c2cc76, which were already present in the jackson-databind 2.21.2 release when TuxCare onboarded it (commit d58835759e). The blacklist is actively enforced in BeanDeserializerFactory.java line 142 during the core deserialization flow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:04:33.761797+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is not present in jackson-databind 2.21.2-tuxcare.2. The vulnerability concerns polymorphic deserialization of commons-configuration JNDIConfiguration classes leading to remote code execution. The fix (blocklist entries preventing deserialization of org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) was already present in upstream version 2.21.2 when TuxCare onboarded it. The vulnerable code pattern never existed in this shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 is not present in jackson-databind 2.21.2-tuxcare.2. The vulnerability concerns polymorphic deserialization of commons-configuration JNDIConfiguration classes leading to remote code execution. The fix (blocklist entries preventing deserialization of org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) was already present in upstream version 2.21.2 when TuxCare onboarded it. The vulnerable code pattern never existed in this shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0, where polymorphic deserialization could instantiate the dangerous class org.apache.xalan.lib.sql.JNDIConnectionPool for JNDI injection attacks. The target version 2.21.2-tuxcare.4 includes the upstream fix (commit 998efd7082) authored by Tatu Saloranta that adds this class to the SubTypeValidator blacklist at line 117. This fix was already present in upstream release 2.21.2 when TuxCare onboarded it (first TuxCare commit d58835759e). The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0, where polymorphic deserialization could instantiate the dangerous class org.apache.xalan.lib.sql.JNDIConnectionPool for JNDI injection attacks. The target version 2.21.2-tuxcare.4 includes the upstream fix (commit 998efd7082) authored by Tatu Saloranta that adds this class to the SubTypeValidator blacklist at line 117. This fix was already present in upstream release 2.21.2 when TuxCare onboarded it (first TuxCare commit d58835759e). The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T17:13:05.282153+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.21.2-tuxcare.3 is not affected by CVE-2019-16335. The vulnerability involved polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to arbitrary code execution via gadget-based attacks. The upstream fix, which adds HikariDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, was already present in the upstream version 2.21.2 when TuxCare onboarded it. The vulnerable pattern (allowing HikariDataSource in polymorphic deserialization) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "The target jackson-databind version 2.21.2-tuxcare.3 is not affected by CVE-2019-16335. The vulnerability involved polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to arbitrary code execution via gadget-based attacks. The upstream fix, which adds HikariDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, was already present in the upstream version 2.21.2 when TuxCare onboarded it. The vulnerable pattern (allowing HikariDataSource in polymorphic deserialization) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:16:55.064774+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind 2.0.0-2.9.10 due to unsafe deserialization of commons-dbcp datasource classes when Default Typing is enabled, allowing RCE via JNDI injection. The fix adds three classes to SubTypeValidator's blocklist: org.apache.commons.dbcp.datasources.PerUserPoolDataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource. The target (jackson-databind 2.21.2-tuxcare.2) already contains this fix, which was applied by upstream maintainer Tatu Saloranta in commits 9593e16cf5 and 328a0f833d (September 2019), prior to the 2.21.2 release that TuxCare onboarded. All three blocklist entries are present at SubTypeValidator.java:124-127, and the validation is actively invoked during deserialization at BeanDeserializerFactory.java:142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 affects jackson-databind 2.0.0-2.9.10 due to unsafe deserialization of commons-dbcp datasource classes when Default Typing is enabled, allowing RCE via JNDI injection. The fix adds three classes to SubTypeValidator's blocklist: org.apache.commons.dbcp.datasources.PerUserPoolDataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource. The target (jackson-databind 2.21.2-tuxcare.2) already contains this fix, which was applied by upstream maintainer Tatu Saloranta in commits 9593e16cf5 and 328a0f833d (September 2019), prior to the 2.21.2 release that TuxCare onboarded. All three blocklist entries are present at SubTypeValidator.java:124-127, and the validation is actively invoked during deserialization at BeanDeserializerFactory.java:142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T17:22:22.486046+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.21.2-tuxcare.3. The vulnerability involves polymorphic deserialization gadgets (P6DataSource, SharedPoolDataSource, PerUserPoolDataSource) that could enable remote code execution when Default Typing is enabled. The upstream fix (commit 9593e16cf5a) adds these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was already included in the upstream jackson-databind 2.21.2 release that TuxCare onboarded, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.21.2-tuxcare.3. The vulnerability involves polymorphic deserialization gadgets (P6DataSource, SharedPoolDataSource, PerUserPoolDataSource) that could enable remote code execution when Default Typing is enabled. The upstream fix (commit 9593e16cf5a) adds these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was already included in the upstream jackson-databind 2.21.2 release that TuxCare onboarded, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:32:29.747187+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is not present in jackson-databind 2.21.2. The vulnerability involves polymorphic type deserialization of the dangerous gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The fix (commit 191a4cdf87) that adds this class to the SubTypeValidator blocklist was already present in the upstream release before TuxCare began maintaining this version. The dangerous class is blocked at line 99 of SubTypeValidator.java, preventing deserialization-based remote code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 is not present in jackson-databind 2.21.2. The vulnerability involves polymorphic type deserialization of the dangerous gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The fix (commit 191a4cdf87) that adds this class to the SubTypeValidator blocklist was already present in the upstream release before TuxCare began maintaining this version. The dangerous class is blocked at line 99 of SubTypeValidator.java, preventing deserialization-based remote code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:51:40.336684+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is not present in jackson-databind 2.21.2-tuxcare.2. The vulnerability involves deserialization of log4j-extras gadget classes (JNDIConnectionSource, DriverManagerConnectionSource) that enable JNDI injection attacks. The fix (commit b5a304a985) adds these classes to SubTypeValidator's blocklist, preventing their instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.21.2 release that TuxCare onboarded. The blocklist is enforced at runtime via BeanDeserializerFactory._validateSubType() during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 is not present in jackson-databind 2.21.2-tuxcare.2. The vulnerability involves deserialization of log4j-extras gadget classes (JNDIConnectionSource, DriverManagerConnectionSource) that enable JNDI injection attacks. The fix (commit b5a304a985) adds these classes to SubTypeValidator's blocklist, preventing their instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.21.2 release that TuxCare onboarded. The blocklist is enforced at runtime via BeanDeserializerFactory._validateSubType() during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330: The target is NOT AFFECTED. The vulnerability requires jackson-databind to deserialize two specific ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector) that enable JNDI injection attacks. The fix - adding these classes to a deserialization blocklist - was already present in the upstream jackson-databind 2.21.2 release that TuxCare onboarded. The fix is located at lines 133-135 of SubTypeValidator.java and was authored by Tatu Saloranta (upstream maintainer) on Nov 1, 2019 in commit eb254813cc. The blocklist is properly enforced during deserialization (line 269: _cfgIllegalClassNames.contains(full)) via BeanDeserializerFactory, preventing any attempt to deserialize these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330: The target is NOT AFFECTED. The vulnerability requires jackson-databind to deserialize two specific ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector) that enable JNDI injection attacks. The fix - adding these classes to a deserialization blocklist - was already present in the upstream jackson-databind 2.21.2 release that TuxCare onboarded. The fix is located at lines 133-135 of SubTypeValidator.java and was authored by Tatu Saloranta (upstream maintainer) on Nov 1, 2019 in commit eb254813cc. The blocklist is properly enforced during deserialization (line 269: _cfgIllegalClassNames.contains(full)) via BeanDeserializerFactory, preventing any attempt to deserialize these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T17:11:43.788711+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is not present in the target repository. The vulnerability involves unsafe deserialization of ignite-jta related classes in jackson-databind. The fix, which adds three classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, org.quartz.utils.JNDIConnectionProvider) to the deserialization blocklist in SubTypeValidator.java, is already present in the target at lines 158-160. This fix was part of the upstream release 2.21.2 that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 is not present in the target repository. The vulnerability involves unsafe deserialization of ignite-jta related classes in jackson-databind. The fix, which adds three classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, org.quartz.utils.JNDIConnectionProvider) to the deserialization blocklist in SubTypeValidator.java, is already present in the target at lines 158-160. This fix was part of the upstream release 2.21.2 that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is not present in jackson-databind 2.21.2-tuxcare.4. The vulnerability concerns missing blacklist entries for org.apache.aries.transaction.jms gadget classes that could enable arbitrary code execution through unsafe polymorphic deserialization. The upstream fix (commit 592872f4235c7f2a3280725278da55544032f72d by Tatu Saloranta) adds these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist and was already included in upstream release 2.21.2 before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "CVE-2020-10672 is not present in jackson-databind 2.21.2-tuxcare.4. The vulnerability concerns missing blacklist entries for org.apache.aries.transaction.jms gadget classes that could enable arbitrary code execution through unsafe polymorphic deserialization. The upstream fix (commit 592872f4235c7f2a3280725278da55544032f72d by Tatu Saloranta) adds these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist and was already included in upstream release 2.21.2 before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:36:34.248507+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.21.2-tuxcare.2. The vulnerability concerns unsafe deserialization of com.caucho.config.types.ResourceRef. The fix (blocking ResourceRef in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was already present in the upstream jackson-databind 2.21.2 release that TuxCare onboarded. The fix commit 1645efbd39 by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of the first TuxCare commit d58835759e (\"Onboard version 2.21.2\"). The vulnerable pattern has been removed by the upstream vendor, making this target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.21.2-tuxcare.2. The vulnerability concerns unsafe deserialization of com.caucho.config.types.ResourceRef. The fix (blocking ResourceRef in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was already present in the upstream jackson-databind 2.21.2 release that TuxCare onboarded. The fix commit 1645efbd39 by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of the first TuxCare commit d58835759e (\"Onboard version 2.21.2\"). The vulnerable pattern has been removed by the upstream vendor, making this target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.21.2-tuxcare.4) is NOT affected by CVE-2020-10968. The vulnerability relates to Jackson's polymorphic deserialization allowing instantiation of the dangerous gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The fix was already included in the upstream jackson-databind 2.21.2 release that TuxCare onboarded. The SubTypeValidator.java file contains the required blocklist entries (lines 169-171) that prevent deserialization of the RmiProvider gadget classes. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "The target repository (jackson-databind 2.21.2-tuxcare.4) is NOT affected by CVE-2020-10968. The vulnerability relates to Jackson's polymorphic deserialization allowing instantiation of the dangerous gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The fix was already included in the upstream jackson-databind 2.21.2 release that TuxCare onboarded. The SubTypeValidator.java file contains the required blocklist entries (lines 169-171) that prevent deserialization of the RmiProvider gadget classes. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.21.2-tuxcare.4 is NOT AFFECTED by CVE-2020-10969. The vulnerability required the absence of javax.swing.JEditorPane from the deserialization blocklist, enabling gadget-chain attacks. The upstream FasterXML maintainer (Tatu Saloranta) fixed this in commit 4d038c9de0 by adding JEditorPane to DEFAULT_NO_DESER_CLASS_NAMES. This fix shipped in upstream version 2.9.10.4 and was already present in the 2.21.2 release that TuxCare onboarded (commit d58835759e). The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "Target jackson-databind version 2.21.2-tuxcare.4 is NOT AFFECTED by CVE-2020-10969. The vulnerability required the absence of javax.swing.JEditorPane from the deserialization blocklist, enabling gadget-chain attacks. The upstream FasterXML maintainer (Tatu Saloranta) fixed this in commit 4d038c9de0 by adding JEditorPane to DEFAULT_NO_DESER_CLASS_NAMES. This fix shipped in upstream version 2.9.10.4 and was already present in the 2.21.2 release that TuxCare onboarded (commit d58835759e). The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.21.2 is NOT affected by CVE-2020-11111. The upstream vendor fix (adding org.apache.activemq.* classes to the SubTypeValidator blocklist) was already present in the upstream release 2.21.2 when TuxCare onboarded it. The blocklist entries on lines 173-183 of SubTypeValidator.java prevent deserialization of all nine activemq gadget classes mentioned in the CVE (ActiveMQConnectionFactory, ActiveMQXAConnectionFactory, spring variants, pool variants, and jms.pool variants). The fix commit 08fbfacf was authored by upstream contributor qxo (49526356@qq.com) and is an ancestor of the first TuxCare commit (d5883575 \"Onboard version 2.21.2\"), confirming it shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "Target version 2.21.2 is NOT affected by CVE-2020-11111. The upstream vendor fix (adding org.apache.activemq.* classes to the SubTypeValidator blocklist) was already present in the upstream release 2.21.2 when TuxCare onboarded it. The blocklist entries on lines 173-183 of SubTypeValidator.java prevent deserialization of all nine activemq gadget classes mentioned in the CVE (ActiveMQConnectionFactory, ActiveMQXAConnectionFactory, spring variants, pool variants, and jms.pool variants). The fix commit 08fbfacf was authored by upstream contributor qxo (49526356@qq.com) and is an ancestor of the first TuxCare commit (d5883575 \"Onboard version 2.21.2\"), confirming it shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.21.2-tuxcare.4 is not affected by CVE-2020-11112. The vulnerability involves deserialization of the dangerous gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The upstream FasterXML vendor fixed this in commit 05d7e0e13f (March 2020) by adding the class to a deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream version 2.21.2 that TuxCare onboarded in October 2026. The defense mechanism blocks deserialization attempts of the dangerous class by checking against an unmodifiable blocklist and throwing a JsonMappingException for security violations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "The target jackson-databind 2.21.2-tuxcare.4 is not affected by CVE-2020-11112. The vulnerability involves deserialization of the dangerous gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The upstream FasterXML vendor fixed this in commit 05d7e0e13f (March 2020) by adding the class to a deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream version 2.21.2 that TuxCare onboarded in October 2026. The defense mechanism blocks deserialization attempts of the dangerous class by checking against an unmodifiable blocklist and throwing a JsonMappingException for security violations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 does not affect jackson-databind 2.21.2-tuxcare.4. The vulnerability involves unsafe deserialization of org.apache.openjpa.ee.WASRegistryManagedRuntime, which could allow arbitrary code execution through Jackson's polymorphic type handling. The target contains the fix: SubTypeValidator.java line 84 includes WASRegistryManagedRuntime in the deserialization blocklist. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit e2ba12d5d6 and was already present in upstream version 2.21.2 when TuxCare onboarded it (first TuxCare commit: d58835759e). The validator is properly integrated into the deserialization pipeline via BeanDeserializerFactory and blocks any attempt to deserialize the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 does not affect jackson-databind 2.21.2-tuxcare.4. The vulnerability involves unsafe deserialization of org.apache.openjpa.ee.WASRegistryManagedRuntime, which could allow arbitrary code execution through Jackson's polymorphic type handling. The target contains the fix: SubTypeValidator.java line 84 includes WASRegistryManagedRuntime in the deserialization blocklist. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit e2ba12d5d6 and was already present in upstream version 2.21.2 when TuxCare onboarded it (first TuxCare commit: d58835759e). The validator is properly integrated into the deserialization pipeline via BeanDeserializerFactory and blocks any attempt to deserialize the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is not present in jackson-databind 2.21.2-tuxcare.4. The vulnerability concerns deserialization gadgets (org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean) that could enable arbitrary code execution through Jackson's polymorphic type handling. The upstream fix (commit 113e89fb08, authored by Tatu Saloranta on 2020-04-06) added these classes to SubTypeValidator's blocklist, and this fix was already present in the upstream release version 2.21.2 when TuxCare onboarded it. The target version is much newer than the affected range (2.x before 2.9.10.4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 is not present in jackson-databind 2.21.2-tuxcare.4. The vulnerability concerns deserialization gadgets (org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean) that could enable arbitrary code execution through Jackson's polymorphic type handling. The upstream fix (commit 113e89fb08, authored by Tatu Saloranta on 2020-04-06) added these classes to SubTypeValidator's blocklist, and this fix was already present in the upstream release version 2.21.2 when TuxCare onboarded it. The target version is much newer than the affected range (2.x before 2.9.10.4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is not present in jackson-databind 2.21.2-tuxcare.4. The fix that adds org.apache.commons.jelly.impl.Embedded to the deserialization blocklist was already present in the upstream release 2.21.2 before TuxCare onboarding. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 is not present in jackson-databind 2.21.2-tuxcare.4. The fix that adds org.apache.commons.jelly.impl.Embedded to the deserialization blocklist was already present in the upstream release 2.21.2 before TuxCare onboarding. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 does not affect jackson-databind version 2.21.2-tuxcare.4. The vulnerability involves unsafe deserialization of the gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool, which could lead to JNDI injection attacks. The fix was introduced in upstream commit d1c67a0396 (April 2020) by adding this class name to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix shipped in the upstream FasterXML jackson-databind release 2.21.2, before TuxCare onboarded the version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 does not affect jackson-databind version 2.21.2-tuxcare.4. The vulnerability involves unsafe deserialization of the gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool, which could lead to JNDI injection attacks. The fix was introduced in upstream commit d1c67a0396 (April 2020) by adding this class name to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix shipped in the upstream FasterXML jackson-databind release 2.21.2, before TuxCare onboarded the version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.21.2-tuxcare.4 is not affected by CVE-2020-14061. The vulnerability involves deserialization of dangerous Oracle JMS connection factory classes that can lead to arbitrary code execution. The upstream fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by Tatu Saloranta, dated April 24, 2020) added these five Oracle JMS classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in the upstream jackson-databind 2.21.2 release that TuxCare onboarded, so the vulnerable code pattern does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "The target jackson-databind 2.21.2-tuxcare.4 is not affected by CVE-2020-14061. The vulnerability involves deserialization of dangerous Oracle JMS connection factory classes that can lead to arbitrary code execution. The upstream fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by Tatu Saloranta, dated April 24, 2020) added these five Oracle JMS classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in the upstream jackson-databind 2.21.2 release that TuxCare onboarded, so the vulnerable code pattern does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 concerns the deserialization gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool which can be exploited for remote code execution via JNDI injection during polymorphic deserialization. The target repository version 2.21.2-tuxcare.4 is NOT AFFECTED because the upstream fix (blacklisting this gadget class) was already present in version 2.21.2 before TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta in commit 840eae2ca81 (2020-05-01) and shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 concerns the deserialization gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool which can be exploited for remote code execution via JNDI injection during polymorphic deserialization. The target repository version 2.21.2-tuxcare.4 is NOT AFFECTED because the upstream fix (blacklisting this gadget class) was already present in version 2.21.2 before TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta in commit 840eae2ca81 (2020-05-01) and shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.21.2-tuxcare.4 is NOT vulnerable to CVE-2020-14195. The fix for this deserialization gadget vulnerability (blocking org.jsecurity.realm.jndi.JndiRealmFactory) was already present in the upstream jackson-databind 2.21.2 release. The blocklist entry exists at SubTypeValidator.java:207 and is actively enforced during polymorphic type resolution. This is an upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi) that shipped with the base 2.21.2 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "The target jackson-databind 2.21.2-tuxcare.4 is NOT vulnerable to CVE-2020-14195. The fix for this deserialization gadget vulnerability (blocking org.jsecurity.realm.jndi.JndiRealmFactory) was already present in the upstream jackson-databind 2.21.2 release. The blocklist entry exists at SubTypeValidator.java:207 and is actively enforced during polymorphic type resolution. This is an upstream fix authored by Tatu Saloranta (tatu.saloranta@iki.fi) that shipped with the base 2.21.2 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:24:07.299123+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is NOT present in jackson-databind 2.21.2-tuxcare.2. The fix (blocklist entry for \"br.com.anteros.dbcp.AnterosDBCPDataSource\") was already included in the upstream release 2.21.2 that TuxCare onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 is NOT present in jackson-databind 2.21.2-tuxcare.2. The fix (blocklist entry for \"br.com.anteros.dbcp.AnterosDBCPDataSource\") was already included in the upstream release 2.21.2 that TuxCare onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:18:59.019571+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.21.2-tuxcare.2 is not affected by CVE-2020-24750. The vulnerability was fixed in upstream version 2.9.10.6 (July 2020) by adding com.pastdev.httpcomponents.configuration.JndiConfiguration to the deserialization blacklist. Version 2.21.2 was released years later and includes this fix from the upstream release. The gadget class is blocked at SubTypeValidator.java:210, preventing the JNDI injection attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "The target jackson-databind version 2.21.2-tuxcare.2 is not affected by CVE-2020-24750. The vulnerability was fixed in upstream version 2.9.10.6 (July 2020) by adding com.pastdev.httpcomponents.configuration.JndiConfiguration to the deserialization blacklist. Version 2.21.2 was released years later and includes this fix from the upstream release. The gadget class is blocked at SubTypeValidator.java:210, preventing the JNDI injection attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in Jackson Databind DOM deserialization) is not present in jackson-databind version 2.21.2-tuxcare.3. The upstream fix (commit 612f971b78 by Tatu Saloranta) that adds XXE protections (disallow-doctype-decl=true and load-external-dtd=false) was already present in upstream version 2.21.2 before TuxCare onboarded it at commit d58835759e. The vulnerable code pattern is absent because the upstream fix shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE vulnerability in Jackson Databind DOM deserialization) is not present in jackson-databind version 2.21.2-tuxcare.3. The upstream fix (commit 612f971b78 by Tatu Saloranta) that adds XXE protections (disallow-doctype-decl=true and load-external-dtd=false) was already present in upstream version 2.21.2 before TuxCare onboarded it at commit d58835759e. The vulnerable code pattern is absent because the upstream fix shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:25:18.997176+00:00", "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 and involves deserialization gadgets in org.apache.commons.dbcp2.datasources classes. The target version 2.21.2-tuxcare.2 contains the upstream fix that blocks these gadget classes in SubTypeValidator.java. The fix (commit 41b8bdb5cc by Tatu Saloranta) was already present in the upstream release 2.21.2 before TuxCare onboarding, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35490" }, "impact_statement": "CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 and involves deserialization gadgets in org.apache.commons.dbcp2.datasources classes. The target version 2.21.2-tuxcare.2 contains the upstream fix that blocks these gadget classes in SubTypeValidator.java. The fix (commit 41b8bdb5cc by Tatu Saloranta) was already present in the upstream release 2.21.2 before TuxCare onboarding, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T12:58:17.463230+00:00", "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource, which are deserialization gadgets enabling JNDI injection attacks. The target version 2.21.2-tuxcare.1 already contains the upstream fix (commit 41b8bdb5cc by tatu.saloranta@iki.fi) that adds these classes to SubTypeValidator's forbidden type list. This fix was shipped in the upstream release 2.21.2 before TuxCare onboarding, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35491" }, "impact_statement": "CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource, which are deserialization gadgets enabling JNDI injection attacks. The target version 2.21.2-tuxcare.1 already contains the upstream fix (commit 41b8bdb5cc by tatu.saloranta@iki.fi) that adds these classes to SubTypeValidator's forbidden type list. This fix was shipped in the upstream release 2.21.2 before TuxCare onboarding, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:56:12.360360+00:00", "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.21.2-tuxcare.2. The vulnerability concerns unsafe deserialization of the JNDI gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit 1ca0388c2fb) added this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing its deserialization. This fix was already included in upstream version 2.21.2, which TuxCare onboarded. The target version 2.21.2 is significantly newer than the affected version range (2.x before 2.9.10.8), and the blocklist entry is confirmed present at line 240 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-35728" }, "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.21.2-tuxcare.2. The vulnerability concerns unsafe deserialization of the JNDI gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit 1ca0388c2fb) added this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing its deserialization. This fix was already included in upstream version 2.21.2, which TuxCare onboarded. The target version 2.21.2 is significantly newer than the affected version range (2.x before 2.9.10.8), and the blocklist entry is confirmed present at line 240 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T13:29:29.992370+00:00", "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is not present in jackson-databind 2.21.2-tuxcare.2. The upstream fix (commit 3ded28aece) was already included in the upstream release 2.21.2 that TuxCare onboarded. All five DriverAdapterCPDS class variants mentioned in the patch are blacklisted in SubTypeValidator.java, preventing their deserialization. The defense mechanism is actively enforced through validateSubType() called during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36179" }, "impact_statement": "CVE-2020-36179 is not present in jackson-databind 2.21.2-tuxcare.2. The upstream fix (commit 3ded28aece) was already included in the upstream release 2.21.2 that TuxCare onboarded. All five DriverAdapterCPDS class variants mentioned in the patch are blacklisted in SubTypeValidator.java, preventing their deserialization. The defense mechanism is actively enforced through validateSubType() called during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:46:24.540154+00:00", "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.21.2-tuxcare.2 is NOT AFFECTED by CVE-2020-36180. The vulnerability pattern (missing blocklist entries for DriverAdapterCPDS gadget classes) is not present because the upstream fix commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b was already included in the upstream release 2.12.1 (December 2020), well before version 2.21.2 was released. All five DriverAdapterCPDS class name entries added by the patch are present in SubTypeValidator.java at lines 123, 193, 219, 228, and 234, with comments referencing [databind#3004].\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36180" }, "impact_statement": "The target jackson-databind 2.21.2-tuxcare.2 is NOT AFFECTED by CVE-2020-36180. The vulnerability pattern (missing blocklist entries for DriverAdapterCPDS gadget classes) is not present because the upstream fix commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b was already included in the upstream release 2.12.1 (December 2020), well before version 2.21.2 was released. All five DriverAdapterCPDS class name entries added by the patch are present in SubTypeValidator.java at lines 123, 193, 219, 228, and 234, with comments referencing [databind#3004].\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:50:26.784780+00:00", "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.21.2-tuxcare.3 is NOT vulnerable to CVE-2020-36181. The fix (adding org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS to the deserialization blocklist in SubTypeValidator.java) was already present in the upstream 2.21.2 release that TuxCare onboarded. Fix commit 3ded28aece authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of the first TuxCare commit d58835759e. The blocklist entry exists at SubTypeValidator.java:228 and blocks deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36181" }, "impact_statement": "Target jackson-databind 2.21.2-tuxcare.3 is NOT vulnerable to CVE-2020-36181. The fix (adding org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS to the deserialization blocklist in SubTypeValidator.java) was already present in the upstream 2.21.2 release that TuxCare onboarded. Fix commit 3ded28aece authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of the first TuxCare commit d58835759e. The blocklist entry exists at SubTypeValidator.java:228 and blocks deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:15:42.590601+00:00", "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.21.2-tuxcare.2 is not affected by CVE-2020-36182. The vulnerability was fixed in upstream commit 3ded28aece by adding org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP gadget classes to the SubTypeValidator blocklist. This fix was already present in the upstream 2.21.2 release that TuxCare onboarded, confirmed by git ancestry showing the fix commit predates the first TuxCare commit d58835759e.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36182" }, "impact_statement": "Target jackson-databind 2.21.2-tuxcare.2 is not affected by CVE-2020-36182. The vulnerability was fixed in upstream commit 3ded28aece by adding org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP gadget classes to the SubTypeValidator blocklist. This fix was already present in the upstream 2.21.2 release that TuxCare onboarded, confirmed by git ancestry showing the fix commit predates the first TuxCare commit d58835759e.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:24:04.222754+00:00", "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.21.2-tuxcare.2) is not affected by CVE-2020-36183. The vulnerability pattern has been removed by an upstream fix that adds org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool to the deserialization blocklist in SubTypeValidator. This fix (commit 12e23c962ff) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.21.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36183" }, "impact_statement": "The target repository (jackson-databind 2.21.2-tuxcare.2) is not affected by CVE-2020-36183. The vulnerability pattern has been removed by an upstream fix that adds org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool to the deserialization blocklist in SubTypeValidator. This fix (commit 12e23c962ff) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.21.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T12:49:38.434607+00:00", "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes. The target (jackson-databind 2.21.2) is NOT AFFECTED because the upstream fix was already present in the 2.21.2 release before TuxCare onboarding. The fix adds PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java (lines 235-236), preventing exploitation by throwing \"Illegal type to deserialize: prevented for security reasons\" when these classes are encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36184" }, "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes. The target (jackson-databind 2.21.2) is NOT AFFECTED because the upstream fix was already present in the 2.21.2 release before TuxCare onboarding. The fix adds PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java (lines 235-236), preventing exploitation by throwing \"Illegal type to deserialize: prevented for security reasons\" when these classes are encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:12:27.199890+00:00", "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8. The target version 2.21.2-tuxcare.2 contains the upstream fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. These classes are in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 235-236), which is enforced during deserialization via BeanDeserializerFactory. The fix shipped with upstream release 2.21.2, not as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36185" }, "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8. The target version 2.21.2-tuxcare.2 contains the upstream fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. These classes are in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 235-236), which is enforced during deserialization via BeanDeserializerFactory. The fix shipped with upstream release 2.21.2, not as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:41:24.721852+00:00", "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 affects jackson-databind versions before 2.9.10.8, related to deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. The target version 2.21.2-tuxcare.2 is not affected because the upstream fix (commit 3e8fa3beea by Tatu Saloranta, dated 2020-12-26) was already included in the upstream 2.21.2 release that TuxCare onboarded. The fix adds PerUserPoolDataSource and SharedPoolDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing deserialization of these dangerous classes. The blocklist entries are present at lines 229-230 and are actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36186" }, "impact_statement": "CVE-2020-36186 affects jackson-databind versions before 2.9.10.8, related to deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. The target version 2.21.2-tuxcare.2 is not affected because the upstream fix (commit 3e8fa3beea by Tatu Saloranta, dated 2020-12-26) was already included in the upstream 2.21.2 release that TuxCare onboarded. The fix adds PerUserPoolDataSource and SharedPoolDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing deserialization of these dangerous classes. The blocklist entries are present at lines 229-230 and are actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:51:16.476690+00:00", "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is not present in jackson-databind 2.21.2. The vulnerability allowed deserialization of dangerous Tomcat DBCP datasource classes (SharedPoolDataSource, PerUserPoolDataSource) that could be exploited for arbitrary code execution. The upstream fix (commit 3e8fa3beea, \"Fixed #2997\" by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was already present in the upstream 2.21.2 release that TuxCare onboarded (commit d58835759e, Dec 2020). The target version is well beyond the affected range (2.x before 2.9.10.8). While TuxCare has backported this CVE to older versions (2.7.x, 2.8.x, 2.9.x branches), no backport was needed for 2.21.2 as it shipped with the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36187" }, "impact_statement": "CVE-2020-36187 is not present in jackson-databind 2.21.2. The vulnerability allowed deserialization of dangerous Tomcat DBCP datasource classes (SharedPoolDataSource, PerUserPoolDataSource) that could be exploited for arbitrary code execution. The upstream fix (commit 3e8fa3beea, \"Fixed #2997\" by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was already present in the upstream 2.21.2 release that TuxCare onboarded (commit d58835759e, Dec 2020). The target version is well beyond the affected range (2.x before 2.9.10.8). While TuxCare has backported this CVE to older versions (2.7.x, 2.8.x, 2.9.x branches), no backport was needed for 2.21.2 as it shipped with the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:00:30.548174+00:00", "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5 due to missing blocklist entries for newrelic-agent embedded logback classes (JNDIConnectionSource and DriverManagerConnectionSource) that enable JNDI injection during polymorphic deserialization. The target repository (jackson-databind 2.21.2-tuxcare.2) already contains the fix in SubTypeValidator.java lines 223-224, which blocks deserialization of these gadget classes. The fix was authored by upstream maintainer Tatu Saloranta (commit 33d96c13fe) and was already present in upstream jackson-databind 2.21.2 when TuxCare onboarded that version (commit d58835759e). The defense is actively enforced through BeanDeserializerFactory calling SubTypeValidator.validateSubType, which checks the blocklist and throws an exception for blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36188" }, "impact_statement": "CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5 due to missing blocklist entries for newrelic-agent embedded logback classes (JNDIConnectionSource and DriverManagerConnectionSource) that enable JNDI injection during polymorphic deserialization. The target repository (jackson-databind 2.21.2-tuxcare.2) already contains the fix in SubTypeValidator.java lines 223-224, which blocks deserialization of these gadget classes. The fix was authored by upstream maintainer Tatu Saloranta (commit 33d96c13fe) and was already present in upstream jackson-databind 2.21.2 when TuxCare onboarded that version (commit d58835759e). The defense is actively enforced through BeanDeserializerFactory calling SubTypeValidator.validateSubType, which checks the blocklist and throws an exception for blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T13:10:32.786596+00:00", "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db classes. Version 2.21.2 is not affected because the fix (blocklist entries for JNDIConnectionSource and DriverManagerConnectionSource) was already present in the upstream release that TuxCare onboarded. The vulnerable code pattern is absent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36189" }, "impact_statement": "CVE-2020-36189 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db classes. Version 2.21.2 is not affected because the fix (blocklist entries for JNDIConnectionSource and DriverManagerConnectionSource) was already present in the upstream release that TuxCare onboarded. The vulnerable code pattern is absent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T14:20:14.370746+00:00", "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.21.2-tuxcare.2 is not affected by CVE-2020-36518. The vulnerability (stack overflow from deeply nested JSON) was fixed by upstream in commit 8238ab41d0 (\"Fix #3473 (re-implementation of #2816 for 2.14)\"), which replaced the recursive UntypedObjectDeserializer.Vanilla class with an iterative implementation (UntypedObjectDeserializerNR) that prevents stack overflow. This fix shipped in upstream release 2.14.0 and was already present in version 2.21.2 when TuxCare onboarded it (commit d58835759e).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-36518" }, "impact_statement": "The target jackson-databind version 2.21.2-tuxcare.2 is not affected by CVE-2020-36518. The vulnerability (stack overflow from deeply nested JSON) was fixed by upstream in commit 8238ab41d0 (\"Fix #3473 (re-implementation of #2816 for 2.14)\"), which replaced the recursive UntypedObjectDeserializer.Vanilla class with an iterative implementation (UntypedObjectDeserializerNR) that prevents stack overflow. This fix shipped in upstream release 2.14.0 and was already present in version 2.21.2 when TuxCare onboarded it (commit d58835759e).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:20:17.888209+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840: Target jackson-databind 2.21.2 is NOT AFFECTED. The vulnerability involves deserialization of org.apache.xbean.propertyeditor.JndiConverter (a JNDI gadget class) leading to arbitrary code execution. The fix (adding JndiConverter to the deserialization blocklist) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.21.2. The blocklist entry exists at SubTypeValidator.java:138 and is actively enforced during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840: Target jackson-databind 2.21.2 is NOT AFFECTED. The vulnerability involves deserialization of org.apache.xbean.propertyeditor.JndiConverter (a JNDI gadget class) leading to arbitrary code execution. The fix (adding JndiConverter to the deserialization blocklist) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.21.2. The blocklist entry exists at SubTypeValidator.java:138 and is actively enforced during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is not present in jackson-databind 2.21.2-tuxcare.4. The fix, which adds org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to the deserialization deny-list in SubTypeValidator.java (line 141), was already present in the upstream version 2.21.2 when TuxCare onboarded it. This is an upstream fix authored by Tatu Saloranta (the jackson-databind maintainer) in commit 9f4e97019fb on 2020-02-29. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 is not present in jackson-databind 2.21.2-tuxcare.4. The fix, which adds org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to the deserialization deny-list in SubTypeValidator.java (line 141), was already present in the upstream version 2.21.2 when TuxCare onboarded it. This is an upstream fix authored by Tatu Saloranta (the jackson-databind maintainer) in commit 9f4e97019fb on 2020-02-29. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:48:33.739879+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is not present in jackson-databind 2.21.2-tuxcare.2. The upstream fix that blocks deserialization of com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig was already included in the upstream release (v2.21.2) that TuxCare onboarded. The vulnerable gadget class is blocked via SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES at line 144.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 is not present in jackson-databind 2.21.2-tuxcare.2. The upstream fix that blocks deserialization of com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig was already included in the upstream release (v2.21.2) that TuxCare onboarded. The vulnerable gadget class is blocked via SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES at line 144.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:23:34.424796+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4/2.8.11.6/2.7.9.7 due to missing blocklist entry for the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.21.2-tuxcare.2) already contains the upstream fix that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 145). The fix was shipped in upstream version 2.21.2 before TuxCare onboarded it, authored by Tatu Saloranta (tatu.saloranta@iki.fi). The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4/2.8.11.6/2.7.9.7 due to missing blocklist entry for the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.21.2-tuxcare.2) already contains the upstream fix that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 145). The fix was shipped in upstream version 2.21.2 before TuxCare onboarded it, authored by Tatu Saloranta (tatu.saloranta@iki.fi). The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:18:37.633690+00:00", "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.21.2-tuxcare.2. The vulnerability involves deserialization of the dangerous class javax.swing.JTextPane, which can lead to arbitrary code execution. The upstream fix (commit 7dbf51bf by Tatu Saloranta) added JTextPane to the SubTypeValidator blocklist and was already included in upstream release 2.21.2 when TuxCare onboarded this version. The defense code is present at SubTypeValidator.java:151.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20190" }, "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.21.2-tuxcare.2. The vulnerability involves deserialization of the dangerous class javax.swing.JTextPane, which can lead to arbitrary code execution. The upstream fix (commit 7dbf51bf by Tatu Saloranta) added JTextPane to the SubTypeValidator blocklist and was already included in upstream release 2.21.2 when TuxCare onboarded this version. The defense code is present at SubTypeValidator.java:151.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 is not present in jackson-databind 2.21.2-tuxcare.4. The vulnerability (unchecked heap allocation in NodeSerialization.readExternal allowing 2GB DoS) was fixed in upstream commit 3ccde7d938 by Tatu Saloranta, which shipped in the upstream 2.21.2 release that TuxCare onboarded. The current code implements the defense: LONGEST_EAGER_ALLOC=100k limit with incremental ByteArrayBuilder allocation for large inputs, preventing malicious length values from causing massive upfront allocations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46877" }, "impact_statement": "CVE-2021-46877 is not present in jackson-databind 2.21.2-tuxcare.4. The vulnerability (unchecked heap allocation in NodeSerialization.readExternal allowing 2GB DoS) was fixed in upstream commit 3ccde7d938 by Tatu Saloranta, which shipped in the upstream 2.21.2 release that TuxCare onboarded. The current code implements the defense: LONGEST_EAGER_ALLOC=100k limit with incremental ByteArrayBuilder allocation for large inputs, preventing malicious length values from causing massive upfront allocations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T16:52:51.215173+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.21.2-tuxcare.3 is NOT AFFECTED by CVE-2022-42003. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream jackson-databind 2.14.0 and backported to 2.12.7.1 and 2.13.4.2. Version 2.21.2 is significantly newer and contains the complete upstream fix. The defense code (handleNestedArrayForSingle checks) is present in both StdDeserializer.java and BeanDeserializer.java, blocking consecutive START_ARRAY tokens during single-value unwrapping. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.21.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "Target version 2.21.2-tuxcare.3 is NOT AFFECTED by CVE-2022-42003. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream jackson-databind 2.14.0 and backported to 2.12.7.1 and 2.13.4.2. Version 2.21.2 is significantly newer and contains the complete upstream fix. The defense code (handleNestedArrayForSingle checks) is present in both StdDeserializer.java and BeanDeserializer.java, blocking consecutive START_ARRAY tokens during single-value unwrapping. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.21.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-03T15:06:35.446673+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 is NOT present in jackson-databind 2.21.2-tuxcare.2. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed by upstream in commit 063183589218fec19a9293ed2f17ec53ea80ba88, which shipped in the upstream 2.21.2 release. The fix adds a check in BeanDeserializer._deserializeFromArray() to reject consecutive START_ARRAY tokens, preventing unbounded recursion. This upstream fix was present before TuxCare onboarded version 2.21.2, and remains intact in the current HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "CVE-2022-42004 is NOT present in jackson-databind 2.21.2-tuxcare.2. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed by upstream in commit 063183589218fec19a9293ed2f17ec53ea80ba88, which shipped in the upstream 2.21.2 release. The fix adds a check in BeanDeserializer._deserializeFromArray() to reject consecutive START_ARRAY tokens, preventing unbounded recursion. This upstream fix was present before TuxCare onboarded version 2.21.2, and remains intact in the current HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:10:01.816801+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-02T20:23:00.112323+00:00", "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 (DoS via deeply nested JsonNode.toString()) is NOT present in jackson-databind 2.21.2-tuxcare.4. The upstream fix (commit a1fa4ae4ec, \"Fix #3447\", dated 2022-05-04) was already included in the upstream 2.21.2 release that TuxCare onboarded. The fix replaces recursive serialization with an explicit IteratorStack to prevent stack exhaustion when serializing deeply nested JSON trees...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50193" }, "impact_statement": "not_affected \u2014 CVE-2026-50193 (DoS via deeply nested JsonNode.toString()) is NOT present in jackson-databind 2.21.2-tuxcare.4. The upstream fix (commit a1fa4ae4ec, \"Fix #3447\", dated 2022-05-04) was already included in the upstream 2.21.2 release that TuxCare onboarded. The fix replaces recursive serialization with an explicit IteratorStack to prevent stack exhaustion when serializing deeply nested JSON trees..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-54512 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" }, "action_statement": "Vulnerability CVE-2026-54512 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-54518 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54518" }, "action_statement": "Vulnerability CVE-2026-54518 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59888" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.21.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2-tuxcare.2" } } ], "timestamp": "2026-11-01T14:09:34.124596+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.21.2-tuxcare.2.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }