{ "@id": "urn:uuid:1e779875-ed46-437f-906b-be102f48b628", "role": "Document Creator", "author": "https://tuxcare.com", "version": 31, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T11:12:00.038548+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is com.fasterxml.jackson.core:jackson-databind 2.8.11.3 \u2014 the CVE's affected product (not false_positive). CVE-2017-15095 extended CVE-2017-7525 by blacklisting additional polymorphic-deserialization gadget classes. The upstream fix landed in 2.8.11; the target (2.8.11.3) is built on that base and already contains the fix. SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES holds the exact CVE-2017-15095 additions: com.sun.rowset.JdbcRowSetImpl (#1680, line 44), java.util.logging.FileHandler + java.rmi.server.UnicastRemoteObject (#1737, lines 46-47), org.springframework.beans.factory.config.PropertyPathFactoryBean (#1737, line 50). The Spring AbstractPointcutAdvisor/AbstractApplicationContext superclass checks (lines 121-123) and c3p0 endsWith(\"DataSource\") check (line 134) generalize (and exceed) the original individual #1737 entries. The defense is reachable during deserialization: BeanDeserializerFactory:142 -> _validateSubType:866 -> SubTypeValidator.validateSubType:99 throws JsonMappingException for any type whose fully-qualified name is in the deny-set, before the deserializer/instance is built. git blame attributes all these lines to upstream maintainer Tatu Saloranta (commit 2235894210, 2017-12-18 \u2014 the upstream 2.8.11 fix date), merged via upstream 2.6->2.7->2.8 branch merges. No CloudLinux/TuxCare author touched them. Verdict: not_affected (upstream vendor fix already present in the shipped version); justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-23; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "not_affected \u2014 Target is com.fasterxml.jackson.core:jackson-databind 2.8.11.3 \u2014 the CVE's affected product (not false_positive). CVE-2017-15095 extended CVE-2017-7525 by blacklisting additional polymorphic-deserialization gadget classes. The upstream fix landed in 2.8.11; the target (2.8.11.3) is built on that base and already contains the fix. SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES holds the exact CVE-2017-15095 additions: com.sun.rowset.JdbcRowSetImpl (#1680, line 44), java.util.logging.FileHandler + java.rmi.server.UnicastRemoteObject (#1737, lines 46-47), org.springframework.beans.factory.config.PropertyPathFactoryBean (#1737, line 50). The Spring AbstractPointcutAdvisor/AbstractApplicationContext superclass checks (lines 121-123) and c3p0 endsWith(\"DataSource\") check (line 134) generalize (and exceed) the original individual #1737 entries. The defense is reachable during deserialization: BeanDeserializerFactory:142 -> _validateSubType:866 -> SubTypeValidator.validateSubType:99 throws JsonMappingException for any type whose fully-qualified name is in the deny-set, before the deserializer/instance is built. git blame attributes all these lines to upstream maintainer Tatu Saloranta (commit 2235894210, 2017-12-18 \u2014 the upstream 2.8.11 fix date), merged via upstream 2.6->2.7->2.8 branch merges. No CloudLinux/TuxCare author touched them. Verdict: not_affected (upstream vendor fix already present in the shipped version); justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-23; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind 2.8.11.3 (product-identity match with the CVE's affected product). CVE-2017-17485 is the incomplete-fix bypass of CVE-2017-7525's polymorphic-deserialization blacklist, exploitable via Spring gadget classes (org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor and org.springframework.beans.factory.config.PropertyPathFactoryBean) that slipped past the earlier deny-list. The upstream fix (jackson-databind issue #1855) hardens SubTypeValidator's deny-list. The target's src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java already contains the complete fix: PropertyPathFactoryBean is on the explicit deny-list (line 50), and AbstractBeanFactoryPointcutAdvisor is blocked by the superclass-walking check (lines 117-126) that rejects any org.springframework.* class whose ancestor is AbstractPointcutAdvisor or AbstractApplicationContext (this robust check \"deprecated\" the plain literal entry per the line 49 comment). The fix was authored upstream by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 2235894210 \"Fix #1855\" (2017-12-18, one of the task's patch commits) and shipped in the upstream 2.8.11 release. The pre-fix vulnerable pattern is therefore not present in HEAD. Verdict: not_affected (upstream fix baked into the shipped version); justification code_not_present. This is an upstream fix, not a TuxCare/CloudLinux backport, so it is not \"already_fixed\". [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "not_affected \u2014 Target is jackson-databind 2.8.11.3 (product-identity match with the CVE's affected product). CVE-2017-17485 is the incomplete-fix bypass of CVE-2017-7525's polymorphic-deserialization blacklist, exploitable via Spring gadget classes (org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor and org.springframework.beans.factory.config.PropertyPathFactoryBean) that slipped past the earlier deny-list. The upstream fix (jackson-databind issue #1855) hardens SubTypeValidator's deny-list. The target's src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java already contains the complete fix: PropertyPathFactoryBean is on the explicit deny-list (line 50), and AbstractBeanFactoryPointcutAdvisor is blocked by the superclass-walking check (lines 117-126) that rejects any org.springframework.* class whose ancestor is AbstractPointcutAdvisor or AbstractApplicationContext (this robust check \"deprecated\" the plain literal entry per the line 49 comment). The fix was authored upstream by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 2235894210 \"Fix #1855\" (2017-12-18, one of the task's patch commits) and shipped in the upstream 2.8.11 release. The pre-fix vulnerable pattern is therefore not present in HEAD. Verdict: not_affected (upstream fix baked into the shipped version); justification code_not_present. This is an upstream fix, not a TuxCare/CloudLinux backport, so it is not \"already_fixed\". [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:29:58.600651+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is NOT present in jackson-databind 2.8.11.3-tuxcare.2. The upstream fix (commit 60d459cedc) was included in version 2.8.10 and is present in the onboarded release 2.8.11.3. The SubTypeValidator class blocks deserialization of both TemplatesImpl variants (com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl and org.apache.xalan.xsltc.trax.TemplatesImpl) that enable arbitrary code execution. The validation is invoked before bean deserialization at BeanDeserializerFactory line 142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 is NOT present in jackson-databind 2.8.11.3-tuxcare.2. The upstream fix (commit 60d459cedc) was included in version 2.8.10 and is present in the onboarded release 2.8.11.3. The SubTypeValidator class blocks deserialization of both TemplatesImpl variants (com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl and org.apache.xalan.xsltc.trax.TemplatesImpl) that enable arbitrary code execution. The validation is invoked before bean deserialization at BeanDeserializerFactory line 142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:21:55.137725+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.8.11.3-tuxcare.2. The fix (blacklist entry for org.apache.ibatis.parsing.XPathParser) was already included in the upstream release 2.8.11.3 before TuxCare onboarded this version. The blacklist entry at line 61 of SubTypeValidator.java blocks deserialization of the iBatis gadget class, preventing the data exfiltration attack vector. The fix was authored by upstream maintainer Tatu Saloranta on May 10, 2018 (commit 27b4defc27) and is an ancestor of both the upstream tag jackson-databind-2.8.11.3 and the first TuxCare onboarding commit (a98464c1 \"Onboard version 2.8.11.3\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.8.11.3-tuxcare.2. The fix (blacklist entry for org.apache.ibatis.parsing.XPathParser) was already included in the upstream release 2.8.11.3 before TuxCare onboarded this version. The blacklist entry at line 61 of SubTypeValidator.java blocks deserialization of the iBatis gadget class, preventing the data exfiltration attack vector. The fix was authored by upstream maintainer Tatu Saloranta on May 10, 2018 (commit 27b4defc27) and is an ancestor of both the upstream tag jackson-databind-2.8.11.3 and the first TuxCare onboarding commit (a98464c1 \"Onboard version 2.8.11.3\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T17:21:23.053995+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is NOT present in jackson-databind 2.8.11.3-tuxcare.3. The vulnerability involves polymorphic deserialization gadgets that allow arbitrary code execution via JNDI/LDAP injection when Default Typing is enabled. The vendor patches blacklist three classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. Analysis confirms these blacklist entries are present in the target at lines 64, 67-68, indicating the fix was already shipped in the upstream release 2.8.11.3, prior to TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 is NOT present in jackson-databind 2.8.11.3-tuxcare.3. The vulnerability involves polymorphic deserialization gadgets that allow arbitrary code execution via JNDI/LDAP injection when Default Typing is enabled. The vendor patches blacklist three classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. Analysis confirms these blacklist entries are present in the target at lines 64, 67-68, indicating the fix was already shipped in the upstream release 2.8.11.3, prior to TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:21:53.187202+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind prior to 2.8.11.2. The target is running version 2.8.11.3, which includes the upstream fix. The Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) are blacklisted in SubTypeValidator.java (lines 67-68), preventing their deserialization. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 28badf7ef6 and shipped in upstream release 2.8.11.2, prior to TuxCare's onboarding of version 2.8.11.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 affects jackson-databind prior to 2.8.11.2. The target is running version 2.8.11.3, which includes the upstream fix. The Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) are blacklisted in SubTypeValidator.java (lines 67-68), preventing their deserialization. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 28badf7ef6 and shipped in upstream release 2.8.11.2, prior to TuxCare's onboarding of version 2.8.11.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:58:31.761827+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 does not affect jackson-databind 2.8.11.3-tuxcare.2. The vulnerability involves polymorphic deserialization of slf4j-ext classes (specifically org.slf4j.ext.EventData) that could lead to arbitrary code execution. The fix (commit 87d29af25e) adds org.slf4j.ext.EventData and three other classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was authored by Tatu Saloranta (upstream) and shipped in upstream release 2.8.11.3, which TuxCare onboarded. The target is based on this fixed version, and the blocklist entry is present at HEAD (line 74 of SubTypeValidator.java). The blocklist is enforced unconditionally during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 does not affect jackson-databind 2.8.11.3-tuxcare.2. The vulnerability involves polymorphic deserialization of slf4j-ext classes (specifically org.slf4j.ext.EventData) that could lead to arbitrary code execution. The fix (commit 87d29af25e) adds org.slf4j.ext.EventData and three other classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was authored by Tatu Saloranta (upstream) and shipped in upstream release 2.8.11.3, which TuxCare onboarded. The target is based on this fixed version, and the blocklist entry is present at HEAD (line 74 of SubTypeValidator.java). The blocklist is enforced unconditionally during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:01:48.562174+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 does not affect this target. The vulnerability involves polymorphic deserialization of BlazeDS classes that could lead to arbitrary code execution. The fix (blocking flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor in SubTypeValidator.java line 75) was already present in upstream release 2.8.11.3 that TuxCare onboarded. The CVE description states \"before 2.8.11.3\" meaning 2.8.11.3 IS the fixed version. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 does not affect this target. The vulnerability involves polymorphic deserialization of BlazeDS classes that could lead to arbitrary code execution. The fix (blocking flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor in SubTypeValidator.java line 75) was already present in upstream release 2.8.11.3 that TuxCare onboarded. The CVE description states \"before 2.8.11.3\" meaning 2.8.11.3 IS the fixed version. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:09:29.528523+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository version 2.8.11.3-tuxcare.2 is NOT vulnerable to CVE-2018-14720. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44) that blacklists the four dangerous classes was already present in the upstream release 2.8.11.3 when TuxCare onboarded it. The fix prevents polymorphic deserialization of org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl by adding them to SubTypeValidator's blacklist (DEFAULT_NO_DESER_CLASS_NAMES).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "The target repository version 2.8.11.3-tuxcare.2 is NOT vulnerable to CVE-2018-14720. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44) that blacklists the four dangerous classes was already present in the upstream release 2.8.11.3 when TuxCare onboarded it. The fix prevents polymorphic deserialization of org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl by adding them to SubTypeValidator's blacklist (DEFAULT_NO_DESER_CLASS_NAMES).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T14:40:05.423100+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.8.11.3-tuxcare.2. The vulnerability was fixed by upstream maintainer Tatu Saloranta in commit 87d29af25e, which added org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl (and three other dangerous classes) to the deserialization blocklist. This fix was already present in upstream release 2.8.11.3 when TuxCare onboarded it. The blocklist is located in SubTypeValidator.java (lines 74-77) in this version, though the original patch modified BeanDeserializerFactory.java - this is an architectural refactoring, but the defense is semantically equivalent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.8.11.3-tuxcare.2. The vulnerability was fixed by upstream maintainer Tatu Saloranta in commit 87d29af25e, which added org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl (and three other dangerous classes) to the deserialization blocklist. This fix was already present in upstream release 2.8.11.3 when TuxCare onboarded it. The blocklist is located in SubTypeValidator.java (lines 74-77) in this version, though the original patch modified BeanDeserializerFactory.java - this is an architectural refactoring, but the defense is semantically equivalent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T12:52:53.936815+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for dangerous deserialization gadget classes, specifically org.apache.axis2.transport.jms.JMSOutTransportInfo. The target repository (version 2.8.11.3) already contains the fix in SubTypeValidator.java (lines 79-83), which adds the dangerous class to DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was authored by the upstream vendor (Tatu Saloranta) and shipped in the upstream 2.8.11.3 release on 2018-11-23, before TuxCare onboarded this version on 2026-09-20. The vulnerable pattern is not present in the target because it was fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for dangerous deserialization gadget classes, specifically org.apache.axis2.transport.jms.JMSOutTransportInfo. The target repository (version 2.8.11.3) already contains the fix in SubTypeValidator.java (lines 79-83), which adds the dangerous class to DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was authored by the upstream vendor (Tatu Saloranta) and shipped in the upstream 2.8.11.3 release on 2018-11-23, before TuxCare onboarded this version on 2026-09-20. The vulnerable pattern is not present in the target because it was fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T16:58:57.863833+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is NOT present in jackson-databind 2.8.11.3-tuxcare.3. The vulnerability concerns the failure to block OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) from polymorphic deserialization. The upstream fix (commit 72cd4025a2) added these classes to the SubTypeValidator blocklist, and this fix was already included in the upstream 2.8.11.3 release that TuxCare onboarded. The target repository contains the complete fix at SubTypeValidator.java lines 81-82.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 is NOT present in jackson-databind 2.8.11.3-tuxcare.3. The vulnerability concerns the failure to block OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) from polymorphic deserialization. The upstream fix (commit 72cd4025a2) added these classes to the SubTypeValidator blocklist, and this fix was already included in the upstream 2.8.11.3 release that TuxCare onboarded. The target repository contains the complete fix at SubTypeValidator.java lines 81-82.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T15:26:39.614024+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.8.11.3 is NOT AFFECTED by CVE-2018-19362. The upstream vendor (FasterXML) fixed this polymorphic deserialization vulnerability in jackson-databind by adding jboss-common-core class 'org.jboss.util.propertyeditor.DocumentEditor' to the deserialization blocklist in commit 72cd4025a2 (Nov 19, 2018). This fix was already present in the upstream release 2.8.11.3 when TuxCare onboarded it (commit a98464c1). The vulnerable code pattern (ability to deserialize dangerous jboss-common-core classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "Target version 2.8.11.3 is NOT AFFECTED by CVE-2018-19362. The upstream vendor (FasterXML) fixed this polymorphic deserialization vulnerability in jackson-databind by adding jboss-common-core class 'org.jboss.util.propertyeditor.DocumentEditor' to the deserialization blocklist in commit 72cd4025a2 (Nov 19, 2018). This fix was already present in the upstream release 2.8.11.3 when TuxCare onboarded it (commit a98464c1). The vulnerable code pattern (ability to deserialize dangerous jboss-common-core classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target jackson-databind 2.8.11.3 (HEAD 9f40b11aa) is NOT affected by CVE-2018-5968. The CVE's fix (jackson issue #1899) simply adds two deserialization gadget class names to the DEFAULT_NO_DESER_CLASS_NAMES deny-list in SubTypeValidator.java. Both names are already present in the target: \"org.hibernate.jmx.StatisticsService\" and \"org.apache.ibatis.datasource.jndi.JndiDataSourceFactory\" (lines 58-59, redundantly re-added at 70-71). validateSubType() rejects any type whose raw FQCN is in that set (exact-match at line 108) by throwing JsonMappingException at line 141, before the bean is built. This check sits on the polymorphic/default-typing deserialization path (BeanDeserializerFactory.createBeanDeserializer -> _validateSubType (line 142) -> SubTypeValidator.validateSubType (line 866), invoked before buildBeanDeserializer). The fix is UPSTREAM-authored: line 57-59 come from commit 038b471e (Tatu Saloranta, upstream lead, tatu.saloranta@iki.fi, 2018-01-21) and the duplicate 69-71 from 454be8bb (MaximilianTews, committed by Tatu Saloranta, 2018-06-26) - both are the exact vendor patch commits, both predate the CloudLinux onboarding commit (a98464c16, amoniatovskiy@cloudlinux.com, 2026). No @cloudlinux.com/@tuxcare.com author ever touched this file, so this is a vendor-already-fixed case, not a TuxCare backport. Verdict: not_affected / code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "not_affected \u2014 Target jackson-databind 2.8.11.3 (HEAD 9f40b11aa) is NOT affected by CVE-2018-5968. The CVE's fix (jackson issue #1899) simply adds two deserialization gadget class names to the DEFAULT_NO_DESER_CLASS_NAMES deny-list in SubTypeValidator.java. Both names are already present in the target: \"org.hibernate.jmx.StatisticsService\" and \"org.apache.ibatis.datasource.jndi.JndiDataSourceFactory\" (lines 58-59, redundantly re-added at 70-71). validateSubType() rejects any type whose raw FQCN is in that set (exact-match at line 108) by throwing JsonMappingException at line 141, before the bean is built. This check sits on the polymorphic/default-typing deserialization path (BeanDeserializerFactory.createBeanDeserializer -> _validateSubType (line 142) -> SubTypeValidator.validateSubType (line 866), invoked before buildBeanDeserializer). The fix is UPSTREAM-authored: line 57-59 come from commit 038b471e (Tatu Saloranta, upstream lead, tatu.saloranta@iki.fi, 2018-01-21) and the duplicate 69-71 from 454be8bb (MaximilianTews, committed by Tatu Saloranta, 2018-06-26) - both are the exact vendor patch commits, both predate the CloudLinux onboarding commit (a98464c16, amoniatovskiy@cloudlinux.com, 2026). No @cloudlinux.com/@tuxcare.com author ever touched this file, so this is a vendor-already-fixed case, not a TuxCare backport. Verdict: not_affected / code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T13:56:02.232476+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.8.11.3-tuxcare.2. The vulnerability concerns incomplete blacklist filtering for c3p0 DataSource gadgets that allowed deserialization-based RCE. The upstream vendor (FasterXML) fixed this in version 2.8.11.1 (commit 6799f8f1) by replacing the narrow c3p0 class blacklist with a pattern-based check that blocks ALL classes starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\". This fix was already present in the upstream 2.8.11.1 release, which predates the target version 2.8.11.3 that TuxCare onboarded. The target's SubTypeValidator.java (lines 23, 171-181) contains the complete defense logic. Verdict: not_affected (upstream fix already shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.8.11.3-tuxcare.2. The vulnerability concerns incomplete blacklist filtering for c3p0 DataSource gadgets that allowed deserialization-based RCE. The upstream vendor (FasterXML) fixed this in version 2.8.11.1 (commit 6799f8f1) by replacing the narrow c3p0 class blacklist with a pattern-based check that blocks ALL classes starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\". This fix was already present in the upstream 2.8.11.1 release, which predates the target version 2.8.11.3 that TuxCare onboarded. The target's SubTypeValidator.java (lines 23, 171-181) contains the complete defense logic. Verdict: not_affected (upstream fix already shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-10T11:12:00.038548+00:00", "status_notes": "Vulnerability CVE-2019-12086 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.6.", "vulnerability": { "name": "CVE-2019-12086" }, "action_statement": "Vulnerability CVE-2019-12086 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:35:57.896695+00:00", "status_notes": "Vulnerability CVE-2019-12384 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4.", "vulnerability": { "name": "CVE-2019-12384" }, "action_statement": "Vulnerability CVE-2019-12384 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:35:57.896695+00:00", "status_notes": "Vulnerability CVE-2019-12814 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4.", "vulnerability": { "name": "CVE-2019-12814" }, "action_statement": "Vulnerability CVE-2019-12814 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:10:00.217578+00:00", "status_notes": "Vulnerability CVE-2019-14379 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14379" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2019-14439 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14439" }, "action_statement": "Vulnerability CVE-2019-14439 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:35:57.896695+00:00", "status_notes": "Vulnerability CVE-2019-14540 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4.", "vulnerability": { "name": "CVE-2019-14540" }, "action_statement": "Vulnerability CVE-2019-14540 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2019-14892 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14892" }, "action_statement": "Vulnerability CVE-2019-14892 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2019-14893 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14893" }, "action_statement": "Vulnerability CVE-2019-14893 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2019-16335 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16335" }, "action_statement": "Vulnerability CVE-2019-16335 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:43:34.152481+00:00", "status_notes": "Vulnerability CVE-2019-16942 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2019-16942" }, "action_statement": "Vulnerability CVE-2019-16942 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2019-16943 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16943" }, "action_statement": "Vulnerability CVE-2019-16943 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-10T11:12:00.038548+00:00", "status_notes": "Vulnerability CVE-2019-17267 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.6.", "vulnerability": { "name": "CVE-2019-17267" }, "action_statement": "Vulnerability CVE-2019-17267 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2019-17531 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17531" }, "action_statement": "Vulnerability CVE-2019-17531 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:42:49.067691+00:00", "status_notes": "Vulnerability CVE-2019-20330 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2019-20330" }, "action_statement": "Vulnerability CVE-2019-20330 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:41:41.171533+00:00", "status_notes": "Vulnerability CVE-2020-10650 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-10650" }, "action_statement": "Vulnerability CVE-2020-10650 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-10T11:12:00.038548+00:00", "status_notes": "Vulnerability CVE-2020-10672 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-10672" }, "action_statement": "Vulnerability CVE-2020-10672 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:40:17.239045+00:00", "status_notes": "Vulnerability CVE-2020-10673 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-10673" }, "action_statement": "Vulnerability CVE-2020-10673 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:40:19.262937+00:00", "status_notes": "Vulnerability CVE-2020-10969 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-10969" }, "action_statement": "Vulnerability CVE-2020-10969 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:42:00.049447+00:00", "status_notes": "Vulnerability CVE-2020-11111 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11111" }, "action_statement": "Vulnerability CVE-2020-11111 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2020-11112 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11112" }, "action_statement": "Vulnerability CVE-2020-11112 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:42:49.067691+00:00", "status_notes": "Vulnerability CVE-2020-11113 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11113" }, "action_statement": "Vulnerability CVE-2020-11113 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:40:45.628896+00:00", "status_notes": "Vulnerability CVE-2020-11619 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11619" }, "action_statement": "Vulnerability CVE-2020-11619 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-10T11:12:00.038548+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.6." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:10:00.217578+00:00", "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:10:00.217578+00:00", "status_notes": "Vulnerability CVE-2020-14061 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:09:00.173024+00:00", "status_notes": "Vulnerability CVE-2020-14062 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:42:49.067691+00:00", "status_notes": "Vulnerability CVE-2020-14195 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-14195" }, "action_statement": "Vulnerability CVE-2020-14195 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:10:00.217578+00:00", "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:10:00.217578+00:00", "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:09:00.173024+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:09:00.173024+00:00", "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:41:41.171533+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:41:53.321938+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:35:57.896695+00:00", "status_notes": "Vulnerability CVE-2020-36183 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36183" }, "action_statement": "Vulnerability CVE-2020-36183 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-02T12:32:32.642822+00:00", "status_notes": "Vulnerability CVE-2020-36187 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.3.", "vulnerability": { "name": "CVE-2020-36187" }, "action_statement": "Vulnerability CVE-2020-36187 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-06T06:14:00.032168+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:35:57.896695+00:00", "status_notes": "Vulnerability CVE-2020-36189 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4.", "vulnerability": { "name": "CVE-2020-36189" }, "action_statement": "Vulnerability CVE-2020-36189 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:42:49.067691+00:00", "status_notes": "Vulnerability CVE-2020-8840 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-8840" }, "action_statement": "Vulnerability CVE-2020-8840 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2020-9546 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9546" }, "action_statement": "Vulnerability CVE-2020-9546 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:43:34.152481+00:00", "status_notes": "Vulnerability CVE-2020-9547 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-9547" }, "action_statement": "Vulnerability CVE-2020-9547 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-10T11:12:00.038548+00:00", "status_notes": "Vulnerability CVE-2021-20190 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.6.", "vulnerability": { "name": "CVE-2021-20190" }, "action_statement": "Vulnerability CVE-2021-20190 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:10:00.217578+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-06T18:52:00.040792+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:10:00.217578+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2026-54512 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" }, "action_statement": "Vulnerability CVE-2026-54512 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-09T12:44:00.029979+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T02:05:58.493775+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.8.11.3 does not have the vulnerable code path. The CVE describes a vulnerability in `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()`, which does not exist in this version. Unwrapped creator properties were not yet implemented in 2.8.11.3 (documented by TestUnwrappedWithCreator265.java in the failing tests directory). The feature was added much later, and the CVE's...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Target version 2.8.11.3 does not have the vulnerable code path. The CVE describes a vulnerability in `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()`, which does not exist in this version. Unwrapped creator properties were not yet implemented in 2.8.11.3 (documented by TestUnwrappedWithCreator265.java in the failing tests directory). The feature was added much later, and the CVE's..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-03T01:42:00.098539+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-59888 is specific to Java Records and cannot affect jackson-databind 2.8.11.3. Java Records were introduced in Java 16 (2021), while this version targets Java 7 and was released in November 2018. The target contains no Record-related code (no RecordComponent, isRecordType, or Record accessor APIs). The CVE explicitly states \"For Java Records, POJOPropertiesCollector._removeUnwantedIgno...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 CVE-2026-59888 is specific to Java Records and cannot affect jackson-databind 2.8.11.3. Java Records were introduced in Java 16 (2021), while this version targets Java 7 and was released in November 2018. The target contains no Record-related code (no RecordComponent, isRecordType, or Record accessor APIs). The CVE explicitly states \"For Java Records, POJOPropertiesCollector._removeUnwantedIgno..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:10:00.217578+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:10:00.217578+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-05T09:35:57.896695+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.3-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:10:00.217578+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:10:00.217578+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.8.11.3-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3-tuxcare.2" } } ], "timestamp": "2026-11-01T09:08:33.532604+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.8.11.3-tuxcare.2.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }