{
  "@id": "urn:uuid:4fa0c3e7-3904-4c7b-8c29-3ea30e285708",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 44,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T10:48:00.438328+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind 2.8.11.4 (com.fasterxml.jackson.core:jackson-databind) \u2014 the exact product of the advisory (product-identity match; not false_positive). CVE-2017-15095 (issue #1737) extends CVE-2017-7525 by blacklisting more polymorphic-deserialization gadget classes. The fix lives in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES plus the Spring/c3p0 class-hierarchy checks in validateSubType(). All six #1737 gadget classes are blocked in the target: java.util.logging.FileHandler (line 46) and java.rmi.server.UnicastRemoteObject (line 47) by exact name; org.springframework.beans.factory.config.PropertyPathFactoryBean (line 50) by exact name; org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor via the Spring superclass walk matching \"AbstractPointcutAdvisor\" (lines 134-143); and com.mchange.v2.c3p0.JndiRefForwardingDataSource + WrapperConnectionPoolDataSource via the c3p0-prefix + endsWith(\"DataSource\") check (lines 144-153). validateSubType() is wired into the deserialization path (BeanDeserializerFactory._validateSubType at line 866, called from createBeanDeserializer at line 142), so listed types throw JsonMappingException instead of being instantiated. The defense was authored entirely upstream (Fix #1737 commit e865a7a4 by Andrew Tolbert @datastax.com, refined by #1855/#1931 by Tatu Saloranta @iki.fi); no TuxCare/CloudLinux author touched the file. Because the upstream fix is already baked into the shipped 2.8.11.4 version, the vulnerable pattern is not present in HEAD \u2192 not_affected (code_not_present). [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-23; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "not_affected \u2014 Target is jackson-databind 2.8.11.4 (com.fasterxml.jackson.core:jackson-databind) \u2014 the exact product of the advisory (product-identity match; not false_positive). CVE-2017-15095 (issue #1737) extends CVE-2017-7525 by blacklisting more polymorphic-deserialization gadget classes. The fix lives in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES plus the Spring/c3p0 class-hierarchy checks in validateSubType(). All six #1737 gadget classes are blocked in the target: java.util.logging.FileHandler (line 46) and java.rmi.server.UnicastRemoteObject (line 47) by exact name; org.springframework.beans.factory.config.PropertyPathFactoryBean (line 50) by exact name; org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor via the Spring superclass walk matching \"AbstractPointcutAdvisor\" (lines 134-143); and com.mchange.v2.c3p0.JndiRefForwardingDataSource + WrapperConnectionPoolDataSource via the c3p0-prefix + endsWith(\"DataSource\") check (lines 144-153). validateSubType() is wired into the deserialization path (BeanDeserializerFactory._validateSubType at line 866, called from createBeanDeserializer at line 142), so listed types throw JsonMappingException instead of being instantiated. The defense was authored entirely upstream (Fix #1737 commit e865a7a4 by Andrew Tolbert @datastax.com, refined by #1855/#1931 by Tatu Saloranta @iki.fi); no TuxCare/CloudLinux author touched the file. Because the upstream fix is already baked into the shipped 2.8.11.4 version, the vulnerable pattern is not present in HEAD \u2192 not_affected (code_not_present). [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-23; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is not present in jackson-databind 2.8.11.4. The upstream vendor (FasterXML) fixed this vulnerability in version 2.8.11 (Dec 2017) by adding blacklist entries for dangerous classes and creating the SubTypeValidator with pattern-based Spring class blocking. The target version 2.8.11.4 includes all these fixes. The vulnerable code patterns (incomplete blacklist allowing RCE via Spring/JDK/C3P0/Tomcat gadget classes) are not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 is not present in jackson-databind 2.8.11.4. The upstream vendor (FasterXML) fixed this vulnerability in version 2.8.11 (Dec 2017) by adding blacklist entries for dangerous classes and creating the SubTypeValidator with pattern-based Spring class blocking. The target version 2.8.11.4 includes all these fixes. The vulnerable code patterns (incomplete blacklist allowing RCE via Spring/JDK/C3P0/Tomcat gadget classes) are not present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:30:21.985032+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is not present in jackson-databind 2.8.11.4-tuxcare.2. The fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.8.11 before TuxCare onboarded version 2.8.11.4. The target contains comprehensive defense via SubTypeValidator class that blocks deserialization of dangerous classes (TemplatesImpl, InvokerTransformer, etc.) preventing arbitrary code execution through polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is not present in jackson-databind 2.8.11.4-tuxcare.2. The fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.8.11 before TuxCare onboarded version 2.8.11.4. The target contains comprehensive defense via SubTypeValidator class that blocks deserialization of dangerous classes (TemplatesImpl, InvokerTransformer, etc.) preventing arbitrary code execution through polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:21:55.137725+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.8.11.4-tuxcare.2 is not affected by CVE-2018-11307. The vulnerability involves unsafe deserialization of the iBatis XPathParser gadget class when Jackson default typing is enabled, allowing data exfiltration via XML external entity processing. The upstream vendor (FasterXML) fixed this in version 2.8.11.2 by adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist in SubTypeValidator. The target version 2.8.11.4 was onboarded by TuxCare with this upstream fix already present. The vulnerable code pattern (missing blacklist entry) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "The target jackson-databind 2.8.11.4-tuxcare.2 is not affected by CVE-2018-11307. The vulnerability involves unsafe deserialization of the iBatis XPathParser gadget class when Jackson default typing is enabled, allowing data exfiltration via XML external entity processing. The upstream vendor (FasterXML) fixed this in version 2.8.11.2 by adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist in SubTypeValidator. The target version 2.8.11.4 was onboarded by TuxCare with this upstream fix already present. The vulnerable code pattern (missing blacklist entry) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:21:23.053995+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.8.11.2. The target version is 2.8.11.4-tuxcare.3, which already contains the upstream fix. The vulnerability allowed arbitrary code execution via JNDI/LDAP injection when Default Typing was enabled and Jodd-db was in the classpath. The fix (commit 28badf7ef6) adds \"jodd.db.connection.DataSourceConnectionProvider\" and related Oracle JDBC classes to SubTypeValidator's deserialization blacklist. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.8.11.4 release, which TuxCare then onboarded via commit d24dfbd26b. The vulnerable pattern is not present in the target because the upstream vendor's fix was already included in the release version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.8.11.2. The target version is 2.8.11.4-tuxcare.3, which already contains the upstream fix. The vulnerability allowed arbitrary code execution via JNDI/LDAP injection when Default Typing was enabled and Jodd-db was in the classpath. The fix (commit 28badf7ef6) adds \"jodd.db.connection.DataSourceConnectionProvider\" and related Oracle JDBC classes to SubTypeValidator's deserialization blacklist. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.8.11.4 release, which TuxCare then onboarded via commit d24dfbd26b. The vulnerable pattern is not present in the target because the upstream vendor's fix was already included in the release version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:22:27.344203+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind prior to 2.8.11.2 when Default Typing is enabled, allowing remote code execution via Oracle JDBC gadget classes. The target (2.8.11.4-tuxcare.2) contains the upstream fix that blacklists oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.8.11.4 release that TuxCare onboarded. The vulnerable deserialization pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 affects jackson-databind prior to 2.8.11.2 when Default Typing is enabled, allowing remote code execution via Oracle JDBC gadget classes. The target (2.8.11.4-tuxcare.2) contains the upstream fix that blacklists oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.8.11.4 release that TuxCare onboarded. The vulnerable deserialization pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:58:58.947122+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.8.11.4-tuxcare.2 is not affected by CVE-2018-14718. The upstream vendor fix that blocks org.slf4j.ext.EventData and three other dangerous classes from polymorphic deserialization was already present in upstream version 2.8.11.4 when TuxCare onboarded it. The fix commit (87d29af25e) by Tatu Saloranta was authored on Aug 16, 2018, and is an ancestor of the TuxCare onboarding commit (d24dfbd26b) from Sep 20, 2026. The vulnerable code pattern has never been present in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "The target jackson-databind version 2.8.11.4-tuxcare.2 is not affected by CVE-2018-14718. The upstream vendor fix that blocks org.slf4j.ext.EventData and three other dangerous classes from polymorphic deserialization was already present in upstream version 2.8.11.4 when TuxCare onboarded it. The fix commit (87d29af25e) by Tatu Saloranta was authored on Aug 16, 2018, and is an ancestor of the TuxCare onboarding commit (d24dfbd26b) from Sep 20, 2026. The vulnerable code pattern has never been present in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:02:25.196465+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is NOT present in jackson-databind 2.8.11.4. The vulnerability concerns polymorphic deserialization of BlazeDS classes (blaze-ds-opt/blaze-ds-core) that could lead to arbitrary code execution. The upstream fix (blocklist entries for flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes) was already present in version 2.8.11.4 when TuxCare onboarded it. The fix is located in SubTypeValidator.java lines 73-77, added by upstream commit 0899726 authored by tatu.saloranta@iki.fi.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 is NOT present in jackson-databind 2.8.11.4. The vulnerability concerns polymorphic deserialization of BlazeDS classes (blaze-ds-opt/blaze-ds-core) that could lead to arbitrary code execution. The upstream fix (blocklist entries for flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes) was already present in version 2.8.11.4 when TuxCare onboarded it. The fix is located in SubTypeValidator.java lines 73-77, added by upstream commit 0899726 authored by tatu.saloranta@iki.fi.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:09:29.528523+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.8.11.4-tuxcare.2 is NOT AFFECTED by CVE-2018-14720. The vulnerability concerns polymorphic deserialization of four dangerous classes that can enable XXE/RCE attacks. The fix (adding these classes to a deserialization blacklist) was already present in the upstream release 2.8.11.4 before TuxCare onboarding, as confirmed by commit 87d29af25e82a249ea15858e2d4ecbf64091db44 authored by upstream maintainer Tatu Saloranta. The blacklist is active by default in SubTypeValidator.java lines 74-77 and enforced via BeanDeserializerFactory._validateSubType at line 142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "The target repository jackson-databind 2.8.11.4-tuxcare.2 is NOT AFFECTED by CVE-2018-14720. The vulnerability concerns polymorphic deserialization of four dangerous classes that can enable XXE/RCE attacks. The fix (adding these classes to a deserialization blacklist) was already present in the upstream release 2.8.11.4 before TuxCare onboarding, as confirmed by commit 87d29af25e82a249ea15858e2d4ecbf64091db44 authored by upstream maintainer Tatu Saloranta. The blacklist is active by default in SubTypeValidator.java lines 74-77 and enforced via BeanDeserializerFactory._validateSubType at line 142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:40:31.077655+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is not present in jackson-databind 2.8.11.4. The upstream fix (commit 87d29af25e) that blocks org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization was already included in the upstream release 2.8.11.4 when TuxCare onboarded it. The blocklist entry exists in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES (line 77) and is enforced via BeanDeserializerFactory._validateSubType() during bean deserialization (line 142). The blocking mechanism was refactored between version 2.6.x (where it lived in BeanDeserializerFactory) and 2.8.x (moved to SubTypeValidator class), but the axis2 protection remains active and effective.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is not present in jackson-databind 2.8.11.4. The upstream fix (commit 87d29af25e) that blocks org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization was already included in the upstream release 2.8.11.4 when TuxCare onboarded it. The blocklist entry exists in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES (line 77) and is enforced via BeanDeserializerFactory._validateSubType() during bean deserialization (line 142). The blocking mechanism was refactored between version 2.6.x (where it lived in BeanDeserializerFactory) and 2.8.x (moved to SubTypeValidator class), but the axis2 protection remains active and effective.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:53:41.382779+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is NOT present in jackson-databind 2.8.11.4-tuxcare.2. The upstream vendor (FasterXML) fixed this vulnerability in commit 72cd4025a by adding four dangerous classes (including org.apache.axis2.transport.jms.JMSOutTransportInfo) to the SubTypeValidator blocklist. This fix was already included in the upstream release 2.8.11.4 that TuxCare onboarded, predating all TuxCare commits. The vulnerable pattern (unrestricted polymorphic deserialization of axis2-transport-jms and related classes) does not exist in the target because the upstream fix removed it before TuxCare's maintenance began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 is NOT present in jackson-databind 2.8.11.4-tuxcare.2. The upstream vendor (FasterXML) fixed this vulnerability in commit 72cd4025a by adding four dangerous classes (including org.apache.axis2.transport.jms.JMSOutTransportInfo) to the SubTypeValidator blocklist. This fix was already included in the upstream release 2.8.11.4 that TuxCare onboarded, predating all TuxCare commits. The vulnerable pattern (unrestricted polymorphic deserialization of axis2-transport-jms and related classes) does not exist in the target because the upstream fix removed it before TuxCare's maintenance began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:59:33.966848+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is not present in jackson-databind 2.8.11.4-tuxcare.3. The vulnerability concerns polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime). These classes are already blocked in SubTypeValidator.java lines 81-82 via upstream commit 72cd4025a2 which shipped in the upstream release 2.8.11.4 before TuxCare onboarded the version. The blocklist is actively enforced during bean deserialization through BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 is not present in jackson-databind 2.8.11.4-tuxcare.3. The vulnerability concerns polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime). These classes are already blocked in SubTypeValidator.java lines 81-82 via upstream commit 72cd4025a2 which shipped in the upstream release 2.8.11.4 before TuxCare onboarded the version. The blocklist is actively enforced during bean deserialization through BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:26:39.614024+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.8.11.4-tuxcare.2 is NOT AFFECTED by CVE-2018-19362. The vulnerability concerns the failure to block jboss-common-core class (specifically org.jboss.util.propertyeditor.DocumentEditor) from polymorphic deserialization. The fix that adds this class and three others to the deserialization blacklist in SubTypeValidator.java is already present in the target (lines 79-83). This fix was authored by the upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.8.11.4 release, which TuxCare later onboarded. The fix commit (72cd4025a2) is an ancestor of the TuxCare onboarding commit (d24dfbd2), confirming it was part of the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "The target repository jackson-databind version 2.8.11.4-tuxcare.2 is NOT AFFECTED by CVE-2018-19362. The vulnerability concerns the failure to block jboss-common-core class (specifically org.jboss.util.propertyeditor.DocumentEditor) from polymorphic deserialization. The fix that adds this class and three others to the deserialization blacklist in SubTypeValidator.java is already present in the target (lines 79-83). This fix was authored by the upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.8.11.4 release, which TuxCare later onboarded. The fix commit (72cd4025a2) is an ancestor of the TuxCare onboarding commit (d24dfbd2), confirming it was part of the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind 2.8.11.4 (TuxCare ELS). CVE-2018-5968 (databind#1899) is an incomplete-blacklist deserialization RCE: two gadget classes \u2014 org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory \u2014 bypassed the default-typing deny-list. The vendor fix adds both to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. In the target, both entries are already present (lines 58-59 and again 70-71), and the deny-list is live: validateSubType is invoked on the deserialization path via BeanDeserializerFactory._validateSubType (line 866). git blame shows the entries were authored by upstream FasterXML (038b471e2e by Tatu Saloranta 2018-01-21; 454be8bb8c by MaximilianTews 2018-06-26) \u2014 the exact patch commits given as input \u2014 not by TuxCare. Version 2.8.11.4 (> vulnerable 2.8.11) shipped with the upstream fix already baked in; no vulnerable pattern exists in HEAD. Verdict: not_affected (upstream/vendor-fix sub-case), justification code_not_present. Attribution: no TuxCare signal (fix author domain iki.fi; fix entered via wholesale onboard/2.8.11.4 version-import, not a targeted backport MR), so fixing_commit_author is the upstream fix-commit author. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "not_affected \u2014 Target is jackson-databind 2.8.11.4 (TuxCare ELS). CVE-2018-5968 (databind#1899) is an incomplete-blacklist deserialization RCE: two gadget classes \u2014 org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory \u2014 bypassed the default-typing deny-list. The vendor fix adds both to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. In the target, both entries are already present (lines 58-59 and again 70-71), and the deny-list is live: validateSubType is invoked on the deserialization path via BeanDeserializerFactory._validateSubType (line 866). git blame shows the entries were authored by upstream FasterXML (038b471e2e by Tatu Saloranta 2018-01-21; 454be8bb8c by MaximilianTews 2018-06-26) \u2014 the exact patch commits given as input \u2014 not by TuxCare. Version 2.8.11.4 (> vulnerable 2.8.11) shipped with the upstream fix already baked in; no vulnerable pattern exists in HEAD. Verdict: not_affected (upstream/vendor-fix sub-case), justification code_not_present. Attribution: no TuxCare signal (fix author domain iki.fi; fix entered via wholesale onboard/2.8.11.4 version-import, not a targeted backport MR), so fixing_commit_author is the upstream fix-commit author. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:56:41.543674+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.8.11.4-tuxcare.2. The target contains the upstream vendor's fix (commit 6799f8f10c by Tatu Saloranta) that blocks deserialization of c3p0 DataSource gadget classes. The fix adds pattern-based validation in SubTypeValidator.validateSubType() (lines 184-194) that rejects any class name starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\", preventing RCE exploitation. This fix was included in upstream version 2.8.11.4 before TuxCare onboarded the release, making it an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.8.11.4-tuxcare.2. The target contains the upstream vendor's fix (commit 6799f8f10c by Tatu Saloranta) that blocks deserialization of c3p0 DataSource gadget classes. The fix adds pattern-based validation in SubTypeValidator.validateSubType() (lines 184-194) that rejects any class name starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\", preventing RCE exploitation. This fix was included in upstream version 2.8.11.4 before TuxCare onboarded the release, making it an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:36:34.248507+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target is NOT affected by CVE-2019-12086. The fix (blocking \"com.mysql.cj.jdbc.admin.MiniAdmin\" from polymorphic deserialization) is already present in SubTypeValidator.java:86. This fix was authored by upstream Jackson maintainer Tatu Saloranta and shipped in the upstream 2.8.11.4 release, which TuxCare subsequently onboarded. The vulnerable pattern (missing MiniAdmin validation) does not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "The target is NOT affected by CVE-2019-12086. The fix (blocking \"com.mysql.cj.jdbc.admin.MiniAdmin\" from polymorphic deserialization) is already present in SubTypeValidator.java:86. This fix was authored by upstream Jackson maintainer Tatu Saloranta and shipped in the upstream 2.8.11.4 release, which TuxCare subsequently onboarded. The vulnerable pattern (missing MiniAdmin validation) does not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T18:43:00.179270+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target version 2.8.11.4-tuxcare.2 is NOT vulnerable to CVE-2019-12384. The upstream vendor (FasterXML) backported the fix to version 2.8.11.4, which blocks deserialization of ch.qos.logback.core.db.DriverManagerConnectionSource through a blocklist mechanism. This fix was already present when TuxCare onboarded the upstream release, making it an upstream-authored fix rather than a TuxCare bac...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 The target version 2.8.11.4-tuxcare.2 is NOT vulnerable to CVE-2019-12384. The upstream vendor (FasterXML) backported the fix to version 2.8.11.4, which blocks deserialization of ch.qos.logback.core.db.DriverManagerConnectionSource through a blocklist mechanism. This fix was already present when TuxCare onboarded the upstream release, making it an upstream-authored fix rather than a TuxCare bac..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T07:23:00.071710+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository jackson-databind 2.8.11.4-tuxcare.2 is NOT affected by CVE-2019-12814. The upstream vendor fix (commit 5f7c69bba07a7155adde130d9dee2e54a54f1fa5 by Tatu Saloranta) was already present in the 2.8.11.4 release before TuxCare onboarding. The fix adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.ja...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 The target repository jackson-databind 2.8.11.4-tuxcare.2 is NOT affected by CVE-2019-12814. The upstream vendor fix (commit 5f7c69bba07a7155adde130d9dee2e54a54f1fa5 by Tatu Saloranta) was already present in the 2.8.11.4 release before TuxCare onboarding. The fix adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.ja..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:15:19.421943+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in the target. The vulnerability was fixed in upstream jackson-databind version 2.8.11.4 (released July 2019) by adding blocklist entries for dangerous classes that enable remote code execution via polymorphic deserialization. The target repository is at version 2.8.11.4-tuxcare.1, which includes the upstream fix. The fix commit (ad418eeb) was authored by upstream maintainer Tatu Saloranta and is tagged in jackson-databind-2.8.11.4. The blocklist entries are present at SubTypeValidator.java:96,99, blocking deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource. This fix was part of the upstream release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT present in the target. The vulnerability was fixed in upstream jackson-databind version 2.8.11.4 (released July 2019) by adding blocklist entries for dangerous classes that enable remote code execution via polymorphic deserialization. The target repository is at version 2.8.11.4-tuxcare.1, which includes the upstream fix. The fix commit (ad418eeb) was authored by upstream maintainer Tatu Saloranta and is tagged in jackson-databind-2.8.11.4. The blocklist entries are present at SubTypeValidator.java:96,99, blocking deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource. This fix was part of the upstream release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:59.528750+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in the target. The vulnerability involves unsafe deserialization of ch.qos.logback.core.db.JNDIConnectionSource when Jackson's Default Typing is enabled, allowing remote code execution via JNDI attacks. The fix (adding JNDIConnectionSource to the SubTypeValidator blacklist) is present in the target at lines 98-99 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta in commit ad418eeb97 and shipped in upstream release 2.8.11.4, which TuxCare subsequently onboarded. The target version 2.8.11.4-tuxcare.2 is based on this already-fixed upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is NOT present in the target. The vulnerability involves unsafe deserialization of ch.qos.logback.core.db.JNDIConnectionSource when Jackson's Default Typing is enabled, allowing remote code execution via JNDI attacks. The fix (adding JNDIConnectionSource to the SubTypeValidator blacklist) is present in the target at lines 98-99 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta in commit ad418eeb97 and shipped in upstream release 2.8.11.4, which TuxCare subsequently onboarded. The target version 2.8.11.4-tuxcare.2 is based on this already-fixed upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:44:39.411138+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "action_statement": "Vulnerability CVE-2019-14540 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "action_statement": "Vulnerability CVE-2019-14892 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "action_statement": "Vulnerability CVE-2019-14893 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "action_statement": "Vulnerability CVE-2019-16335 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:20:04.884214+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "action_statement": "Vulnerability CVE-2019-16942 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "action_statement": "Vulnerability CVE-2019-16943 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:21:00.026446+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "action_statement": "Vulnerability CVE-2019-17267 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "action_statement": "Vulnerability CVE-2019-17531 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:16:00.033636+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "action_statement": "Vulnerability CVE-2019-20330 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:10:53.626785+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "action_statement": "Vulnerability CVE-2020-10650 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T10:48:00.438328+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "action_statement": "Vulnerability CVE-2020-10672 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:10:31.241919+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "action_statement": "Vulnerability CVE-2020-10673 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "action_statement": "Vulnerability CVE-2020-10968 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:10:31.241919+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "action_statement": "Vulnerability CVE-2020-10969 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:11:00.101263+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "action_statement": "Vulnerability CVE-2020-11111 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:12:00.090826+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "action_statement": "Vulnerability CVE-2020-11112 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:13:00.049452+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "action_statement": "Vulnerability CVE-2020-11113 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:10:53.626785+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "action_statement": "Vulnerability CVE-2020-11619 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T10:48:00.438328+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "action_statement": "Vulnerability CVE-2020-11620 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:44:39.411138+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "action_statement": "Vulnerability CVE-2020-14060 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:25:00.119457+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "action_statement": "Vulnerability CVE-2020-14061 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:24:00.161824+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "action_statement": "Vulnerability CVE-2020-14062 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:13:00.049452+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "action_statement": "Vulnerability CVE-2020-14195 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:24:00.161824+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "action_statement": "Vulnerability CVE-2020-24616 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:25:00.119457+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "action_statement": "Vulnerability CVE-2020-24750 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-25649"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "action_statement": "Vulnerability CVE-2020-35490 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:24:00.161824+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "action_statement": "Vulnerability CVE-2020-35491 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:24:00.161824+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "action_statement": "Vulnerability CVE-2020-35728 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "action_statement": "Vulnerability CVE-2020-36179 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "action_statement": "Vulnerability CVE-2020-36180 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T06:14:00.032168+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "action_statement": "Vulnerability CVE-2020-36181 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:44:39.411138+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "action_statement": "Vulnerability CVE-2020-36182 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:44:39.411138+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "action_statement": "Vulnerability CVE-2020-36183 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36184"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "action_statement": "Vulnerability CVE-2020-36185 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "action_statement": "Vulnerability CVE-2020-36186 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:44:39.411138+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "action_statement": "Vulnerability CVE-2020-36187 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T06:14:00.032168+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "action_statement": "Vulnerability CVE-2020-36188 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T12:23:15.570282+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "action_statement": "Vulnerability CVE-2020-36189 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "action_statement": "Vulnerability CVE-2020-36518 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:20:04.884214+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "action_statement": "Vulnerability CVE-2020-8840 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:24:00.161824+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "action_statement": "Vulnerability CVE-2020-9546 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T08:17:00.158151+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "action_statement": "Vulnerability CVE-2020-9547 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "action_statement": "Vulnerability CVE-2020-9548 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T10:48:00.438328+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "action_statement": "Vulnerability CVE-2021-20190 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:13:36.432303+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "action_statement": "Vulnerability CVE-2021-46877 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:24:00.161824+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "action_statement": "Vulnerability CVE-2022-42003 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:52:00.040792+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:25:00.119457+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "action_statement": "Vulnerability CVE-2026-50193 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "action_statement": "Vulnerability CVE-2026-54512 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:12:47.728703+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      },
      "action_statement": "Vulnerability CVE-2026-54513 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:21:00.026446+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:09:55.785498+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.8.11.4 is not affected by CVE-2026-54518. While the vulnerable code pattern (missing view check in deserializeUsingPropertyBasedWithUnwrapped for creator properties) exists in the codebase, the feature it depends on\u2014unwrapped creator parameters (constructor parameters annotated with both @JsonUnwrapped and @JsonView)\u2014is not implemented in this version. The feature implementation commi...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.8.11.4 is not affected by CVE-2026-54518. While the vulnerable code pattern (missing view check in deserializeUsingPropertyBasedWithUnwrapped for creator properties) exists in the codebase, the feature it depends on\u2014unwrapped creator parameters (constructor parameters annotated with both @JsonUnwrapped and @JsonView)\u2014is not implemented in this version. The feature implementation commi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:43:00.214744+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-59888 specifically affects Java Records with @JsonIgnore and PropertyNamingStrategy. The target version 2.8.11.4-tuxcare.3 predates Java Records support (added in jackson-databind 2.12.0, August 2020) by approximately 3 years. The version targets Java 7 and contains zero Record-specific code. For regular POJOs (all that 2.8.x supports), ignored properties are completely removed before ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-59888 specifically affects Java Records with @JsonIgnore and PropertyNamingStrategy. The target version 2.8.11.4-tuxcare.3 predates Java Records support (added in jackson-databind 2.12.0, August 2020) by approximately 3 years. The version targets Java 7 and contains zero Record-specific code. For regular POJOs (all that 2.8.x supports), ignored properties are completely removed before ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:44:39.411138+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:25:00.119457+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:44:39.411138+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:25:00.119457+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:25:00.119457+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.8.11.4-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:59:00.141399+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.8.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.8.11.4-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}