{ "@id": "urn:uuid:2cd498b6-31e5-4086-a8e9-4c0838bf9657", "role": "Document Creator", "author": "https://tuxcare.com", "version": 4, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-09T13:53:00.116712+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.4 is not affected by CVE-2017-15095. The CVE affects versions prior to 2.8.11 and 2.9.4. The fix (blacklisting additional dangerous classes for polymorphic deserialization) was already present in the upstream 2.9.10.4 release that TuxCare onboarded. All required class blacklist entries from issues #1737 and #1680 are present in SubTypeValidator.java and actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "Target version 2.9.10.4 is not affected by CVE-2017-15095. The CVE affects versions prior to 2.8.11 and 2.9.4. The fix (blacklisting additional dangerous classes for polymorphic deserialization) was already present in the upstream 2.9.10.4 release that TuxCare onboarded. All required class blacklist entries from issues #1737 and #1680 are present in SubTypeValidator.java and actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.9.10.4-tuxcare.3 is not affected by CVE-2017-17485. The vulnerability required expanded blacklist entries for deserialization gadgets (Spring framework types like AbstractPointcutAdvisor/AbstractApplicationContext, JDK types like FileHandler/UnicastRemoteObject, and 3rd-party types). The upstream fix (commits e865a7a446 and 2235894210) introduced SubTypeValidator class with comprehensive blacklist and pattern-matching logic, which was already present in jackson-databind 2.9.10.4 before TuxCare onboarding (commit 5178627882). The fix is correctly integrated: BeanDeserializerFactory.createBeanDeserializer calls _validateSubType (line 135) which delegates to SubTypeValidator.validateSubType, blocking all CVE-2017-17485 gadgets before deserializer instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "Target jackson-databind 2.9.10.4-tuxcare.3 is not affected by CVE-2017-17485. The vulnerability required expanded blacklist entries for deserialization gadgets (Spring framework types like AbstractPointcutAdvisor/AbstractApplicationContext, JDK types like FileHandler/UnicastRemoteObject, and 3rd-party types). The upstream fix (commits e865a7a446 and 2235894210) introduced SubTypeValidator class with comprehensive blacklist and pattern-matching logic, which was already present in jackson-databind 2.9.10.4 before TuxCare onboarding (commit 5178627882). The fix is correctly integrated: BeanDeserializerFactory.createBeanDeserializer calls _validateSubType (line 135) which delegates to SubTypeValidator.validateSubType, blocking all CVE-2017-17485 gadgets before deserializer instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is not present in jackson-databind 2.9.10.4. The vulnerability allows arbitrary code execution via malicious JSON with polymorphic type information that specifies dangerous gadget classes. The upstream fix (issue #1599) implemented a blacklist-based defense in SubTypeValidator that rejects deserialization of known dangerous classes. This fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream 2.9.10.4 release that TuxCare onboarded. The target repository contains the complete fix: SubTypeValidator with the DEFAULT_NO_DESER_CLASS_NAMES blacklist including all CVE-2017-7525 gadget classes (TemplatesImpl, InvokerTransformer, InstantiateTransformer, MethodClosure, ConvertedClosure, ObjectFactory), and BeanDeserializerFactory calls the validation before creating any bean deserializer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 is not present in jackson-databind 2.9.10.4. The vulnerability allows arbitrary code execution via malicious JSON with polymorphic type information that specifies dangerous gadget classes. The upstream fix (issue #1599) implemented a blacklist-based defense in SubTypeValidator that rejects deserialization of known dangerous classes. This fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream 2.9.10.4 release that TuxCare onboarded. The target repository contains the complete fix: SubTypeValidator with the DEFAULT_NO_DESER_CLASS_NAMES blacklist including all CVE-2017-7525 gadget classes (TemplatesImpl, InvokerTransformer, InstantiateTransformer, MethodClosure, ConvertedClosure, ObjectFactory), and BeanDeserializerFactory calls the validation before creating any bean deserializer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.9.10.4. The upstream fix that blacklists org.apache.ibatis.parsing.XPathParser was already included in version 2.9.6 and is present in this version (2.9.10.4). The fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.9.10.4. The upstream fix that blacklists org.apache.ibatis.parsing.XPathParser was already included in version 2.9.6 and is present in this version (2.9.10.4). The fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is NOT present in jackson-databind 2.9.10.4. The fix was already included in the upstream 2.9.10.4 release that TuxCare onboarded. The SubTypeValidator.java blacklist contains \"jodd.db.connection.DataSourceConnectionProvider\" (line 68), preventing deserialization of this gadget class when Default Typing is enabled. This upstream fix by Tatu Saloranta (commit 28badf7ef6) predates TuxCare's onboarding commit (5178627882).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 is NOT present in jackson-databind 2.9.10.4. The fix was already included in the upstream 2.9.10.4 release that TuxCare onboarded. The SubTypeValidator.java blacklist contains \"jodd.db.connection.DataSourceConnectionProvider\" (line 68), preventing deserialization of this gadget class when Default Typing is enabled. This upstream fix by Tatu Saloranta (commit 28badf7ef6) predates TuxCare's onboarding commit (5178627882).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in the target. The upstream vendor (FasterXML) fixed this deserialization vulnerability in version 2.9.10.4 by blacklisting Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. The target version 2.9.10.4-tuxcare.3 was onboarded from upstream with the fix already present in commit 28badf7ef6 (authored by Tatu Saloranta on Jun 7, 2018), which predates the first TuxCare commit (5178627882). The vulnerable pattern does not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 is NOT present in the target. The upstream vendor (FasterXML) fixed this deserialization vulnerability in version 2.9.10.4 by blacklisting Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. The target version 2.9.10.4-tuxcare.3 was onboarded from upstream with the fix already present in commit 28badf7ef6 (authored by Tatu Saloranta on Jun 7, 2018), which predates the first TuxCare commit (5178627882). The vulnerable pattern does not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10.4-tuxcare.3 is not affected by CVE-2018-14718. The upstream fix blocking org.slf4j.ext.EventData from polymorphic deserialization was already present in the upstream 2.9.10.4 release that TuxCare onboarded. The blocklist in SubTypeValidator.java (lines 75-78) includes all four dangerous classes from the security patch, and the validation is actively enforced via _validateSubType() during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "The target jackson-databind 2.9.10.4-tuxcare.3 is not affected by CVE-2018-14718. The upstream fix blocking org.slf4j.ext.EventData from polymorphic deserialization was already present in the upstream 2.9.10.4 release that TuxCare onboarded. The blocklist in SubTypeValidator.java (lines 75-78) includes all four dangerous classes from the security patch, and the validation is actively enforced via _validateSubType() during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10.4 is NOT vulnerable to CVE-2018-14719. The fix that adds flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor (blaze-ds class) and other dangerous classes to the deserialization blacklist was already present in the upstream 2.9.10.4 release. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "The target jackson-databind 2.9.10.4 is NOT vulnerable to CVE-2018-14719. The fix that adds flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor (blaze-ds class) and other dangerous classes to the deserialization blacklist was already present in the upstream 2.9.10.4 release. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is an XXE vulnerability affecting jackson-databind versions before 2.9.7, exploitable via polymorphic deserialization of four specific JDK and third-party classes. The target repository (jackson-databind 2.9.10.4-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.9.10.4 before TuxCare onboarding. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocked in SubTypeValidator.java lines 74-78. Fix commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by upstream author Tatu Saloranta was included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 is an XXE vulnerability affecting jackson-databind versions before 2.9.7, exploitable via polymorphic deserialization of four specific JDK and third-party classes. The target repository (jackson-databind 2.9.10.4-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.9.10.4 before TuxCare onboarding. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocked in SubTypeValidator.java lines 74-78. Fix commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by upstream author Tatu Saloranta was included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.9.10.4-tuxcare.3. The target contains the upstream fix that blocks deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl, preventing the SSRF vulnerability. The fix was shipped in the upstream version 2.9.10.4 before TuxCare onboarded it (commit 87d29af25e by upstream maintainer Tatu Saloranta).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.9.10.4-tuxcare.3. The target contains the upstream fix that blocks deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl, preventing the SSRF vulnerability. The fix was shipped in the upstream version 2.9.10.4 before TuxCare onboarded it (commit 87d29af25e by upstream maintainer Tatu Saloranta).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 by allowing polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo. The target version 2.9.10.4 is NOT vulnerable - the upstream fix (commit 72cd4025a2, issue #2186) that adds this class to the deserialization blocklist was included in the upstream release 2.9.10.4 before TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:85, and the validation is enforced on the critical path at BeanDeserializerFactory.java:135 before any bean deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 by allowing polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo. The target version 2.9.10.4 is NOT vulnerable - the upstream fix (commit 72cd4025a2, issue #2186) that adds this class to the deserialization blocklist was included in the upstream release 2.9.10.4 before TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:85, and the validation is enforced on the critical path at BeanDeserializerFactory.java:135 before any bean deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is NOT present in jackson-databind 2.9.10.4-tuxcare.3. The upstream fix (commit 72cd4025a2) that adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the polymorphic deserialization blocklist was already included in the upstream release 2.9.10.4 when TuxCare onboarded it. The vulnerable pattern is not present because the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "CVE-2018-19361 is NOT present in jackson-databind 2.9.10.4-tuxcare.3. The upstream fix (commit 72cd4025a2) that adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the polymorphic deserialization blocklist was already included in the upstream release 2.9.10.4 when TuxCare onboarded it. The vulnerable pattern is not present because the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.9.10.4-tuxcare.3. The vulnerability involved failure to block org.jboss.util.propertyeditor.DocumentEditor (and three other classes) from polymorphic deserialization. The fix was authored by upstream maintainer Tatu Saloranta in commit 72cd4025a2 (November 2018), shipped in jackson-databind 2.9.8, and was already present when TuxCare onboarded version 2.9.10.4. The blocklist entries are present at SubTypeValidator.java lines 81-85 and actively enforced via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.9.10.4-tuxcare.3. The vulnerability involved failure to block org.jboss.util.propertyeditor.DocumentEditor (and three other classes) from polymorphic deserialization. The fix was authored by upstream maintainer Tatu Saloranta in commit 72cd4025a2 (November 2018), shipped in jackson-databind 2.9.8, and was already present when TuxCare onboarded version 2.9.10.4. The blocklist entries are present at SubTypeValidator.java lines 81-85 and actively enforced via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3. The target version 2.9.10.4 (released April 2020) is not vulnerable because the upstream fix (issue #1899) was already included in the release. The two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) are present in the deserialization blacklist at SubTypeValidator.java lines 62-63. This fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) in commit 038b471e2e dated January 2018, well before the 2.9.10.4 release and before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3. The target version 2.9.10.4 (released April 2020) is not vulnerable because the upstream fix (issue #1899) was already included in the release. The two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) are present in the deserialization blacklist at SubTypeValidator.java lines 62-63. This fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) in commit 038b471e2e dated January 2018, well before the 2.9.10.4 release and before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 affects jackson-databind 2.9.x before 2.9.5. The target version 2.9.10.4-tuxcare.3 is well after the fix release. The upstream fix (commit 6799f8f10c by Tatu Saloranta) added pattern-based validation to block deserialization of c3p0 DataSource classes (any class starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\"). This fix is present in the target repository, having been shipped in upstream release 2.9.10.4 and onboarded by TuxCare. The defense is active in SubTypeValidator.validateSubType() at lines 288-298, which is invoked during bean deserialization. The vulnerable pattern (missing c3p0 DataSource validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 affects jackson-databind 2.9.x before 2.9.5. The target version 2.9.10.4-tuxcare.3 is well after the fix release. The upstream fix (commit 6799f8f10c by Tatu Saloranta) added pattern-based validation to block deserialization of c3p0 DataSource classes (any class starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\"). This fix is present in the target repository, having been shipped in upstream release 2.9.10.4 and onboarded by TuxCare. The defense is active in SubTypeValidator.validateSubType() at lines 288-298, which is invoked during bean deserialization. The vulnerable pattern (missing c3p0 DataSource validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind versions before 2.9.9 when polymorphic typing is enabled and the mysql-connector-java jar is in the classpath. The vulnerability allows arbitrary file read via deserialization of com.mysql.cj.jdbc.admin.MiniAdmin. The target version 2.9.10.4 contains the upstream fix that blocks this class in SubTypeValidator. The fix was authored by upstream maintainer Tatu Saloranta in commit dda513bd72 and shipped in jackson-databind 2.9.9, which predates the 2.9.10.4 release that TuxCare onboarded. The vulnerable pattern (missing MiniAdmin blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 affects jackson-databind versions before 2.9.9 when polymorphic typing is enabled and the mysql-connector-java jar is in the classpath. The vulnerability allows arbitrary file read via deserialization of com.mysql.cj.jdbc.admin.MiniAdmin. The target version 2.9.10.4 contains the upstream fix that blocks this class in SubTypeValidator. The fix was authored by upstream maintainer Tatu Saloranta in commit dda513bd72 and shipped in jackson-databind 2.9.9, which predates the 2.9.10.4 release that TuxCare onboarded. The vulnerable pattern (missing MiniAdmin blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.9.10.4-tuxcare.3. The vulnerability involves polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to remote code execution. The fix (adding this class to the deserialization blacklist) was included in upstream version 2.9.9.1 and is present in the target version 2.9.10.4. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.9.10.4-tuxcare.3. The vulnerability involves polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to remote code execution. The fix (adding this class to the deserialization blacklist) was included in upstream version 2.9.9.1 and is present in the target version 2.9.10.4. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is not present in jackson-databind 2.9.10.4. The vulnerability involved polymorphic deserialization of JDOM XSLTransformer classes to read arbitrary files. The fix, which blacklists org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer in SubTypeValidator.java, was already present in the upstream 2.9.10.4 release that TuxCare onboarded. The blacklist is enforce...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 CVE-2019-12814 is not present in jackson-databind 2.9.10.4. The vulnerability involved polymorphic deserialization of JDOM XSLTransformer classes to read arbitrary files. The fix, which blacklists org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer in SubTypeValidator.java, was already present in the upstream 2.9.10.4 release that TuxCare onboarded. The blacklist is enforce..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.9.10.4. The upstream vendor (FasterXML) fixed this vulnerability in commit ad418eeb97 (dated 2019-07-25) by adding \"net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup\" and \"ch.qos.logback.core.db.JNDIConnectionSource\" to the SubTypeValidator blocklist. This fix was already included in the upstream 2.9.10.4 release when TuxCare onboarded it (commit 51786278). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.9.10.4. The upstream vendor (FasterXML) fixed this vulnerability in commit ad418eeb97 (dated 2019-07-25) by adding \"net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup\" and \"ch.qos.logback.core.db.JNDIConnectionSource\" to the SubTypeValidator blocklist. This fix was already included in the upstream 2.9.10.4 release when TuxCare onboarded it (commit 51786278). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is not a vulnerability in the target jackson-databind 2.9.10.4-tuxcare.3. The fix was already present in upstream release 2.9.10.4 before TuxCare onboarded it. The patch adds two classes to SubTypeValidator's blocklist to prevent polymorphic deserialization attacks: ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup. Both entries are present in the target at lines 102 and 98 respectively. The fix commit (ad418eeb974e357f2797aef64aa0e3ffaaa6125b) was authored by upstream maintainer Tatu Saloranta on 2019-07-25 and is an ancestor of TuxCare's onboarding commit from 2026-09-10.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "CVE-2019-14439 is not a vulnerability in the target jackson-databind 2.9.10.4-tuxcare.3. The fix was already present in upstream release 2.9.10.4 before TuxCare onboarded it. The patch adds two classes to SubTypeValidator's blocklist to prevent polymorphic deserialization attacks: ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup. Both entries are present in the target at lines 102 and 98 respectively. The fix commit (ad418eeb974e357f2797aef64aa0e3ffaaa6125b) was authored by upstream maintainer Tatu Saloranta on 2019-07-25 and is an ancestor of TuxCare's onboarding commit from 2026-09-10.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 fixed upstream before 2.9.10.4: CVE-2019-14540 fix bbdbc40029b1 by tatu.saloranta@iki.fi (2019-10-15) is an ancestor of tuxcare-current/2.9.10.4 (inside upstream tag jackson-databind-2.9.10.4); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "not_affected \u2014 fixed upstream before 2.9.10.4: CVE-2019-14540 fix bbdbc40029b1 by tatu.saloranta@iki.fi (2019-10-15) is an ancestor of tuxcare-current/2.9.10.4 (inside upstream tag jackson-databind-2.9.10.4); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 fixed upstream before 2.9.10.4: CVE-2019-14892 fix 41b7f9b90149 by tatu.saloranta@iki.fi (2019-09-19) is an ancestor of tuxcare-current/2.9.10.4 (inside upstream tag jackson-databind-2.9.10.4); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "not_affected \u2014 fixed upstream before 2.9.10.4: CVE-2019-14892 fix 41b7f9b90149 by tatu.saloranta@iki.fi (2019-09-19) is an ancestor of tuxcare-current/2.9.10.4 (inside upstream tag jackson-databind-2.9.10.4); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 fixed upstream before 2.9.10.4: CVE-2019-14893 fix 998efd708284 by tatu.saloranta@iki.fi (2019-09-19) is an ancestor of tuxcare-current/2.9.10.4 (inside upstream tag jackson-databind-2.9.10.4); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "not_affected \u2014 fixed upstream before 2.9.10.4: CVE-2019-14893 fix 998efd708284 by tatu.saloranta@iki.fi (2019-09-19) is an ancestor of tuxcare-current/2.9.10.4 (inside upstream tag jackson-databind-2.9.10.4); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 fixed upstream before 2.9.10.4: CVE-2019-16335 fix 73c1c2cc76e6 by tatu.saloranta@iki.fi (2019-09-12) is an ancestor of tuxcare-current/2.9.10.4 (inside upstream tag jackson-databind-2.9.10.4); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "not_affected \u2014 fixed upstream before 2.9.10.4: CVE-2019-16335 fix 73c1c2cc76e6 by tatu.saloranta@iki.fi (2019-09-12) is an ancestor of tuxcare-current/2.9.10.4 (inside upstream tag jackson-databind-2.9.10.4); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.9.10.4-tuxcare.3. The fix was already included in the upstream 2.9.10.4 release that TuxCare onboarded. The vulnerable classes (org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, com.p6spy.engine.spy.P6DataSource) are blacklisted in SubTypeValidator.java at lines 127-129, preventing their deserialization when Default Typing is enabled. The fix was committed by upstream maintainer Tatu Saloranta on 2019-09-28 (commit 328a0f833d) and was present in the upstream release before TuxCare's onboarding commit (5178627882, dated 2026-09-10).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.9.10.4-tuxcare.3. The fix was already included in the upstream 2.9.10.4 release that TuxCare onboarded. The vulnerable classes (org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, com.p6spy.engine.spy.P6DataSource) are blacklisted in SubTypeValidator.java at lines 127-129, preventing their deserialization when Default Typing is enabled. The fix was committed by upstream maintainer Tatu Saloranta on 2019-09-28 (commit 328a0f833d) and was present in the upstream release before TuxCare's onboarding commit (5178627882, dated 2026-09-10).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.9.10.4. The vulnerability involves polymorphic typing deserialization of dangerous classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource) that enable arbitrary code execution. The upstream fix (commit 9593e16c by Tatu Saloranta) added these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was already present in upstream release 2.9.10.4, which TuxCare onboarded in commit 51786278. The target's SubTypeValidator.java (lines 127-129) contains the blocklist entries, and validateSubType() is properly invoked during bean deserialization (BeanDeserializerFactory.java:135), blocking the attack vector before any dangerous instantiation occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.9.10.4. The vulnerability involves polymorphic typing deserialization of dangerous classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource) that enable arbitrary code execution. The upstream fix (commit 9593e16c by Tatu Saloranta) added these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was already present in upstream release 2.9.10.4, which TuxCare onboarded in commit 51786278. The target's SubTypeValidator.java (lines 127-129) contains the blocklist entries, and validateSubType() is properly invoked during bean deserialization (BeanDeserializerFactory.java:135), blocking the attack vector before any dangerous instantiation occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 fixed upstream before 2.9.10.4: CVE-2019-17267 fix 191a4cdf87b5 by tatu.saloranta@iki.fi (2019-09-19) is an ancestor of tuxcare-current/2.9.10.4 (inside upstream tag jackson-databind-2.9.10.4); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "not_affected \u2014 fixed upstream before 2.9.10.4: CVE-2019-17267 fix 191a4cdf87b5 by tatu.saloranta@iki.fi (2019-09-19) is an ancestor of tuxcare-current/2.9.10.4 (inside upstream tag jackson-databind-2.9.10.4); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (amoniatovskiy@cloudlinux.com, 2026-09-10). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1. The target version 2.9.10.4-tuxcare.3 contains the upstream fix (commit b5a304a985) that adds org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.9.10.4 release when TuxCare onboarded it (first TuxCare commit: 5178627882). The vulnerable pattern is not present because the dangerous log4j-extras classes cannot be deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1. The target version 2.9.10.4-tuxcare.3 contains the upstream fix (commit b5a304a985) that adds org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.9.10.4 release when TuxCare onboarded it (first TuxCare commit: 5178627882). The vulnerable pattern is not present because the dangerous log4j-extras classes cannot be deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is not present in jackson-databind 2.9.10.4. The vulnerability affects versions 2.9.x before 2.9.10.2, and the target is version 2.9.10.4-tuxcare.3. The upstream fix (commit fc4214a88) that adds ehcache class blocking to the deserialization blocklist was included in upstream release 2.9.10.2, which is part of the base version that TuxCare's ELS maintenance started from. The blocklist entries for net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector are present and actively enforced in the deserialization validation path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 is not present in jackson-databind 2.9.10.4. The vulnerability affects versions 2.9.x before 2.9.10.2, and the target is version 2.9.10.4-tuxcare.3. The upstream fix (commit fc4214a88) that adds ehcache class blocking to the deserialization blocklist was included in upstream release 2.9.10.2, which is part of the base version that TuxCare's ELS maintenance started from. The blocklist entries for net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector are present and actively enforced in the deserialization validation path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind versions before 2.9.10.4. The target is version 2.9.10.4, which includes the upstream fix (commit a424c038ba by Tatu Saloranta) that adds ignite-jta gadget classes to the SubTypeValidator blocklist. The vulnerable code pattern is not present because the fix was already in the upstream release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 affects jackson-databind versions before 2.9.10.4. The target is version 2.9.10.4, which includes the upstream fix (commit a424c038ba by Tatu Saloranta) that adds ignite-jta gadget classes to the SubTypeValidator blocklist. The vulnerable code pattern is not present because the fix was already in the upstream release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget class (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory). The target repository is jackson-databind 2.9.10.4-tuxcare.3, which contains the upstream fix that blocks this gadget class in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the 2.9.10.4 release that TuxCare onboarded. The vulnerable code pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget class (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory). The target repository is jackson-databind 2.9.10.4-tuxcare.3, which contains the upstream fix that blocks this gadget class in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the 2.9.10.4 release that TuxCare onboarded. The vulnerable code pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.9.10.4. The fix (blocklist entry for com.caucho.config.types.ResourceRef) was already included in the upstream 2.9.10.4 release that TuxCare onboarded. The vulnerable deserialization gadget is blocked by SubTypeValidator at line 181, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.9.10.4. The fix (blocklist entry for com.caucho.config.types.ResourceRef) was already included in the upstream 2.9.10.4 release that TuxCare onboarded. The vulnerable deserialization gadget is blocked by SubTypeValidator at line 181, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 is not present in jackson-databind 2.9.10.4. The vulnerability involved deserialization gadgets related to org.aoju.bus.proxy.provider.remoting.RmiProvider that could lead to arbitrary code execution. The upstream fix added these classes to the deserialization blocklist in SubTypeValidator.java. This fix (commit 05d7e0e13f) was authored by upstream maintainer Tatu Saloranta and was already included in the upstream 2.9.10.4 release that TuxCare onboarded. The blocklist entries are present at lines 184-185 of SubTypeValidator.java, preventing instantiation of the dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 is not present in jackson-databind 2.9.10.4. The vulnerability involved deserialization gadgets related to org.aoju.bus.proxy.provider.remoting.RmiProvider that could lead to arbitrary code execution. The upstream fix added these classes to the deserialization blocklist in SubTypeValidator.java. This fix (commit 05d7e0e13f) was authored by upstream maintainer Tatu Saloranta and was already included in the upstream 2.9.10.4 release that TuxCare onboarded. The blocklist entries are present at lines 184-185 of SubTypeValidator.java, preventing instantiation of the dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 is NOT AFFECTING this target. The vulnerability involves deserialization of javax.swing.JEditorPane as a gadget for RCE. The fix (blocklist entry for JEditorPane) is present in SubTypeValidator.java:164. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 6ba4845798 and shipped in upstream jackson-databind 2.9.10.4 release before TuxCare onboarded the repository (commit 5178627882). The vulnerable code pattern is not present in the target because the upstream vendor already fixed it in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "CVE-2020-10969 is NOT AFFECTING this target. The vulnerability involves deserialization of javax.swing.JEditorPane as a gadget for RCE. The fix (blocklist entry for JEditorPane) is present in SubTypeValidator.java:164. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 6ba4845798 and shipped in upstream jackson-databind 2.9.10.4 release before TuxCare onboarded the repository (commit 5178627882). The vulnerable code pattern is not present in the target because the upstream vendor already fixed it in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10.4 is NOT vulnerable to CVE-2020-11111. The fix blocking deserialization of org.apache.activemq.* gadget classes was already present in the upstream 2.9.10.4 release. All 9 activemq class names from the vendor patches are in SubTypeValidator.java lines 189-197, added by upstream commit c14c9f99ed authored by Tatu Saloranta (tatu.saloranta@iki.fi). This commit was part of the upstream release before TuxCare's onboarding, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "The target jackson-databind 2.9.10.4 is NOT vulnerable to CVE-2020-11111. The fix blocking deserialization of org.apache.activemq.* gadget classes was already present in the upstream 2.9.10.4 release. All 9 activemq class names from the vendor patches are in SubTypeValidator.java lines 189-197, added by upstream commit c14c9f99ed authored by Tatu Saloranta (tatu.saloranta@iki.fi). This commit was part of the upstream release before TuxCare's onboarding, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.9.10.4-tuxcare.3, which is based on the upstream 2.9.10.4 release that already contains the fix. The vulnerability involved deserialization of the dangerous class org.apache.commons.proxy.provider.remoting.RmiProvider. The fix, authored by upstream maintainer Tatu Saloranta (commit 05d7e0e13f), adds this class to the blacklist in SubTypeValidator.java (line 200). This fix was already present in the upstream 2.9.10.4 release before TuxCare onboarded it, making this an upstream-provided fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.9.10.4-tuxcare.3, which is based on the upstream 2.9.10.4 release that already contains the fix. The vulnerability involved deserialization of the dangerous class org.apache.commons.proxy.provider.remoting.RmiProvider. The fix, authored by upstream maintainer Tatu Saloranta (commit 05d7e0e13f), adds this class to the blacklist in SubTypeValidator.java (line 200). This fix was already present in the upstream 2.9.10.4 release before TuxCare onboarded it, making this an upstream-provided fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 concerns a deserialization gadget vulnerability in jackson-databind involving org.apache.openjpa.ee.WASRegistryManagedRuntime. The fix (adding this class to the SubTypeValidator denylist) is present in the target at SubTypeValidator.java:84. This fix was authored by upstream FasterXML (tatu.saloranta@iki.fi) and shipped in the upstream 2.9.10.4 release before TuxCare onboarded it (commit 5178627882). The vulnerable code pattern (unblocked WASRegistryManagedRuntime deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 concerns a deserialization gadget vulnerability in jackson-databind involving org.apache.openjpa.ee.WASRegistryManagedRuntime. The fix (adding this class to the SubTypeValidator denylist) is present in the target at SubTypeValidator.java:84. This fix was authored by upstream FasterXML (tatu.saloranta@iki.fi) and shipped in the upstream 2.9.10.4 release before TuxCare onboarded it (commit 5178627882). The vulnerable code pattern (unblocked WASRegistryManagedRuntime deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 due to deserialization gadgets related to Spring AOP classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean). The target version 2.9.10.4 contains the upstream fix that blocks these dangerous classes in SubTypeValidator.java. The fix was authored by the upstream Jackson maintainer (tatu.saloranta@iki.fi) on 2020-04-06 and shipped in the upstream 2.9.10.4 release before TuxCare onboarded it. The vulnerable pattern (ability to deserialize these gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 due to deserialization gadgets related to Spring AOP classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean). The target version 2.9.10.4 contains the upstream fix that blocks these dangerous classes in SubTypeValidator.java. The fix was authored by the upstream Jackson maintainer (tatu.saloranta@iki.fi) on 2020-04-06 and shipped in the upstream 2.9.10.4 release before TuxCare onboarded it. The vulnerable pattern (ability to deserialize these gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to improper handling of the org.apache.commons.jelly.impl.Embedded serialization gadget. The target repository is at version 2.9.10.4-tuxcare.3, which includes the upstream fix (commit 77040d85e3e by Tatu Saloranta, 2020-04-07) that adds org.apache.commons.jelly.impl.Embedded to the deserialization blocklist in SubTypeValidator.java line 203. This fix was already present in the upstream 2.9.10.4 release that TuxCare onboarded (commit 5178627882d). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to improper handling of the org.apache.commons.jelly.impl.Embedded serialization gadget. The target repository is at version 2.9.10.4-tuxcare.3, which includes the upstream fix (commit 77040d85e3e by Tatu Saloranta, 2020-04-07) that adds org.apache.commons.jelly.impl.Embedded to the deserialization blocklist in SubTypeValidator.java line 203. This fix was already present in the upstream 2.9.10.4 release that TuxCare onboarded (commit 5178627882d). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-14061 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-14062 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-14195 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14195" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-06T08:17:00.158151+00:00", "status_notes": "Vulnerability CVE-2020-36180 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-36181 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 affects jackson-databind versions lacking xbean-reflect/JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target version 2.9.10.4 is NOT vulnerable. The fix (commit 9bb52c7122) was shipped in upstream version 2.9.10.4, which TuxCare onboarded. The blocklist entry preventing deserialization of JndiConverter is present at SubTypeValidator.java:152 and actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 affects jackson-databind versions lacking xbean-reflect/JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target version 2.9.10.4 is NOT vulnerable. The fix (commit 9bb52c7122) was shipped in upstream version 2.9.10.4, which TuxCare onboarded. The blocklist entry preventing deserialization of JndiConverter is present at SubTypeValidator.java:152 and actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to deserialization gadget vulnerabilities related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target repository at version 2.9.10.4 is not affected because the fix was already included in the upstream 2.9.10.4 release. The SubTypeValidator.java file contains the blocked class name in its DEFAULT_NO_DESER_CLASS_NAMES deny list (lines 154-155), preventing deserialization of the malicious gadget class. This fix was authored by upstream maintainer Tatu Saloranta and was present in the upstream release before TuxCare onboarded version 2.9.10.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to deserialization gadget vulnerabilities related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target repository at version 2.9.10.4 is not affected because the fix was already included in the upstream 2.9.10.4 release. The SubTypeValidator.java file contains the blocked class name in its DEFAULT_NO_DESER_CLASS_NAMES deny list (lines 154-155), preventing deserialization of the malicious gadget class. This fix was authored by upstream maintainer Tatu Saloranta and was present in the upstream release before TuxCare onboarded version 2.9.10.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions BEFORE 2.9.10.4 due to unsafe deserialization of the gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The target repository is jackson-databind version 2.9.10.4-tuxcare.3, which includes the upstream fix from commit 9f4e97019f (authored by Tatu Saloranta) that adds this class to the deserialization blocklist in SubTypeValidator.java line 158. The fix was already present in the upstream 2.9.10.4 release that TuxCare onboarded (first TuxCare commit 51786278 \"Onboard version 2.9.10.4\"). The vulnerable pattern is not present in the target because the defense mechanism (blocklist validation) prevents deserialization of the dangerous gadget class, blocking the attack chain from JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 affects jackson-databind versions BEFORE 2.9.10.4 due to unsafe deserialization of the gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The target repository is jackson-databind version 2.9.10.4-tuxcare.3, which includes the upstream fix from commit 9f4e97019f (authored by Tatu Saloranta) that adds this class to the deserialization blocklist in SubTypeValidator.java line 158. The fix was already present in the upstream 2.9.10.4 release that TuxCare onboarded (first TuxCare commit 51786278 \"Onboard version 2.9.10.4\"). The vulnerable pattern is not present in the target because the defense mechanism (blocklist validation) prevents deserialization of the dangerous gadget class, blocking the attack chain from JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is NOT present in jackson-databind 2.9.10.4. The vulnerability involves unsafe deserialization of br.com.anteros.dbcp.AnterosDBCPConfig, which could enable gadget chain exploitation. The upstream vendor (FasterXML) fixed this in version 2.9.10.4 by adding the class to the deserialization blocklist in SubTypeValidator.java. The target repository is jackson-databind 2.9.10.4-tuxcare.3, which was onboarded from the upstream 2.9.10.4 release that already contained this fix (commit 9f4e97019fb0 by Tatu Saloranta). The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 is NOT present in jackson-databind 2.9.10.4. The vulnerability involves unsafe deserialization of br.com.anteros.dbcp.AnterosDBCPConfig, which could enable gadget chain exploitation. The upstream vendor (FasterXML) fixed this in version 2.9.10.4 by adding the class to the deserialization blocklist in SubTypeValidator.java. The target repository is jackson-databind 2.9.10.4-tuxcare.3, which was onboarded from the upstream 2.9.10.4 release that already contained this fix (commit 9f4e97019fb0 by Tatu Saloranta). The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2021-20190 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-06T18:52:00.040792+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-50193 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" }, "action_statement": "Vulnerability CVE-2026-50193 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.10.4 is not affected by CVE-2026-54512. The vulnerability is specific to PolymorphicTypeValidator (PTV), a configurable validation mechanism introduced in version 2.10.0. Version 2.9.10.4 predates PTV and uses a different security architecture (SubTypeValidator with a hardcoded deny-list). While 2.9.10.4 does not validate type parameters at type resolution time, it validates them when element/value deserializers are created, preventing the bypass described in the CVE. The attack vector (bypassing a configured PTV allow-list by smuggling denied types as generic parameters) does not apply to 2.9.10.4's non-configurable validation model.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.9.10.4 is not affected by CVE-2026-54512. The vulnerability is specific to PolymorphicTypeValidator (PTV), a configurable validation mechanism introduced in version 2.10.0. Version 2.9.10.4 predates PTV and uses a different security architecture (SubTypeValidator with a hardcoded deny-list). While 2.9.10.4 does not validate type parameters at type resolution time, it validates them when element/value deserializers are created, preventing the bypass described in the CVE. The attack vector (bypassing a configured PTV allow-list by smuggling denied types as generic parameters) does not apply to 2.9.10.4's non-configurable validation model." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-09T13:53:00.116712+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.4-tuxcare.6.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.4-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.10.4 is NOT AFFECTED by CVE-2026-54518. The vulnerability exists in UnwrappedPropertyHandler.processUnwrappedCreatorProperties(), which does not exist in this version. The feature to support @JsonUnwrapped with @JsonCreator parameters was implemented in commit 502fe888da (issue #1467) in a later version and is not present in 2.9.10.4. Any attempt to use @JsonUnwrapped on a @JsonCrea...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Version 2.9.10.4 is NOT AFFECTED by CVE-2026-54518. The vulnerability exists in UnwrappedPropertyHandler.processUnwrappedCreatorProperties(), which does not exist in this version. The feature to support @JsonUnwrapped with @JsonCreator parameters was implemented in commit 502fe888da (issue #1467) in a later version and is not present in 2.9.10.4. Any attempt to use @JsonUnwrapped on a @JsonCrea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.10.4 is not affected by CVE-2026-59888. This vulnerability specifically targets Java Records with @JsonIgnore annotations when a PropertyNamingStrategy is applied. Java Records were introduced in Java 14 (2020) and became stable in Java 16 (2021). Target version 2.9.10.4 predates Records entirely: it targets Java 7 (javac.src.version=1.7 per pom.xml), contains no Records introspecti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 Version 2.9.10.4 is not affected by CVE-2026-59888. This vulnerability specifically targets Java Records with @JsonIgnore annotations when a PropertyNamingStrategy is applied. Java Records were introduced in Java 14 (2020) and became stable in Java 16 (2021). Target version 2.9.10.4 predates Records entirely: it targets Java 7 (javac.src.version=1.7 per pom.xml), contains no Records introspecti..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.10.4-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4-tuxcare.5" } } ], "timestamp": "2026-11-05T11:01:22.079749+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.10.4-tuxcare.5.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }