{ "@id": "urn:uuid:4fd50f5c-4e75-4782-a66c-97fc8e2c39d4", "role": "Document Creator", "author": "https://tuxcare.com", "version": 60, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-09T13:37:30.818436+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T13:14:44.515379+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.7-tuxcare.3 is not affected by CVE-2017-15095. The vulnerability (deserialization of dangerous classes via polymorphic type handling) was fixed in upstream version 2.9.4, and the target is running 2.9.10.7, which is significantly later. The fix was already present in the upstream release 2.9.10.7 that TuxCare onboarded. All blacklist entries from issue #1737 are present in SubTypeValidator.java, including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring framework classes, and C3P0 classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "Target version 2.9.10.7-tuxcare.3 is not affected by CVE-2017-15095. The vulnerability (deserialization of dangerous classes via polymorphic type handling) was fixed in upstream version 2.9.4, and the target is running 2.9.10.7, which is significantly later. The fix was already present in the upstream release 2.9.10.7 that TuxCare onboarded. All blacklist entries from issue #1737 are present in SubTypeValidator.java, including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring framework classes, and C3P0 classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T15:47:47.688279+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is not present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability involved incomplete blacklisting of dangerous classes for polymorphic deserialization, particularly affecting Spring framework types. The target contains the complete upstream fix via SubTypeValidator class with all required blacklist entries and pattern-matching logic for Spring and C3P0 classes. The fix was authored by upstream (Tatu Saloranta, tatu.saloranta@iki.fi) and shipped in upstream releases 2.7.9.2, 2.8.11, and 2.9.0+, all predating the target version 2.9.10.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 is not present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability involved incomplete blacklisting of dangerous classes for polymorphic deserialization, particularly affecting Spring framework types. The target contains the complete upstream fix via SubTypeValidator class with all required blacklist entries and pattern-matching logic for Spring and C3P0 classes. The fix was authored by upstream (Tatu Saloranta, tatu.saloranta@iki.fi) and shipped in upstream releases 2.7.9.2, 2.8.11, and 2.9.0+, all predating the target version 2.9.10.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T14:34:04.441947+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.7-tuxcare.3) is not affected by CVE-2017-7525. The fix for this deserialization vulnerability (issue #1599) was already present in the upstream version 2.9.10.7 when TuxCare onboarded it. The defense mechanism is implemented in SubTypeValidator.java, which maintains a blacklist of dangerous classes (InvokerTransformer, InstantiateTransformer, TemplatesImpl, etc.) and validates types before deserialization in BeanDeserializerFactory.createBeanDeserializer(), preventing arbitrary code execution via malicious JSON input with embedded type declarations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "The target repository (jackson-databind 2.9.10.7-tuxcare.3) is not affected by CVE-2017-7525. The fix for this deserialization vulnerability (issue #1599) was already present in the upstream version 2.9.10.7 when TuxCare onboarded it. The defense mechanism is implemented in SubTypeValidator.java, which maintains a blacklist of dangerous classes (InvokerTransformer, InstantiateTransformer, TemplatesImpl, etc.) and validates types before deserialization in BeanDeserializerFactory.createBeanDeserializer(), preventing arbitrary code execution via malicious JSON input with embedded type declarations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T13:23:58.768798+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.9.10.7. The vulnerability involves deserializing the malicious iBatis gadget class \"org.apache.ibatis.parsing.XPathParser\" when Jackson default typing is enabled, allowing data exfiltration via XML external entities. The fix (blacklisting this class in SubTypeValidator.java) was already present in the upstream release 2.9.10.7 that TuxCare onboarded. The blacklist entry exists at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:65, added by upstream commit 27b4defc270 by Tatu Saloranta on 2018-05-10, which is an ancestor of the first TuxCare commit (ad46f7e28 \"Onboard version 2.9.10.7\"). No separate TuxCare backport of CVE-2018-11307 was applied to this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.9.10.7. The vulnerability involves deserializing the malicious iBatis gadget class \"org.apache.ibatis.parsing.XPathParser\" when Jackson default typing is enabled, allowing data exfiltration via XML external entities. The fix (blacklisting this class in SubTypeValidator.java) was already present in the upstream release 2.9.10.7 that TuxCare onboarded. The blacklist entry exists at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:65, added by upstream commit 27b4defc270 by Tatu Saloranta on 2018-05-10, which is an ancestor of the first TuxCare commit (ad46f7e28 \"Onboard version 2.9.10.7\"). No separate TuxCare backport of CVE-2018-11307 was applied to this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 does NOT affect jackson-databind version 2.9.10.7. The vulnerability involves polymorphic deserialization of dangerous classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that enable JNDI/LDAP exploitation. The target version contains the upstream fix (commit 28badf7ef6) which adds these classes to the SubTypeValidator blacklist. This fix was authored by the upstream FasterXML maintainer Tatu Saloranta and was already present in the upstream release 2.9.10.7 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "CVE-2018-12022 does NOT affect jackson-databind version 2.9.10.7. The vulnerability involves polymorphic deserialization of dangerous classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that enable JNDI/LDAP exploitation. The target version contains the upstream fix (commit 28badf7ef6) which adds these classes to the SubTypeValidator blacklist. This fix was authored by the upstream FasterXML maintainer Tatu Saloranta and was already present in the upstream release 2.9.10.7 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T16:25:43.115991+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.7 is not affected by CVE-2018-12023. The Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that enable LDAP-based deserialization attacks are already blacklisted in SubTypeValidator.java (lines 70-72). The fix was applied by upstream FasterXML maintainer Tatu Saloranta in commit 28badf7ef6 (June 2018), shipped in version 2.9.6, and included in all subsequent 2.9.x releases including the target version 2.9.10.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "Target version 2.9.10.7 is not affected by CVE-2018-12023. The Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that enable LDAP-based deserialization attacks are already blacklisted in SubTypeValidator.java (lines 70-72). The fix was applied by upstream FasterXML maintainer Tatu Saloranta in commit 28badf7ef6 (June 2018), shipped in version 2.9.6, and included in all subsequent 2.9.x releases including the target version 2.9.10.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T14:01:43.517878+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.9.10.7. The vulnerability involved unsafe polymorphic deserialization of slf4j-ext EventData and other dangerous classes. The upstream fix (commit 87d29af2) adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist was already present in version 2.9.10.7 when TuxCare onboarded it. The fix shipped in the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.9.10.7. The vulnerability involved unsafe polymorphic deserialization of slf4j-ext EventData and other dangerous classes. The upstream fix (commit 87d29af2) adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist was already present in version 2.9.10.7 when TuxCare onboarded it. The fix shipped in the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T16:04:33.761797+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is not present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability concerns polymorphic deserialization of blaze-ds classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes) that could enable arbitrary code execution. The fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and was already included in upstream release 2.9.10.7 before TuxCare onboarding. The blacklist preventing deserialization of these dangerous classes is present in SubTypeValidator.java lines 74-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "CVE-2018-14719 is not present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability concerns polymorphic deserialization of blaze-ds classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes) that could enable arbitrary code execution. The fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and was already included in upstream release 2.9.10.7 before TuxCare onboarding. The blacklist preventing deserialization of these dangerous classes is present in SubTypeValidator.java lines 74-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T14:10:29.791973+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability affects versions before 2.9.7 due to missing blacklist entries for four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that enable XXE/deserialization attacks. The target version includes the upstream fix (commit 87d29af25e) that adds these classes to the SubTypeValidator blacklist. This fix was already present in the upstream 2.9.10.7 release before TuxCare onboarded it (first TuxCare commit: ad46f7e by amoniatovskiy@cloudlinux.com). The defense blocks polymorphic deserialization of the four classes before instantiation, preventing the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability affects versions before 2.9.7 due to missing blacklist entries for four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that enable XXE/deserialization attacks. The target version includes the upstream fix (commit 87d29af25e) that adds these classes to the SubTypeValidator blacklist. This fix was already present in the upstream 2.9.10.7 release before TuxCare onboarded it (first TuxCare commit: ad46f7e by amoniatovskiy@cloudlinux.com). The defense blocks polymorphic deserialization of the four classes before instantiation, preventing the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T14:41:24.721852+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.7-tuxcare.3) is NOT affected by CVE-2018-14721. The vulnerability allowed SSRF attacks via polymorphic deserialization of the axis2-jaxws class. The upstream vendor fix (commit 87d29af25e) added \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" to the deserialization blocklist, and this fix was already present in upstream version 2.9.10.7 when TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:78 and is actively enforced during all polymorphic deserialization operations via BeanDeserializerFactory._validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "The target repository (jackson-databind 2.9.10.7-tuxcare.3) is NOT affected by CVE-2018-14721. The vulnerability allowed SSRF attacks via polymorphic deserialization of the axis2-jaxws class. The upstream vendor fix (commit 87d29af25e) added \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" to the deserialization blocklist, and this fix was already present in upstream version 2.9.10.7 when TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:78 and is actively enforced during all polymorphic deserialization operations via BeanDeserializerFactory._validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T12:58:17.463230+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is not present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability involved missing blacklist protection for org.apache.axis2.transport.jms.JMSOutTransportInfo during polymorphic deserialization. The upstream fix (commit 72cd4025a2 by Tatu Saloranta, 2018-11-19) added this class to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. This fix was already included in upstream release 2.9.10.7, which TuxCare onboarded via commit ad46f7e28. The target version is 2.9.10.7-tuxcare.3, which inherits the fix from the upstream release. The vulnerable code pattern (missing blacklist entry) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 is not present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability involved missing blacklist protection for org.apache.axis2.transport.jms.JMSOutTransportInfo during polymorphic deserialization. The upstream fix (commit 72cd4025a2 by Tatu Saloranta, 2018-11-19) added this class to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. This fix was already included in upstream release 2.9.10.7, which TuxCare onboarded via commit ad46f7e28. The target version is 2.9.10.7-tuxcare.3, which inherits the fix from the upstream release. The vulnerable code pattern (missing blacklist entry) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T17:02:28.386699+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10.7-tuxcare.3 is not affected by CVE-2018-19361. The vulnerability involves polymorphic deserialization of dangerous OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that could enable arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 72cd4025a229fb28ec133235003dd4616f70afaa by adding these classes to a blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.9.10.7 release that TuxCare onboarded on 2020-12-02, making the target not affected from inception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "The target jackson-databind 2.9.10.7-tuxcare.3 is not affected by CVE-2018-19361. The vulnerability involves polymorphic deserialization of dangerous OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that could enable arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 72cd4025a229fb28ec133235003dd4616f70afaa by adding these classes to a blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.9.10.7 release that TuxCare onboarded on 2020-12-02, making the target not affected from inception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T15:28:17.034118+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability required blocking specific dangerous classes (org.jboss.util.propertyeditor.DocumentEditor and others) from polymorphic deserialization. The upstream vendor (Tatu Saloranta) applied this fix in commit 72cd4025a2 on Nov 19, 2018, which was included in release 2.9.8. The target version 2.9.10.7 already contained this fix when TuxCare onboarded it. The blocklist entries are present at SubTypeValidator.java:81-85.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability required blocking specific dangerous classes (org.jboss.util.propertyeditor.DocumentEditor and others) from polymorphic deserialization. The upstream vendor (Tatu Saloranta) applied this fix in commit 72cd4025a2 on Nov 19, 2018, which was included in release 2.9.8. The target version 2.9.10.7 already contained this fix when TuxCare onboarded it. The blocklist entries are present at SubTypeValidator.java:81-85.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability involved two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the existing blacklist for remote code execution. The upstream fix added these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 62-63), preventing their deserialization. This fix was authored by Tatu Saloranta (upstream maintainer) and shipped in upstream version 2.9.10.7, which TuxCare later onboarded. The blacklist is properly enforced through BeanDeserializerFactory._validateSubType() during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability involved two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the existing blacklist for remote code execution. The upstream fix added these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 62-63), preventing their deserialization. This fix was authored by Tatu Saloranta (upstream maintainer) and shipped in upstream version 2.9.10.7, which TuxCare later onboarded. The blacklist is properly enforced through BeanDeserializerFactory._validateSubType() during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T14:01:13.058306+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10.7-tuxcare.3 is NOT AFFECTED by CVE-2018-7489. The upstream vendor (FasterXML) fixed this vulnerability in commit 6799f8f10c (Fix #1931) by adding validation logic to block deserialization of c3p0 DataSource classes. This fix was already present in the upstream release 2.9.10.7 that TuxCare onboarded. The defense code in SubTypeValidator.java (lines 24, 294-304) blocks any class matching pattern \"com.mchange.v2.c3p0.*DataSource\" during polymorphic type validation, preventing the attack path described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "The target jackson-databind 2.9.10.7-tuxcare.3 is NOT AFFECTED by CVE-2018-7489. The upstream vendor (FasterXML) fixed this vulnerability in commit 6799f8f10c (Fix #1931) by adding validation logic to block deserialization of c3p0 DataSource classes. This fix was already present in the upstream release 2.9.10.7 that TuxCare onboarded. The defense code in SubTypeValidator.java (lines 24, 294-304) blocks any class matching pattern \"com.mchange.v2.c3p0.*DataSource\" during polymorphic type validation, preventing the attack path described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T16:37:30.400386+00:00", "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind versions before 2.9.9 due to missing validation of the com.mysql.cj.jdbc.admin.MiniAdmin class in polymorphic deserialization. The target version 2.9.10.7-tuxcare.3 already contains the upstream fix (commit dda513bd72 by tatu.saloranta@iki.fi) which adds MiniAdmin to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java at line 88. This fix was shipped in the upstream release 2.9.10.7 before TuxCare onboarded it, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12086" }, "impact_statement": "CVE-2019-12086 affects jackson-databind versions before 2.9.9 due to missing validation of the com.mysql.cj.jdbc.admin.MiniAdmin class in polymorphic deserialization. The target version 2.9.10.7-tuxcare.3 already contains the upstream fix (commit dda513bd72 by tatu.saloranta@iki.fi) which adds MiniAdmin to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java at line 88. This fix was shipped in the upstream release 2.9.10.7 before TuxCare onboarded it, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-01T18:51:00.087366+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target version 2.9.10.7 is not affected by CVE-2019-12384. The fix was already present in the upstream release that TuxCare onboarded. The dangerous class \"ch.qos.logback.core.db.DriverManagerConnectionSource\" is blocked in the SubTypeValidator deny list (line 91), preventing polymorphic deserialization attacks via logback-core. The CVE affects versions before 2.9.9.1; the target is 2.9.10.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 The target version 2.9.10.7 is not affected by CVE-2019-12384. The fix was already present in the upstream release that TuxCare onboarded. The dangerous class \"ch.qos.logback.core.db.DriverManagerConnectionSource\" is blocked in the SubTypeValidator deny list (line 91), preventing polymorphic deserialization attacks via logback-core. The CVE affects versions before 2.9.9.1; the target is 2.9.10.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-02T07:30:00.106983+00:00", "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind version 2.9.10.7-tuxcare.3 is NOT affected by CVE-2019-12814. The vulnerability involves polymorphic typing deserialization of JDOM XSLTransformer classes that can be exploited to read arbitrary local files. The upstream vendor fix (commit 5f7c69bba07a7155adde130d9dee2e54a54f1fa5 by Tatu Saloranta) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12814" }, "impact_statement": "not_affected \u2014 The target jackson-databind version 2.9.10.7-tuxcare.3 is NOT affected by CVE-2019-12814. The vulnerability involves polymorphic typing deserialization of JDOM XSLTransformer classes that can be exploited to read arbitrary local files. The upstream vendor fix (commit 5f7c69bba07a7155adde130d9dee2e54a54f1fa5 by Tatu Saloranta) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T12:18:14.184922+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.9.10.7-tuxcare.3 is NOT AFFECTED by CVE-2019-14379. The fix that blocks deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource was already present in the upstream jackson-databind 2.9.10.7 release that TuxCare onboarded. The blacklist entries are present in SubTypeValidator.java at lines 98 and 102, preventing arbitrary code execution via these gadget classes. The fix was authored by upstream maintainer Tatu Saloranta (commit ad418eeb97) and shipped in the upstream release before TuxCare's first commit (ad46f7e284 \"Onboard version 2.9.10.7\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "The target repository jackson-databind 2.9.10.7-tuxcare.3 is NOT AFFECTED by CVE-2019-14379. The fix that blocks deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource was already present in the upstream jackson-databind 2.9.10.7 release that TuxCare onboarded. The blacklist entries are present in SubTypeValidator.java at lines 98 and 102, preventing arbitrary code execution via these gadget classes. The fix was authored by upstream maintainer Tatu Saloranta (commit ad418eeb97) and shipped in the upstream release before TuxCare's first commit (ad46f7e284 \"Onboard version 2.9.10.7\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T13:45:27.906732+00:00", "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.7-tuxcare.3) is not affected by CVE-2019-14439. The vulnerability involves polymorphic deserialization of dangerous classes when Default Typing is enabled, allowing remote code execution or JNDI injection through classes like ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup. The upstream fix, which adds these classes to the blacklist in SubTypeValidator.java, was already present in version 2.9.10.7 when TuxCare onboarded it. The fix was authored by Tatu Saloranta (upstream maintainer) in commit ad418eeb97, dated July 25, 2019, and is part of the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14439" }, "impact_statement": "The target repository (jackson-databind 2.9.10.7-tuxcare.3) is not affected by CVE-2019-14439. The vulnerability involves polymorphic deserialization of dangerous classes when Default Typing is enabled, allowing remote code execution or JNDI injection through classes like ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup. The upstream fix, which adds these classes to the blacklist in SubTypeValidator.java, was already present in version 2.9.10.7 when TuxCare onboarded it. The fix was authored by Tatu Saloranta (upstream maintainer) in commit ad418eeb97, dated July 25, 2019, and is part of the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-14540 is a jackson-databind polymorphic-typing deserialization gadget issue: with default/polymorphic typing enabled, a JSON payload naming com.zaxxer.hikari.HikariConfig as a type id could be instantiated as a gadget. The upstream fix adds that class name to the SubTypeValidator deny-list so validateSubType rejects it before instantiation. The target is jackson-databind 2.9.10.7 (pom: 2.9.10.20201202), which is AFTER the fixed 2.9.10 release (CVE affects \"before 2.9.10\"). The defense is present in HEAD: SubTypeValidator.java line 105 `s.add(\"com.zaxxer.hikari.HikariConfig\");` (plus line 107 HikariDataSource). git blame ties these exact lines to upstream commits d4983c740f and 73c1c2cc76 \u2014 the two patch commits named in this task \u2014 both authored and committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in 2019 and both ancestors of HEAD. Enforcement is intact: validateSubType() (line 249) checks _cfgIllegalClassNames.contains(full) and throws \"Illegal type (...) to deserialize: prevented for security reasons\" (line 283) before any instantiation. Attribution: this is an UPSTREAM/vendor fix (not a TuxCare/CloudLinux-authored backport), so the correct verdict is not_affected with justification code_not_present rather than already_fixed. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "not_affected \u2014 CVE-2019-14540 is a jackson-databind polymorphic-typing deserialization gadget issue: with default/polymorphic typing enabled, a JSON payload naming com.zaxxer.hikari.HikariConfig as a type id could be instantiated as a gadget. The upstream fix adds that class name to the SubTypeValidator deny-list so validateSubType rejects it before instantiation. The target is jackson-databind 2.9.10.7 (pom: 2.9.10.20201202), which is AFTER the fixed 2.9.10 release (CVE affects \"before 2.9.10\"). The defense is present in HEAD: SubTypeValidator.java line 105 `s.add(\"com.zaxxer.hikari.HikariConfig\");` (plus line 107 HikariDataSource). git blame ties these exact lines to upstream commits d4983c740f and 73c1c2cc76 \u2014 the two patch commits named in this task \u2014 both authored and committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in 2019 and both ancestors of HEAD. Enforcement is intact: validateSubType() (line 249) checks _cfgIllegalClassNames.contains(full) and throws \"Illegal type (...) to deserialize: prevented for security reasons\" (line 283) before any instantiation. Attribution: this is an UPSTREAM/vendor fix (not a TuxCare/CloudLinux-authored backport), so the correct verdict is not_affected with justification code_not_present rather than already_fixed. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is not a vulnerability in this target. The fix is present in the code (SubTypeValidator.java lines 112-114 blocklisting org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration). The fix was authored by the upstream vendor (Tatu Saloranta, tatu.saloranta@iki.fi) as part of jackson-databind 2.9.10 release and inherited by TuxCare when onboarding version 2.9.10.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 is not a vulnerability in this target. The fix is present in the code (SubTypeValidator.java lines 112-114 blocklisting org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration). The fix was authored by the upstream vendor (Tatu Saloranta, tatu.saloranta@iki.fi) as part of jackson-databind 2.9.10 release and inherited by TuxCare when onboarding version 2.9.10.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-14893 (jackson-databind#2469) is a polymorphic-deserialization gadget CVE. The vendor fix (commit 998efd708284778f29d83d7962a9bd935c228317, author Tatu Saloranta / upstream FasterXML) adds a single deny-list entry \u2014 org.apache.xalan.lib.sql.JNDIConnectionPool \u2014 to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java so the xalan2 JNDI gadget cannot be instantiated during default/@JsonTypeInfo(Id.CLASS|MINIMAL_CLASS) deserialization. The target (com.fasterxml.jackson.core:jackson-databind 2.9.10.7, TuxCare ELS fork) ALREADY contains that exact deny-list entry at SubTypeValidator.java:116-117. The entry is on the live deserialization path: validateSubType() (line 239) is invoked from BeanDeserializerFactory.buildBeanDeserializer via _validateSubType (lines 135/919); at line 249 it matches the class name against _cfgIllegalClassNames (=DEFAULT_NO_DESER_CLASS_NAMES) and, on match, throws JsonMappingException (\"prevented for security reasons\", line 282) before instantiation. git blame shows the line was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-09-19 in the very commit that is the vendor patch, and it entered this repo via the wholesale \"Onboard version 2.9.10.7\" import \u2014 NOT via a TuxCare CVE-2019-14893 backport (the only TuxCare backport merge present is for CVE-2020-36182). The vulnerable pattern (missing deny entry) is therefore absent in HEAD due to an upstream-authored fix already shipped in this version. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "not_affected \u2014 CVE-2019-14893 (jackson-databind#2469) is a polymorphic-deserialization gadget CVE. The vendor fix (commit 998efd708284778f29d83d7962a9bd935c228317, author Tatu Saloranta / upstream FasterXML) adds a single deny-list entry \u2014 org.apache.xalan.lib.sql.JNDIConnectionPool \u2014 to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java so the xalan2 JNDI gadget cannot be instantiated during default/@JsonTypeInfo(Id.CLASS|MINIMAL_CLASS) deserialization. The target (com.fasterxml.jackson.core:jackson-databind 2.9.10.7, TuxCare ELS fork) ALREADY contains that exact deny-list entry at SubTypeValidator.java:116-117. The entry is on the live deserialization path: validateSubType() (line 239) is invoked from BeanDeserializerFactory.buildBeanDeserializer via _validateSubType (lines 135/919); at line 249 it matches the class name against _cfgIllegalClassNames (=DEFAULT_NO_DESER_CLASS_NAMES) and, on match, throws JsonMappingException (\"prevented for security reasons\", line 282) before instantiation. git blame shows the line was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-09-19 in the very commit that is the vendor patch, and it entered this repo via the wholesale \"Onboard version 2.9.10.7\" import \u2014 NOT via a TuxCare CVE-2019-14893 backport (the only TuxCare backport merge present is for CVE-2020-36182). The vulnerable pattern (missing deny entry) is therefore absent in HEAD due to an upstream-authored fix already shipped in this version. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-16335 is a jackson-databind polymorphic-typing (deserialization gadget) issue exploited via the com.zaxxer.hikari.HikariDataSource class when default typing is enabled. The upstream fix (commit 73c1c2cc7, \"Fix #2449\") adds the FQCN \"com.zaxxer.hikari.HikariDataSource\" to the SubTypeValidator deny-list. The target repo (jackson-databind 2.9.10.7, HEAD e36043f6e) ALREADY CONTAINS this exact deny-list entry at SubTypeValidator.java:107, and git history confirms the line was introduced by the very same upstream patch commit (73c1c2cc7), which is an ancestor of HEAD via the onboarded upstream 2.9.10 baseline. The deny-list is actively consumed: validateSubType() checks _cfgIllegalClassNames.contains(full) and throws \"Illegal type ... prevented for security reasons\" for any listed class. The defense is on the deserialization execution path and blocks the Brief's Input from reaching the Goal. The fix is upstream-vendor-authored (Tatu Saloranta, iki.fi), NOT a TuxCare/CloudLinux backport \u2014 so verdict is not_affected (vendor fix already in shipped version), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "not_affected \u2014 CVE-2019-16335 is a jackson-databind polymorphic-typing (deserialization gadget) issue exploited via the com.zaxxer.hikari.HikariDataSource class when default typing is enabled. The upstream fix (commit 73c1c2cc7, \"Fix #2449\") adds the FQCN \"com.zaxxer.hikari.HikariDataSource\" to the SubTypeValidator deny-list. The target repo (jackson-databind 2.9.10.7, HEAD e36043f6e) ALREADY CONTAINS this exact deny-list entry at SubTypeValidator.java:107, and git history confirms the line was introduced by the very same upstream patch commit (73c1c2cc7), which is an ancestor of HEAD via the onboarded upstream 2.9.10 baseline. The deny-list is actively consumed: validateSubType() checks _cfgIllegalClassNames.contains(full) and throws \"Illegal type ... prevented for security reasons\" for any listed class. The defense is on the deserialization execution path and blocks the Brief's Input from reaching the Goal. The fix is upstream-vendor-authored (Tatu Saloranta, iki.fi), NOT a TuxCare/CloudLinux backport \u2014 so verdict is not_affected (vendor fix already in shipped version), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T15:10:53.898872+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability exploits polymorphic typing to deserialize dangerous commons-dbcp and p6spy classes when Default Typing is enabled. The upstream vendor (FasterXML) fixed this by adding three classes to SubTypeValidator's blacklist in commits 9593e16cf5 and 328a0f833d, authored by Tatu Saloranta. These fixes were already present in upstream release 2.9.10.x before TuxCare onboarded version 2.9.10.7. The target's SubTypeValidator.java contains all three required blacklist entries at lines 124-127, preventing deserialization of SharedPoolDataSource, PerUserPoolDataSource, and P6DataSource.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.9.10.7-tuxcare.3. The vulnerability exploits polymorphic typing to deserialize dangerous commons-dbcp and p6spy classes when Default Typing is enabled. The upstream vendor (FasterXML) fixed this by adding three classes to SubTypeValidator's blacklist in commits 9593e16cf5 and 328a0f833d, authored by Tatu Saloranta. These fixes were already present in upstream release 2.9.10.x before TuxCare onboarded version 2.9.10.7. The target's SubTypeValidator.java contains all three required blacklist entries at lines 124-127, preventing deserialization of SharedPoolDataSource, PerUserPoolDataSource, and P6DataSource.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T17:20:10.514084+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.9.10.7-tuxcare.3. The fix for this vulnerability was already included in the upstream jackson-databind 2.9.10.1 release (September 2019), which predates the target version. All three dangerous gadget classes (P6DataSource, SharedPoolDataSource, PerUserPoolDataSource) are properly blocklisted in SubTypeValidator.java lines 124-127, preventing polymorphic deserialization attacks. The fix was authored by upstream maintainer Tatu Saloranta and was present before TuxCare onboarded version 2.9.10.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.9.10.7-tuxcare.3. The fix for this vulnerability was already included in the upstream jackson-databind 2.9.10.1 release (September 2019), which predates the target version. All three dangerous gadget classes (P6DataSource, SharedPoolDataSource, PerUserPoolDataSource) are properly blocklisted in SubTypeValidator.java lines 124-127, preventing polymorphic deserialization attacks. The fix was authored by upstream maintainer Tatu Saloranta and was present before TuxCare onboarded version 2.9.10.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-17267 is a jackson-databind polymorphic-typing (default typing) deserialization-gadget issue involving net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. Upstream fixed it in 2.9.10 / 2.8.11.5 (patch commit 191a4cdf8, GitHub issue #2460) by adding that class name to the SubTypeValidator deny list. The target is jackson-databind 2.9.10.7 (com.fasterxml.jackson.core:jackson-databind) \u2014 same product, a later patch release than the fixed 2.9.10. The deny-list entry is present verbatim at SubTypeValidator.java:99 (\"s.add(\\\"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\\\");\") under the \"[databind#2387], [databind#2460]: EHCache\" comment (line 97), i.e. the exact post-fix state. The enforcement path is intact: validateSubType() (line 239) tests _cfgIllegalClassNames.contains(full) (line 249, backed by DEFAULT_NO_DESER_CLASS_NAMES at line 225/231) and, on a match, breaks to reportBadTypeDefinition(\"Illegal type (%s) to deserialize: prevented for security reasons\", line 282), preventing instantiation. git blame/log shows line 99 was introduced by upstream commit 191a4cdf8 authored by Tatu Saloranta \u2014 the jackson maintainer, not a TuxCare/CloudLinux domain. The fix is baked into the shipped version, so the vulnerable pre-fix pattern (gadget absent from deny list) is not present in HEAD. Verdict: not_affected (upstream/vendor fix already applied), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "not_affected \u2014 CVE-2019-17267 is a jackson-databind polymorphic-typing (default typing) deserialization-gadget issue involving net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. Upstream fixed it in 2.9.10 / 2.8.11.5 (patch commit 191a4cdf8, GitHub issue #2460) by adding that class name to the SubTypeValidator deny list. The target is jackson-databind 2.9.10.7 (com.fasterxml.jackson.core:jackson-databind) \u2014 same product, a later patch release than the fixed 2.9.10. The deny-list entry is present verbatim at SubTypeValidator.java:99 (\"s.add(\\\"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\\\");\") under the \"[databind#2387], [databind#2460]: EHCache\" comment (line 97), i.e. the exact post-fix state. The enforcement path is intact: validateSubType() (line 239) tests _cfgIllegalClassNames.contains(full) (line 249, backed by DEFAULT_NO_DESER_CLASS_NAMES at line 225/231) and, on a match, breaks to reportBadTypeDefinition(\"Illegal type (%s) to deserialize: prevented for security reasons\", line 282), preventing instantiation. git blame/log shows line 99 was introduced by upstream commit 191a4cdf8 authored by Tatu Saloranta \u2014 the jackson maintainer, not a TuxCare/CloudLinux domain. The fix is baked into the shipped version, so the vulnerable pre-fix pattern (gadget absent from deny list) is not present in HEAD. Verdict: not_affected (upstream/vendor fix already applied), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T14:51:16.476690+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1 where polymorphic typing allows deserialization of dangerous log4j-extras classes leading to JNDI injection and remote code execution. The target version 2.9.10.7 already includes the upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) which adds org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to the deserialization blacklist. This fix was shipped in upstream release 2.9.10.1, well before the 2.9.10.7 version that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1 where polymorphic typing allows deserialization of dangerous log4j-extras classes leading to JNDI injection and remote code execution. The target version 2.9.10.7 already includes the upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) which adds org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to the deserialization blacklist. This fix was shipped in upstream release 2.9.10.1, well before the 2.9.10.7 version that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.9.10.7. The vulnerability requires blocking two ehcache JNDI selector classes (GenericJndiSelector and GlassfishSelector) from polymorphic deserialization. The fix was already present in the upstream 2.9.10.7 release that TuxCare onboarded. The target contains the complete fix: lines 133-135 of SubTypeValidator.java add both classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization and blocking the JNDI injection attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.9.10.7. The vulnerability requires blocking two ehcache JNDI selector classes (GenericJndiSelector and GlassfishSelector) from polymorphic deserialization. The fix was already present in the upstream 2.9.10.7 release that TuxCare onboarded. The target contains the complete fix: lines 133-135 of SubTypeValidator.java add both classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization and blocking the JNDI injection attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T17:08:31.778572+00:00", "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.9.10.7-tuxcare.3, which already contains the upstream fix in commit a424c038ba by Tatu Saloranta (tatu.saloranta@iki.fi). The fix adds three class names to the SubTypeValidator blacklist: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This fix was already present in the upstream 2.9.10.7 release that TuxCare onboarded (commit ad46f7e28), so the vulnerable pattern has never been present in this target version. The SubTypeValidator is actively invoked during deserialization by BeanDeserializerFactory, ensuring the defense is enforced.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10650" }, "impact_statement": "CVE-2020-10650 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.9.10.7-tuxcare.3, which already contains the upstream fix in commit a424c038ba by Tatu Saloranta (tatu.saloranta@iki.fi). The fix adds three class names to the SubTypeValidator blacklist: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This fix was already present in the upstream 2.9.10.7 release that TuxCare onboarded (commit ad46f7e28), so the vulnerable pattern has never been present in this target version. The SubTypeValidator is actively invoked during deserialization by BeanDeserializerFactory, ensuring the defense is enforced.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.7-tuxcare.3) is NOT affected by CVE-2020-10672. The vulnerability involved deserialization gadgets in org.apache.aries.transaction.jms classes that could enable malicious operations. The upstream fix, which blocks these classes via SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, was already present in the upstream 2.9.10.7 release that TuxCare onboarded. The dangerous XaPooledConnectionFactory classes are blocked at lines 163-164 of SubTypeValidator.java, and this validation is enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10672" }, "impact_statement": "The target repository (jackson-databind 2.9.10.7-tuxcare.3) is NOT affected by CVE-2020-10672. The vulnerability involved deserialization gadgets in org.apache.aries.transaction.jms classes that could enable malicious operations. The upstream fix, which blocks these classes via SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, was already present in the upstream 2.9.10.7 release that TuxCare onboarded. The dangerous XaPooledConnectionFactory classes are blocked at lines 163-164 of SubTypeValidator.java, and this validation is enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T16:32:27.596761+00:00", "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4. The target is version 2.9.10.7-tuxcare.3. The fix (blocking deserialization of com.caucho.config.types.ResourceRef) is present at SubTypeValidator.java:167. This fix was authored by Tatu Saloranta (upstream vendor) and shipped in the upstream release 2.9.10.7 that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10673" }, "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4. The target is version 2.9.10.7-tuxcare.3. The fix (blocking deserialization of com.caucho.config.types.ResourceRef) is present at SubTypeValidator.java:167. This fix was authored by Tatu Saloranta (upstream vendor) and shipped in the upstream release 2.9.10.7 that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4. The target repository is at version 2.9.10.7-tuxcare.3, which already contains the upstream fix. The vulnerability relates to deserialization gadgets in org.aoju.bus.proxy.provider.remoting.RmiProvider. The fix adds these class names to the SubTypeValidator blocklist, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta in commit 05d7e0e13f43e12db6a51726df12c8b4d8040676 and shipped in upstream release 2.9.10.4. Since the target is at version 2.9.10.7, the fix was already present when TuxCare onboarded this version. The blocklist entries are confirmed present in SubTypeValidator.java at lines 169-171.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10968" }, "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4. The target repository is at version 2.9.10.7-tuxcare.3, which already contains the upstream fix. The vulnerability relates to deserialization gadgets in org.aoju.bus.proxy.provider.remoting.RmiProvider. The fix adds these class names to the SubTypeValidator blocklist, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta in commit 05d7e0e13f43e12db6a51726df12c8b4d8040676 and shipped in upstream release 2.9.10.4. Since the target is at version 2.9.10.7, the fix was already present when TuxCare onboarded this version. The blocklist entries are confirmed present in SubTypeValidator.java at lines 169-171.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.9.10.7 is not affected by CVE-2020-10969. The vulnerability concerns deserialization gadget attacks via javax.swing.JEditorPane when processing JSON with polymorphic type information. The upstream fix (adding JEditorPane to the deserialization blacklist) was already present in version 2.9.10.7 when TuxCare onboarded it. The fix is located in SubTypeValidator.java at line 150, where \"javax.swing.JEditorPane\" is included in the DEFAULT_NO_DESER_CLASS_NAMES set. This blacklist is enforced by the validateSubType method, which is called on every deserialization path through BeanDeserializerFactory. Since the CVE affects versions \"before 2.9.10.4\" and the target is 2.9.10.7, the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "The target jackson-databind version 2.9.10.7 is not affected by CVE-2020-10969. The vulnerability concerns deserialization gadget attacks via javax.swing.JEditorPane when processing JSON with polymorphic type information. The upstream fix (adding JEditorPane to the deserialization blacklist) was already present in version 2.9.10.7 when TuxCare onboarded it. The fix is located in SubTypeValidator.java at line 150, where \"javax.swing.JEditorPane\" is included in the DEFAULT_NO_DESER_CLASS_NAMES set. This blacklist is enforced by the validateSubType method, which is called on every deserialization path through BeanDeserializerFactory. Since the CVE affects versions \"before 2.9.10.4\" and the target is 2.9.10.7, the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.9.10.7-tuxcare.3 is NOT AFFECTED by CVE-2020-11111. The fix for this vulnerability is already present in the codebase. The vulnerability pattern (unblocked deserialization of org.apache.activemq.* classes) has been removed by an upstream fix that shipped in jackson-databind 2.9.10.7. The SubTypeValidator.java file contains all the required activemq class blocking code (lines 173-183), preventing deserialization of dangerous ActiveMQ connection factory classes. This fix was authored by qxo (49526356@qq.com) in upstream commit 08fbfacf89, which was included in the upstream release before TuxCare onboarded version 2.9.10.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11111" }, "impact_statement": "The target repository jackson-databind version 2.9.10.7-tuxcare.3 is NOT AFFECTED by CVE-2020-11111. The fix for this vulnerability is already present in the codebase. The vulnerability pattern (unblocked deserialization of org.apache.activemq.* classes) has been removed by an upstream fix that shipped in jackson-databind 2.9.10.7. The SubTypeValidator.java file contains all the required activemq class blocking code (lines 173-183), preventing deserialization of dangerous ActiveMQ connection factory classes. This fix was authored by qxo (49526356@qq.com) in upstream commit 08fbfacf89, which was included in the upstream release before TuxCare onboarded version 2.9.10.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is not present in the target. The upstream fix that blocks deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider was already included in jackson-databind version 2.9.10.7 (the base version TuxCare onboarded). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 05d7e0e13f, which shipped before TuxCare's onboarding commit ad46f7e28. The vulnerable pattern is not present because the upstream vendor's fix was already in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11112" }, "impact_statement": "CVE-2020-11112 is not present in the target. The upstream fix that blocks deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider was already included in jackson-databind version 2.9.10.7 (the base version TuxCare onboarded). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 05d7e0e13f, which shipped before TuxCare's onboarding commit ad46f7e28. The vulnerable pattern is not present because the upstream vendor's fix was already in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (org.apache.openjpa.ee.WASRegistryManagedRuntime). The target version 2.9.10.7 is NOT vulnerable because the fix was already present in the upstream release that TuxCare onboarded. The blocklist entry for WASRegistryManagedRuntime exists at line 84 of SubTypeValidator.java, added by upstream commit e2ba12d5 (authored by tatu.saloranta@iki.fi) before TuxCare's first commit ad46f7e2 (\"Onboard version 2.9.10.7\"). This is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11113" }, "impact_statement": "CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (org.apache.openjpa.ee.WASRegistryManagedRuntime). The target version 2.9.10.7 is NOT vulnerable because the fix was already present in the upstream release that TuxCare onboarded. The blocklist entry for WASRegistryManagedRuntime exists at line 84 of SubTypeValidator.java, added by upstream commit e2ba12d5 (authored by tatu.saloranta@iki.fi) before TuxCare's first commit ad46f7e2 (\"Onboard version 2.9.10.7\"). This is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10.7-tuxcare.3 is NOT AFFECTED by CVE-2020-11619. The upstream fix (commit 113e89fb08 by Tatu Saloranta) that blocks deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean was already included in the upstream release 2.9.10.7 that TuxCare onboarded. The vulnerable classes are present in the SubTypeValidator blocklist (lines 52-54) and the validation is properly integrated into the deserialization pipeline via BeanDeserializerFactory._validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11619" }, "impact_statement": "The target jackson-databind 2.9.10.7-tuxcare.3 is NOT AFFECTED by CVE-2020-11619. The upstream fix (commit 113e89fb08 by Tatu Saloranta) that blocks deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean was already included in the upstream release 2.9.10.7 that TuxCare onboarded. The vulnerable classes are present in the SubTypeValidator blocklist (lines 52-54) and the validation is properly integrated into the deserialization pipeline via BeanDeserializerFactory._validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.9.10.7-tuxcare.3, which already contains the upstream vendor's fix. The vulnerability involves deserialization of the gadget class org.apache.commons.jelly.impl.Embedded. The fix adds this class to SubTypeValidator's blocklist (line 189), preventing its deserialization. This fix was authored by the upstream FasterXML maintainer (Tatu Saloranta) in commit 77040d85e3 and was included in the 2.9.10.7 upstream release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11620" }, "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.9.10.7-tuxcare.3, which already contains the upstream vendor's fix. The vulnerability involves deserialization of the gadget class org.apache.commons.jelly.impl.Embedded. The fix adds this class to SubTypeValidator's blocklist (line 189), preventing its deserialization. This fix was authored by the upstream FasterXML maintainer (Tatu Saloranta) in commit 77040d85e3 and was included in the 2.9.10.7 upstream release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:21:54.536967+00:00", "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to missing deserialization blocklist entries for apache/drill gadget classes. The target version 2.9.10.7-tuxcare.3 already contains the fix - the dangerous class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (SubTypeValidator.java:192). This fix was included in the upstream release 2.9.10.7 before TuxCare onboarded it, making this an upstream-provided fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14060" }, "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to missing deserialization blocklist entries for apache/drill gadget classes. The target version 2.9.10.7-tuxcare.3 already contains the fix - the dangerous class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (SubTypeValidator.java:192). This fix was included in the upstream release 2.9.10.7 before TuxCare onboarded it, making this an upstream-provided fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is NOT present in jackson-databind 2.9.10.7. The vulnerability involves deserialization gadgets using oracle.jms.* classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The fix, which adds these five classes to the deserialization blocklist in SubTypeValidator.java, was introduced by upstream maintainer Tatu Saloranta in commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e as part of jackson-databind 2.9.10.5 (released June 21, 2020). Since the target version 2.9.10.7 > 2.9.10.5, the fix was already present in the upstream release that TuxCare onboarded. The CVE explicitly states \"before 2.9.10.5\", confirming version 2.9.10.5 and later are not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14061" }, "impact_statement": "CVE-2020-14061 is NOT present in jackson-databind 2.9.10.7. The vulnerability involves deserialization gadgets using oracle.jms.* classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The fix, which adds these five classes to the deserialization blocklist in SubTypeValidator.java, was introduced by upstream maintainer Tatu Saloranta in commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e as part of jackson-databind 2.9.10.5 (released June 21, 2020). Since the target version 2.9.10.7 > 2.9.10.5, the fix was already present in the upstream release that TuxCare onboarded. The CVE explicitly states \"before 2.9.10.5\", confirming version 2.9.10.5 and later are not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:23:21.346897+00:00", "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is not present in jackson-databind 2.9.10.7. The vulnerability involves unsafe deserialization of com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool enabling JNDI injection attacks. The upstream fix (commit 840eae2c by Tatu Saloranta) added this class to the deserialization blocklist in SubTypeValidator.java and was included in upstream release 2.9.10.5. TuxCare onboarded version 2.9.10.7, which already contained this fix. The blocklist entry is present at SubTypeValidator.java:119.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14062" }, "impact_statement": "CVE-2020-14062 is not present in jackson-databind 2.9.10.7. The vulnerability involves unsafe deserialization of com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool enabling JNDI injection attacks. The upstream fix (commit 840eae2c by Tatu Saloranta) added this class to the deserialization blocklist in SubTypeValidator.java and was included in upstream release 2.9.10.5. TuxCare onboarded version 2.9.10.7, which already contained this fix. The blocklist entry is present at SubTypeValidator.java:119.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is not present in jackson-databind 2.9.10.7. The vulnerability involves deserialization of org.jsecurity.realm.jndi.JndiRealmFactory gadget class. The fix (adding this class to the deserialization blocklist) was implemented by upstream FasterXML in version 2.9.10.5 and included in the 2.9.10.7 release that TuxCare onboarded. The blocklist entry is present at SubTypeValidator.java:205, and the validateSubType method blocks deserialization of this class before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-14195" }, "impact_statement": "CVE-2020-14195 is not present in jackson-databind 2.9.10.7. The vulnerability involves deserialization of org.jsecurity.realm.jndi.JndiRealmFactory gadget class. The fix (adding this class to the deserialization blocklist) was implemented by upstream FasterXML in version 2.9.10.5 and included in the 2.9.10.7 release that TuxCare onboarded. The blocklist entry is present at SubTypeValidator.java:205, and the validateSubType method blocks deserialization of this class before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T14:22:45.297248+00:00", "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6. The target repository is version 2.9.10.7-tuxcare.3, which already contains the upstream fix. The vulnerable pattern (ability to deserialize br.com.anteros.dbcp.AnterosDBCPDataSource gadget class) is not present because the class is blocked in SubTypeValidator.java line 147. This fix was shipped in upstream release 2.9.10.7, which TuxCare onboarded as the base version. The fix commit is authored by upstream maintainer Tatu Saloranta, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24616" }, "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6. The target repository is version 2.9.10.7-tuxcare.3, which already contains the upstream fix. The vulnerable pattern (ability to deserialize br.com.anteros.dbcp.AnterosDBCPDataSource gadget class) is not present because the class is blocked in SubTypeValidator.java line 147. This fix was shipped in upstream release 2.9.10.7, which TuxCare onboarded as the base version. The fix commit is authored by upstream maintainer Tatu Saloranta, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T15:18:09.376674+00:00", "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.7 is NOT affected by CVE-2020-24750. The upstream fix (blacklisting com.pastdev.httpcomponents.configuration.JndiConfiguration) was already present in upstream release 2.9.10.7 when TuxCare onboarded it. The CVE affects versions \"before 2.9.10.6\" and the fix was included in 2.9.10.6; target version 2.9.10.7 shipped with the fix already applied by upstream author Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24750" }, "impact_statement": "Target version 2.9.10.7 is NOT affected by CVE-2020-24750. The upstream fix (blacklisting com.pastdev.httpcomponents.configuration.JndiConfiguration) was already present in upstream release 2.9.10.7 when TuxCare onboarded it. The CVE affects versions \"before 2.9.10.6\" and the fix was included in 2.9.10.6; target version 2.9.10.7 shipped with the fix already applied by upstream author Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is com.fasterxml.jackson.core:jackson-databind 2.9.10.7 \u2014 exactly the product CVE-2020-25649 concerns (Product-Identity Check passes; not false_positive). CVE-2020-25649 is an XXE flaw: Jackson's DOMDeserializer parsed attacker-supplied XML (a JSON string value bound to org.w3c.dom.Node/Document) into a DOM using a DocumentBuilderFactory that did not disable DOCTYPE/external-entity processing, allowing external entity resolution (local file read / SSRF / integrity impact). The upstream fix (issue #2589) hardens the shared DEFAULT_PARSER_FACTORY in DOMDeserializer.java. At HEAD, DOMDeserializer.java (the ONLY XML-parsing sink in the entire main source) already contains the complete fix: setExpandEntityReferences(false) (#1279), FEATURE_SECURE_PROCESSING=true, and the #2589 additions disallow-doctype-decl=true and load-external-dtd=false. disallow-doctype-decl=true makes the parser throw on any DOCTYPE, structurally eliminating entity declarations and XXE. The fix commit 3d932709abd0b5390efe67451653fc9efa9db677 is an ancestor of HEAD and of the onboard baseline, authored upstream by FasterXML (jon@jrg.me.uk / tatu.saloranta@iki.fi), not TuxCare. Because the vulnerable pattern is not present in the shipped version (upstream fix baked in), verdict is not_affected with justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "not_affected \u2014 Target is com.fasterxml.jackson.core:jackson-databind 2.9.10.7 \u2014 exactly the product CVE-2020-25649 concerns (Product-Identity Check passes; not false_positive). CVE-2020-25649 is an XXE flaw: Jackson's DOMDeserializer parsed attacker-supplied XML (a JSON string value bound to org.w3c.dom.Node/Document) into a DOM using a DocumentBuilderFactory that did not disable DOCTYPE/external-entity processing, allowing external entity resolution (local file read / SSRF / integrity impact). The upstream fix (issue #2589) hardens the shared DEFAULT_PARSER_FACTORY in DOMDeserializer.java. At HEAD, DOMDeserializer.java (the ONLY XML-parsing sink in the entire main source) already contains the complete fix: setExpandEntityReferences(false) (#1279), FEATURE_SECURE_PROCESSING=true, and the #2589 additions disallow-doctype-decl=true and load-external-dtd=false. disallow-doctype-decl=true makes the parser throw on any DOCTYPE, structurally eliminating entity declarations and XXE. The fix commit 3d932709abd0b5390efe67451653fc9efa9db677 is an ancestor of HEAD and of the onboard baseline, authored upstream by FasterXML (jon@jrg.me.uk / tatu.saloranta@iki.fi), not TuxCare. Because the vulnerable pattern is not present in the shipped version (upstream fix baked in), verdict is not_affected with justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:32.408653+00:00", "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:32.408653+00:00", "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T16:14:34.572852+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target version 2.9.10.7 is not affected by CVE-2020-8840. The fix blocking deserialization of org.apache.xbean.propertyeditor.JndiConverter was authored by upstream jackson-databind maintainer Tatu Saloranta (commit 914e7c9f2c) and shipped in upstream release 2.9.10.7, which TuxCare onboarded in commit ad46f7e284. The blocklist entry exists at SubTypeValidator.java:138, preventing JNDI injection exploitation via this gadget class. Target version 2.9.10.7 exceeds the CVE's fixed version threshold of 2.9.10.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "The target version 2.9.10.7 is not affected by CVE-2020-8840. The fix blocking deserialization of org.apache.xbean.propertyeditor.JndiConverter was authored by upstream jackson-databind maintainer Tatu Saloranta (commit 914e7c9f2c) and shipped in upstream release 2.9.10.7, which TuxCare onboarded in commit ad46f7e284. The blocklist entry exists at SubTypeValidator.java:138, preventing JNDI injection exploitation via this gadget class. Target version 2.9.10.7 exceeds the CVE's fixed version threshold of 2.9.10.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.9.10.7 is not affected by CVE-2020-9546. The fix blocking deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig was introduced in upstream version 2.9.10.4 (released 11-Apr-2020) and is present in the target version 2.9.10.7 (released 02-Dec-2020). The fix was authored by upstream maintainer Tatu Saloranta and was already in the upstream release when TuxCare onboarded version 2.9.10.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "Target jackson-databind 2.9.10.7 is not affected by CVE-2020-9546. The fix blocking deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig was introduced in upstream version 2.9.10.4 (released 11-Apr-2020) and is present in the target version 2.9.10.7 (released 02-Dec-2020). The fix was authored by upstream maintainer Tatu Saloranta and was already in the upstream release when TuxCare onboarded version 2.9.10.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T15:45:35.958455+00:00", "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is not present in jackson-databind 2.9.10.7. The vulnerability involves unsafe deserialization of the com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig gadget class. The fix blocking this class was applied in upstream version 2.9.10.4 (commit 1e64db6a2f by FasterXML maintainer Tatu Saloranta) and is present in the target at SubTypeValidator.java:144. Since version 2.9.10.7 > 2.9.10.4, the fix was already included in the upstream release that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9547" }, "impact_statement": "CVE-2020-9547 is not present in jackson-databind 2.9.10.7. The vulnerability involves unsafe deserialization of the com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig gadget class. The fix blocking this class was applied in upstream version 2.9.10.4 (commit 1e64db6a2f by FasterXML maintainer Tatu Saloranta) and is present in the target at SubTypeValidator.java:144. Since version 2.9.10.7 > 2.9.10.4, the fix was already included in the upstream release that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T16:18:43.675482+00:00", "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 does not affect this version of jackson-databind (2.9.10.7). The vulnerability involves deserialization of the malicious gadget class br.com.anteros.dbcp.AnterosDBCPConfig, which can lead to remote code execution or JNDI injection. The upstream fix that blocks this gadget class was included in jackson-databind 2.9.10.4, and this target version (2.9.10.7) already contains the complete fix in SubTypeValidator.java line 145. The fix was authored by upstream maintainer Tatu Saloranta and shipped with the upstream release before TuxCare onboarded version 2.9.10.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9548" }, "impact_statement": "CVE-2020-9548 does not affect this version of jackson-databind (2.9.10.7). The vulnerability involves deserialization of the malicious gadget class br.com.anteros.dbcp.AnterosDBCPConfig, which can lead to remote code execution or JNDI injection. The upstream fix that blocks this gadget class was included in jackson-databind 2.9.10.4, and this target version (2.9.10.7) already contains the complete fix in SubTypeValidator.java line 145. The fix was authored by upstream maintainer Tatu Saloranta and shipped with the upstream release before TuxCare onboarded version 2.9.10.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2021-20190 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" }, "action_statement": "Vulnerability CVE-2021-20190 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2022-42004 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" }, "action_statement": "Vulnerability CVE-2022-42004 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-06T18:52:00.040792+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.10.7 is NOT affected by CVE-2026-54512. This version predates the introduction of PolymorphicTypeValidator (added in 2.10.0), which is the security mechanism containing the vulnerability. The vulnerable method `_resolveAndValidateGeneric()` does not exist in this version. While the target does process polymorphic type identifiers with generic parameters via `resolveSubType()`, the specific attack goal\u2014bypassing a configured PolymorphicTypeValidator allowlist\u2014cannot be reached because PolymorphicTypeValidator does not exist in this version. Only blacklist-based validation exists via SubTypeValidator.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.9.10.7 is NOT affected by CVE-2026-54512. This version predates the introduction of PolymorphicTypeValidator (added in 2.10.0), which is the security mechanism containing the vulnerability. The vulnerable method `_resolveAndValidateGeneric()` does not exist in this version. While the target does process polymorphic type identifiers with generic parameters via `resolveSubType()`, the specific attack goal\u2014bypassing a configured PolymorphicTypeValidator allowlist\u2014cannot be reached because PolymorphicTypeValidator does not exist in this version. Only blacklist-based validation exists via SubTypeValidator." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-29T00:12:47.728703+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-30T12:55:12.779940+00:00", "status_notes": "Vulnerability CVE-2026-54515 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.3.", "vulnerability": { "name": "CVE-2026-54515" }, "action_statement": "Vulnerability CVE-2026-54515 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-09T13:37:30.818436+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.5.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-05T09:55:18.164328+00:00", "status_notes": "Vulnerability CVE-2026-54518 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.4.", "vulnerability": { "name": "CVE-2026-54518" }, "action_statement": "Vulnerability CVE-2026-54518 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-03T01:48:41.134828+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.9.10.7 is NOT AFFECTED by CVE-2026-59888. The vulnerability requires Java Record support, which does not exist in this version. The target targets Java 1.7 (predates Java Records introduced in JDK 16/17), has no Record-handling code, and was released well before Records existed. In 2.9.10.7, properties with only @JsonIgnore (no @JsonProperty) are removed from the property map b...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 Target version 2.9.10.7 is NOT AFFECTED by CVE-2026-59888. The vulnerability requires Java Record support, which does not exist in this version. The target targets Java 1.7 (predates Java Records introduced in JDK 16/17), has no Record-handling code, and was released well before Records existed. In 2.9.10.7, properties with only @JsonIgnore (no @JsonProperty) are removed from the property map b..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-30T12:55:35.178644+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.3.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-11-05T09:55:18.164328+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.4.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-30T12:55:35.178644+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.3.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-30T12:55:35.178644+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.3.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.7-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-28T11:06:10.427533+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.10.7-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.10.7-tuxcare.2.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }