{ "@id": "urn:uuid:023d7172-3f16-4f87-affa-5ae5a23d9370", "role": "Document Creator", "author": "https://tuxcare.com", "version": 5, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T13:06:00.255850+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2017-15095 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2017-15095" }, "action_statement": "Vulnerability CVE-2017-15095 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2017-17485 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2017-17485" }, "action_statement": "Vulnerability CVE-2017-17485 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.9.3 is not affected by CVE-2017-7525. The vulnerability was fixed in upstream version 2.8.9 (April 2017) by commit 60d459cedc authored by upstream maintainer Tatu Saloranta. This fix was already included in the upstream 2.9.0 release (July 2017), well before the 2.9.3 release (December 2017). The fix adds blacklist validation in BeanDeserializerFactory that prevents deserialization of dangerous classes known to enable arbitrary code execution via polymorphic deserialization. When TuxCare onboarded version 2.9.3 (commit ec839404df by amoniatovskiy@cloudlinux.com), the fix was already present in the upstream codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "The target jackson-databind version 2.9.3 is not affected by CVE-2017-7525. The vulnerability was fixed in upstream version 2.8.9 (April 2017) by commit 60d459cedc authored by upstream maintainer Tatu Saloranta. This fix was already included in the upstream 2.9.0 release (July 2017), well before the 2.9.3 release (December 2017). The fix adds blacklist validation in BeanDeserializerFactory that prevents deserialization of dangerous classes known to enable arbitrary code execution via polymorphic deserialization. When TuxCare onboarded version 2.9.3 (commit ec839404df by amoniatovskiy@cloudlinux.com), the fix was already present in the upstream codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2018-11307 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-11307" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-12T13:06:00.255850+00:00", "status_notes": "Vulnerability CVE-2018-12022 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10.", "vulnerability": { "name": "CVE-2018-12022" }, "action_statement": "Vulnerability CVE-2018-12022 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-12T13:06:00.255850+00:00", "status_notes": "Vulnerability CVE-2018-12023 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10.", "vulnerability": { "name": "CVE-2018-12023" }, "action_statement": "Vulnerability CVE-2018-12023 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2018-14718 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14718" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2018-14719 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14719" }, "action_statement": "Vulnerability CVE-2018-14719 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2018-14720 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14720" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2018-14721 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14721" }, "action_statement": "Vulnerability CVE-2018-14721 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-12T13:06:00.255850+00:00", "status_notes": "Vulnerability CVE-2018-19360 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10.", "vulnerability": { "name": "CVE-2018-19360" }, "action_statement": "Vulnerability CVE-2018-19360 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-12T13:06:00.255850+00:00", "status_notes": "Vulnerability CVE-2018-19361 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10.", "vulnerability": { "name": "CVE-2018-19361" }, "action_statement": "Vulnerability CVE-2018-19361 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2018-19362 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19362" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2018-5968 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-5968" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2018-7489 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-7489" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2019-12086 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12086" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2019-12384 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12384" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-12T13:06:00.255850+00:00", "status_notes": "Vulnerability CVE-2019-12814 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10.", "vulnerability": { "name": "CVE-2019-12814" }, "action_statement": "Vulnerability CVE-2019-12814 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2019-14379 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14379" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2019-14439 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14439" }, "action_statement": "Vulnerability CVE-2019-14439 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T18:14:55.256701+00:00", "status_notes": "Vulnerability CVE-2019-14540 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.9.", "vulnerability": { "name": "CVE-2019-14540" }, "action_statement": "Vulnerability CVE-2019-14540 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2019-14892 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14892" }, "action_statement": "Vulnerability CVE-2019-14892 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-12T13:06:00.255850+00:00", "status_notes": "Vulnerability CVE-2019-14893 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10.", "vulnerability": { "name": "CVE-2019-14893" }, "action_statement": "Vulnerability CVE-2019-14893 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2019-16335 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16335" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2019-16942 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16942" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2019-16943 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16943" }, "action_statement": "Vulnerability CVE-2019-16943 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2019-17267 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17267" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2019-17531 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17531" }, "action_statement": "Vulnerability CVE-2019-17531 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2019-20330 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-20330" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-10650 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10650" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:29:00.034482+00:00", "status_notes": "Vulnerability CVE-2020-10672 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10672" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-10673 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10673" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-10969 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10969" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-11111 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11111" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-11112 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11112" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-11113 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11113" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-11619 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11619" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T18:14:47.066751+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.9.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.9." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-14061 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-14062 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-14195 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14195" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:29:00.034482+00:00", "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-36180 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-12T13:06:00.255850+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-12T13:06:00.255850+00:00", "status_notes": "Vulnerability CVE-2020-36183 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10.", "vulnerability": { "name": "CVE-2020-36183" }, "action_statement": "Vulnerability CVE-2020-36183 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-8840 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-8840" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-12T13:06:00.255850+00:00", "status_notes": "Vulnerability CVE-2020-9546 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10.", "vulnerability": { "name": "CVE-2020-9546" }, "action_statement": "Vulnerability CVE-2020-9546 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.3-tuxcare.10." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-9547 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9547" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2021-20190 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-19032 does not affect version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 jackson-databind version 2.9.3 is NOT affected by CVE-2026-19032. The vulnerability requires ServiceLoader enumeration of FileSystemProvider instances, which was introduced in version 2.9.7/2.10.0 via issue #2120 (commit 9ee894c06, September 2018). Version 2.9.3 (December 2017) has a simple implementation that only calls Paths.get(uri) without any FileSystemNotFoundException handling or Service...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-19032" }, "impact_statement": "not_affected \u2014 jackson-databind version 2.9.3 is NOT affected by CVE-2026-19032. The vulnerability requires ServiceLoader enumeration of FileSystemProvider instances, which was introduced in version 2.9.7/2.10.0 via issue #2120 (commit 9ee894c06, September 2018). Version 2.9.3 (December 2017) has a simple implementation that only calls Paths.get(uri) without any FileSystemNotFoundException handling or Service..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.3 is NOT affected by CVE-2026-54512. This vulnerability specifically concerns bypassing PolymorphicTypeValidator (PTV) by smuggling denied classes as generic type parameters. PTV was introduced in April 2019 (commit 1135b2c1d) and first shipped in version 2.10.0 (September 2019). Version 2.9.3 predates PTV entirely\u2014the architectural component being bypassed does not exist. The CVE's stated range \"from 2.10.0\" correctly identifies when PTV was introduced. While 2.9.3 lacks security controls for polymorphic deserialization, the specific PTV-bypass vulnerability cannot manifest without PTV present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.9.3 is NOT affected by CVE-2026-54512. This vulnerability specifically concerns bypassing PolymorphicTypeValidator (PTV) by smuggling denied classes as generic type parameters. PTV was introduced in April 2019 (commit 1135b2c1d) and first shipped in version 2.10.0 (September 2019). Version 2.9.3 predates PTV entirely\u2014the architectural component being bypassed does not exist. The CVE's stated range \"from 2.10.0\" correctly identifies when PTV was introduced. While 2.9.3 lacks security controls for polymorphic deserialization, the specific PTV-bypass vulnerability cannot manifest without PTV present." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54517 affects jackson-databind versions 2.21.0-2.21.3 and 3.0.0-3.1.3 where setterless properties with @JsonView restrictions bypass view checks during property-based creator deserialization. Version 2.9.3 is not affected because: (1) the isMerging() mechanism that routes setterless properties through the vulnerable buffering path does not exist in 2.9.3; (2) SetterlessProperty.set() t...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54517" }, "impact_statement": "not_affected \u2014 CVE-2026-54517 affects jackson-databind versions 2.21.0-2.21.3 and 3.0.0-3.1.3 where setterless properties with @JsonView restrictions bypass view checks during property-based creator deserialization. Version 2.9.3 is not affected because: (1) the isMerging() mechanism that routes setterless properties through the vulnerable buffering path does not exist in 2.9.3; (2) SetterlessProperty.set() t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.3 is NOT AFFECTED by CVE-2026-54518. The vulnerability requires the processUnwrappedCreatorProperties() method in UnwrappedPropertyHandler, which does not exist in this version. The feature enabling the vulnerability (@JsonUnwrapped with @JsonCreator) was added in commit 502fe888da (Nov 2024) for versions 2.19.0+. Version 2.9.3 explicitly rejects this combination with InvalidDefinit...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Version 2.9.3 is NOT AFFECTED by CVE-2026-54518. The vulnerability requires the processUnwrappedCreatorProperties() method in UnwrappedPropertyHandler, which does not exist in this version. The feature enabling the vulnerability (@JsonUnwrapped with @JsonCreator) was added in commit 502fe888da (Nov 2024) for versions 2.19.0+. Version 2.9.3 explicitly rejects this combination with InvalidDefinit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target jackson-databind 2.9.3 does not support Java Records, which were introduced in Java 16 (2021), four years after this version was released (2017). The CVE-2026-59888 vulnerability is specific to Record deserialization with PropertyNamingStrategy, where @JsonIgnore annotations can be bypassed. POJOs in 2.9.3 follow a different processing path where ignored properties are removed before pro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 Target jackson-databind 2.9.3 does not support Java Records, which were introduced in Java 16 (2021), four years after this version was released (2017). The CVE-2026-59888 vulnerability is specific to Record deserialization with PropertyNamingStrategy, where @JsonIgnore annotations can be bypassed. POJOs in 2.9.3 follow a different processing path where ignored properties are removed before pro..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.3-tuxcare.8 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3-tuxcare.8" } } ], "timestamp": "2026-11-10T11:28:42.309979+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.3-tuxcare.8.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }