{ "@id": "urn:uuid:200cf70e-e6df-4228-b355-c0b1f4cb2b19", "role": "Document Creator", "author": "https://tuxcare.com", "version": 11, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T13:05:00.100065+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.9.4-tuxcare.3 is NOT AFFECTED by CVE-2017-15095. The CVE explicitly states that versions \"prior to 2.8.11 and 2.9.4\" are vulnerable, meaning 2.9.4 is the first fixed version. The upstream FasterXML vendor included comprehensive blacklist fixes for CVE-2017-15095 (databind#1737) in the 2.9.4 release before TuxCare onboarded it. The fix commit ddfddfba6414adbecaff99684ef66eebd3a92e92 by upstream maintainer Tatu Saloranta was already present in the upstream jackson-databind-2.9.4 tag. SubTypeValidator.java contains all required blacklist entries including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and Spring/C3P0 classes, plus sophisticated hierarchy checks for Spring framework types. The vulnerable deserialization pattern (missing blacklist protections) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "Target jackson-databind 2.9.4-tuxcare.3 is NOT AFFECTED by CVE-2017-15095. The CVE explicitly states that versions \"prior to 2.8.11 and 2.9.4\" are vulnerable, meaning 2.9.4 is the first fixed version. The upstream FasterXML vendor included comprehensive blacklist fixes for CVE-2017-15095 (databind#1737) in the 2.9.4 release before TuxCare onboarded it. The fix commit ddfddfba6414adbecaff99684ef66eebd3a92e92 by upstream maintainer Tatu Saloranta was already present in the upstream jackson-databind-2.9.4 tag. SubTypeValidator.java contains all required blacklist entries including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and Spring/C3P0 classes, plus sophisticated hierarchy checks for Spring framework types. The vulnerable deserialization pattern (missing blacklist protections) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.9.3. The target is version 2.9.4, which already contains the upstream fix. The vulnerability involved an incomplete blacklist for polymorphic deserialization that failed to block dangerous Spring framework classes. The fix (commit 2235894210c75f624a3d0cd60bfb0434a20a18bf by upstream maintainer Tatu Saloranta) introduced SubTypeValidator with hierarchical superclass checking for Spring types. This fix was present in the upstream 2.9.4 release that TuxCare onboarded (commit afd958fd8f8e34d9f01a4e3fb2508c5cb8d45033), confirmed by merge-base ancestry check. The vulnerable pattern (missing Spring framework validation) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.9.3. The target is version 2.9.4, which already contains the upstream fix. The vulnerability involved an incomplete blacklist for polymorphic deserialization that failed to block dangerous Spring framework classes. The fix (commit 2235894210c75f624a3d0cd60bfb0434a20a18bf by upstream maintainer Tatu Saloranta) introduced SubTypeValidator with hierarchical superclass checking for Spring types. This fix was present in the upstream 2.9.4 release that TuxCare onboarded (commit afd958fd8f8e34d9f01a4e3fb2508c5cb8d45033), confirmed by merge-base ancestry check. The vulnerable pattern (missing Spring framework validation) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.4-tuxcare.3 is not affected by CVE-2017-7525. This deserialization vulnerability allows code execution through maliciously crafted JSON input containing dangerous class names. The fix\u2014a blacklist validation mechanism in SubTypeValidator.java that blocks deserialization of known exploit classes\u2014was already present in the upstream 2.9.4 release when TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream version 2.9.4 (released well after the CVE's affected version range: before 2.6.7.1, 2.7.9.1, and 2.8.9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "The target jackson-databind 2.9.4-tuxcare.3 is not affected by CVE-2017-7525. This deserialization vulnerability allows code execution through maliciously crafted JSON input containing dangerous class names. The fix\u2014a blacklist validation mechanism in SubTypeValidator.java that blocks deserialization of known exploit classes\u2014was already present in the upstream 2.9.4 release when TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream version 2.9.4 (released well after the CVE's affected version range: before 2.6.7.1, 2.7.9.1, and 2.8.9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2018-11307 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-11307" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-12T13:05:00.100065+00:00", "status_notes": "Vulnerability CVE-2018-12022 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8.", "vulnerability": { "name": "CVE-2018-12022" }, "action_statement": "Vulnerability CVE-2018-12022 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-12T13:05:00.100065+00:00", "status_notes": "Vulnerability CVE-2018-12023 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8.", "vulnerability": { "name": "CVE-2018-12023" }, "action_statement": "Vulnerability CVE-2018-12023 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:03:00.063750+00:00", "status_notes": "Vulnerability CVE-2018-14718 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14718" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2018-14719 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14719" }, "action_statement": "Vulnerability CVE-2018-14719 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-12T13:04:00.106737+00:00", "status_notes": "Vulnerability CVE-2018-14720 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8.", "vulnerability": { "name": "CVE-2018-14720" }, "action_statement": "Vulnerability CVE-2018-14720 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2018-14721 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14721" }, "action_statement": "Vulnerability CVE-2018-14721 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-12T13:04:00.106737+00:00", "status_notes": "Vulnerability CVE-2018-19360 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8.", "vulnerability": { "name": "CVE-2018-19360" }, "action_statement": "Vulnerability CVE-2018-19360 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-12T13:05:00.100065+00:00", "status_notes": "Vulnerability CVE-2018-19361 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8.", "vulnerability": { "name": "CVE-2018-19361" }, "action_statement": "Vulnerability CVE-2018-19361 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:04:41.517753+00:00", "status_notes": "Vulnerability CVE-2018-19362 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19362" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The target repository is at version 2.9.4-tuxcare.4, which already contains the upstream vendor fix (commit 038b471e2e by tatu.saloranta@iki.fi) that adds these two gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was included in the upstream 2.9.4 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The target repository is at version 2.9.4-tuxcare.4, which already contains the upstream vendor fix (commit 038b471e2e by tatu.saloranta@iki.fi) that adds these two gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was included in the upstream 2.9.4 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2018-7489 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-7489" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:04:00.219574+00:00", "status_notes": "Vulnerability CVE-2019-12086 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12086" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:04:41.517753+00:00", "status_notes": "Vulnerability CVE-2019-12384 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12384" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2019-12814 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12814" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2019-14379 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14379" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2019-14439 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14439" }, "action_statement": "Vulnerability CVE-2019-14439 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2019-14540 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14540" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2019-14892 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14892" }, "action_statement": "Vulnerability CVE-2019-14892 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-12T13:04:00.106737+00:00", "status_notes": "Vulnerability CVE-2019-14893 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8.", "vulnerability": { "name": "CVE-2019-14893" }, "action_statement": "Vulnerability CVE-2019-14893 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-12T13:05:00.100065+00:00", "status_notes": "Vulnerability CVE-2019-16335 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8.", "vulnerability": { "name": "CVE-2019-16335" }, "action_statement": "Vulnerability CVE-2019-16335 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:05:21.376666+00:00", "status_notes": "Vulnerability CVE-2019-16942 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16942" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2019-16943 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16943" }, "action_statement": "Vulnerability CVE-2019-16943 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-10T11:19:43.767729+00:00", "status_notes": "Vulnerability CVE-2019-17267 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.7.", "vulnerability": { "name": "CVE-2019-17267" }, "action_statement": "Vulnerability CVE-2019-17267 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2019-17531 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17531" }, "action_statement": "Vulnerability CVE-2019-17531 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:04:41.517753+00:00", "status_notes": "Vulnerability CVE-2019-20330 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-20330" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:03:15.933463+00:00", "status_notes": "Vulnerability CVE-2020-10650 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10650" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-10T11:19:43.767729+00:00", "status_notes": "Vulnerability CVE-2020-10672 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.7.", "vulnerability": { "name": "CVE-2020-10672" }, "action_statement": "Vulnerability CVE-2020-10672 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.7." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:03:00.063750+00:00", "status_notes": "Vulnerability CVE-2020-10673 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10673" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:03:52.222695+00:00", "status_notes": "Vulnerability CVE-2020-10969 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10969" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:03:52.222695+00:00", "status_notes": "Vulnerability CVE-2020-11111 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11111" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:03:52.222695+00:00", "status_notes": "Vulnerability CVE-2020-11112 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11112" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:03:15.933463+00:00", "status_notes": "Vulnerability CVE-2020-11113 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11113" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:02:32.344159+00:00", "status_notes": "Vulnerability CVE-2020-11619 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11619" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-10T11:19:43.767729+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.7.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.7." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-14061 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-14062 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:03:00.063750+00:00", "status_notes": "Vulnerability CVE-2020-14195 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14195" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:03:52.222695+00:00", "status_notes": "Vulnerability CVE-2020-36181 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:04:41.517753+00:00", "status_notes": "Vulnerability CVE-2020-8840 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-8840" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-12T13:05:00.100065+00:00", "status_notes": "Vulnerability CVE-2020-9546 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8.", "vulnerability": { "name": "CVE-2020-9546" }, "action_statement": "Vulnerability CVE-2020-9546 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.8." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:04:41.517753+00:00", "status_notes": "Vulnerability CVE-2020-9547 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9547" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-10T11:19:43.767729+00:00", "status_notes": "Vulnerability CVE-2021-20190 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.7.", "vulnerability": { "name": "CVE-2021-20190" }, "action_statement": "Vulnerability CVE-2021-20190 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.4-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-54512 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54512" }, "action_statement": "Vulnerability CVE-2026-54512 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:05:21.376666+00:00", "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.4-tuxcare.4 is NOT AFFECTED by CVE-2026-54518. The vulnerability requires @JsonUnwrapped annotation on @JsonCreator parameters, a feature combination that is explicitly NOT supported in version 2.9.4 (throws InvalidDefinitionException per issue #265). This feature was only added in version 2.21.0 (commit 502fe888da, Nov 2024), and the CVE's affected version range explicitly starts a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Version 2.9.4-tuxcare.4 is NOT AFFECTED by CVE-2026-54518. The vulnerability requires @JsonUnwrapped annotation on @JsonCreator parameters, a feature combination that is explicitly NOT supported in version 2.9.4 (throws InvalidDefinitionException per issue #265). This feature was only added in version 2.21.0 (commit 502fe888da, Nov 2024), and the CVE's affected version range explicitly starts a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.4 is not affected by CVE-2026-59888. This vulnerability is specific to Java Record deserialization with @JsonIgnore annotations and PropertyNamingStrategy. Java Records were introduced in Java 14 (2020) and finalized in Java 16 (2021). Version 2.9.4 was released in January 2018 with Java 1.7 target compatibility and does not support Java Records. The Input type (Record component des...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 Version 2.9.4 is not affected by CVE-2026-59888. This vulnerability is specific to Java Record deserialization with @JsonIgnore annotations and PropertyNamingStrategy. Java Records were introduced in Java 14 (2020) and finalized in Java 16 (2021). Version 2.9.4 was released in January 2018 with Java 1.7 target compatibility and does not support Java Records. The Input type (Record component des..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.4-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4-tuxcare.6" } } ], "timestamp": "2026-11-09T13:00:52.856738+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.4-tuxcare.6.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }