{ "@id": "urn:uuid:577f14e8-3d65-4114-843e-52008e0af363", "role": "Document Creator", "author": "https://tuxcare.com", "version": 43, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T10:52:00.051324+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T13:06:45.482707+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.9.8 is not affected by CVE-2017-15095. The vulnerability was fixed in upstream versions 2.8.11 and 2.9.4 by introducing SubTypeValidator with a comprehensive blacklist of dangerous deserialization gadget classes. Since the target is version 2.9.8 (released after 2.9.4), it already contained the fix when TuxCare onboarded it. The fix commit (2235894210c by Tatu Saloranta, Dec 18 2017) is an ancestor of the TuxCare onboarding commit (be66907a443b), confirming the fix was in the upstream release. All blacklist entries from the CVE-2017-15095 patches are present in SubTypeValidator.java and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "Target jackson-databind version 2.9.8 is not affected by CVE-2017-15095. The vulnerability was fixed in upstream versions 2.8.11 and 2.9.4 by introducing SubTypeValidator with a comprehensive blacklist of dangerous deserialization gadget classes. Since the target is version 2.9.8 (released after 2.9.4), it already contained the fix when TuxCare onboarded it. The fix commit (2235894210c by Tatu Saloranta, Dec 18 2017) is an ancestor of the TuxCare onboarding commit (be66907a443b), confirming the fix was in the upstream release. All blacklist entries from the CVE-2017-15095 patches are present in SubTypeValidator.java and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T15:42:13.542842+00:00", "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind 2.9.x through 2.9.3 via incomplete deserialization blacklist bypassed by Spring gadget classes. Target version 2.9.8-tuxcare.3 contains complete fix in SubTypeValidator.java with all required blacklist entries (databind#1737: FileHandler, UnicastRemoteObject, PropertyPathFactoryBean; databind#1855: BasicDataSource, ClassLoader) and Spring pattern blocking (AbstractPointcutAdvisor, AbstractApplicationContext). Fix committed 2017-12-18 by upstream maintainer Tatu Saloranta (commit 2235894210) and shipped in upstream 2.9.8 release before TuxCare onboarding (be66907a44, 2026-09-10). Validation is mandatory via BeanDeserializerFactory._validateSubType() line 135, cannot be disabled. Vulnerable pattern not present due to upstream vendor fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-17485" }, "impact_statement": "CVE-2017-17485 affects jackson-databind 2.9.x through 2.9.3 via incomplete deserialization blacklist bypassed by Spring gadget classes. Target version 2.9.8-tuxcare.3 contains complete fix in SubTypeValidator.java with all required blacklist entries (databind#1737: FileHandler, UnicastRemoteObject, PropertyPathFactoryBean; databind#1855: BasicDataSource, ClassLoader) and Spring pattern blocking (AbstractPointcutAdvisor, AbstractApplicationContext). Fix committed 2017-12-18 by upstream maintainer Tatu Saloranta (commit 2235894210) and shipped in upstream 2.9.8 release before TuxCare onboarding (be66907a44, 2026-09-10). Validation is mandatory via BeanDeserializerFactory._validateSubType() line 135, cannot be disabled. Vulnerable pattern not present due to upstream vendor fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T14:25:56.437477+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target version 2.9.8-tuxcare.3 is newer than 2.8.9 and already contains the upstream fix. The fix introduces SubTypeValidator with a blacklist of dangerous classes (including TemplatesImpl variants) and validates types before deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.8 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target version 2.9.8-tuxcare.3 is newer than 2.8.9 and already contains the upstream fix. The fix introduces SubTypeValidator with a blacklist of dangerous classes (including TemplatesImpl variants) and validates types before deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.8 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T13:15:34.961054+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.9.8-tuxcare.3. The vulnerability involves deserialization of the malicious iBatis gadget class \"org.apache.ibatis.parsing.XPathParser\" via Jackson's default typing, which can lead to data exfiltration. The fix (adding this class to the blacklist in SubTypeValidator.java) was authored by upstream developer Tatu Saloranta in commit 27b4defc270454dea6842bd9279f17387eceb737 and was already present in the upstream 2.9.8 release that TuxCare onboarded. Since the CVE states the vulnerability was fixed in 2.9.6 and the target version is 2.9.8, the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.9.8-tuxcare.3. The vulnerability involves deserialization of the malicious iBatis gadget class \"org.apache.ibatis.parsing.XPathParser\" via Jackson's default typing, which can lead to data exfiltration. The fix (adding this class to the blacklist in SubTypeValidator.java) was authored by upstream developer Tatu Saloranta in commit 27b4defc270454dea6842bd9279f17387eceb737 and was already present in the upstream 2.9.8 release that TuxCare onboarded. Since the CVE states the vulnerability was fixed in 2.9.6 and the target version is 2.9.8, the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T17:17:09.184138+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.9.8-tuxcare.4 is NOT AFFECTED by CVE-2018-12022. The vulnerability (polymorphic deserialization of Jodd-db gadget class enabling LDAP-based code execution) was fixed in upstream version 2.9.6. The target's 2.9.8 release already contains the upstream fix (commit 28badf7ef6), which blacklists jodd.db.connection.DataSourceConnectionProvider in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was present in the upstream 2.9.8 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "The target jackson-databind version 2.9.8-tuxcare.4 is NOT AFFECTED by CVE-2018-12022. The vulnerability (polymorphic deserialization of Jodd-db gadget class enabling LDAP-based code execution) was fixed in upstream version 2.9.6. The target's 2.9.8 release already contains the upstream fix (commit 28badf7ef6), which blacklists jodd.db.connection.DataSourceConnectionProvider in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was present in the upstream 2.9.8 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T16:18:43.675482+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind versions prior to 2.9.6. The target repository is version 2.9.8-tuxcare.4, which already contains the upstream fix. The vulnerability involves polymorphic deserialization of Oracle JDBC and Jodd-db classes that allow JNDI/LDAP injection. The fix (blacklisting these dangerous classes in SubTypeValidator) was introduced by upstream commit 7487cf7eb1 and merged into the 2.9 branch via bf261d404c, both authored by Tatu Saloranta. This fix was part of the upstream 2.9.6+ releases and was already present when TuxCare onboarded version 2.9.8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "CVE-2018-12023 affects jackson-databind versions prior to 2.9.6. The target repository is version 2.9.8-tuxcare.4, which already contains the upstream fix. The vulnerability involves polymorphic deserialization of Oracle JDBC and Jodd-db classes that allow JNDI/LDAP injection. The fix (blacklisting these dangerous classes in SubTypeValidator) was introduced by upstream commit 7487cf7eb1 and merged into the 2.9 branch via bf261d404c, both authored by Tatu Saloranta. This fix was part of the upstream 2.9.6+ releases and was already present when TuxCare onboarded version 2.9.8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T13:45:27.906732+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is not affecting this target. The vulnerability involves polymorphic deserialization of the slf4j-ext class org.slf4j.ext.EventData that could lead to arbitrary code execution. The upstream fix blocking this class was already present in jackson-databind 2.9.8 when TuxCare onboarded it. The fix commit 87d29af25e by Tatu Saloranta (upstream maintainer) added org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its instantiation during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is not affecting this target. The vulnerability involves polymorphic deserialization of the slf4j-ext class org.slf4j.ext.EventData that could lead to arbitrary code execution. The upstream fix blocking this class was already present in jackson-databind 2.9.8 when TuxCare onboarded it. The fix commit 87d29af25e by Tatu Saloranta (upstream maintainer) added org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its instantiation during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T15:58:22.317135+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.8-tuxcare.4 is not vulnerable to CVE-2018-14719. The fix blocking blaze-ds classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes) from polymorphic deserialization was already present in the upstream 2.9.8 release that TuxCare onboarded. The dangerous classes are blacklisted in SubTypeValidator.java (lines 72-75) and actively checked during deserialization via BeanDeserializerFactory._validateSubType() calling SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "The target jackson-databind 2.9.8-tuxcare.4 is not vulnerable to CVE-2018-14719. The fix blocking blaze-ds classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes) from polymorphic deserialization was already present in the upstream 2.9.8 release that TuxCare onboarded. The dangerous classes are blacklisted in SubTypeValidator.java (lines 72-75) and actively checked during deserialization via BeanDeserializerFactory._validateSubType() calling SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T14:06:34.485186+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.8-tuxcare.3 is NOT AFFECTED by CVE-2018-14720. The vulnerability involves polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that can enable XXE attacks or RCE. The fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream jackson-databind 2.9.8 release that TuxCare onboarded. The four dangerous classes are blocked in SubTypeValidator.java (lines 72-75), and the validation is unconditionally invoked on all bean deserialization paths through BeanDeserializerFactory._validateSubType. No configuration can disable this protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "The target jackson-databind 2.9.8-tuxcare.3 is NOT AFFECTED by CVE-2018-14720. The vulnerability involves polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that can enable XXE attacks or RCE. The fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream jackson-databind 2.9.8 release that TuxCare onboarded. The four dangerous classes are blocked in SubTypeValidator.java (lines 72-75), and the validation is unconditionally invoked on all bean deserialization paths through BeanDeserializerFactory._validateSubType. No configuration can disable this protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T14:34:24.934920+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.8-tuxcare.3) is NOT affected by CVE-2018-14721. The upstream fix (commit 87d29af25e) that adds org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the deserialization blacklist was already present in the upstream 2.9.8 release that TuxCare onboarded. The fix is located in SubTypeValidator.java lines 71-75, where all four classes from the upstream patch (including the axis2-jaxws class) are blocked from polymorphic deserialization. The validation mechanism is actively enforced via BeanDeserializerFactory._validateSubType() at line 135, making SSRF attacks via this class impossible.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "The target repository (jackson-databind 2.9.8-tuxcare.3) is NOT affected by CVE-2018-14721. The upstream fix (commit 87d29af25e) that adds org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the deserialization blacklist was already present in the upstream 2.9.8 release that TuxCare onboarded. The fix is located in SubTypeValidator.java lines 71-75, where all four classes from the upstream patch (including the axis2-jaxws class) are blocked from polymorphic deserialization. The validation mechanism is actively enforced via BeanDeserializerFactory._validateSubType() at line 135, making SSRF attacks via this class impossible.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T12:43:54.437566+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.8-tuxcare.3) is NOT affected by CVE-2018-19360. The vulnerability pattern (missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo) is not present because the upstream fix was already included in version 2.9.8, which is the base version that TuxCare onboarded. The fix commit 72cd4025a2 by upstream maintainer Tatu Saloranta adds the dangerous class to the deserialization blocklist in SubTypeValidator.java, preventing polymorphic deserialization attacks. This fix shipped in the upstream 2.9.8 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "The target repository (jackson-databind 2.9.8-tuxcare.3) is NOT affected by CVE-2018-19360. The vulnerability pattern (missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo) is not present because the upstream fix was already included in version 2.9.8, which is the base version that TuxCare onboarded. The fix commit 72cd4025a2 by upstream maintainer Tatu Saloranta adds the dangerous class to the deserialization blocklist in SubTypeValidator.java, preventing polymorphic deserialization attacks. This fix shipped in the upstream 2.9.8 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T16:54:53.626272+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.9.8 is NOT affected by CVE-2018-19361. The vulnerability involves polymorphic deserialization of OpenJPA runtime classes that could lead to arbitrary code execution. The fix (commit 72cd4025a2) that adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the SubTypeValidator blocklist was already present in the upstream version 2.9.8 that TuxCare onboarded. The blocklist entries are confirmed present in the target at lines 79-80 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "The target repository jackson-databind version 2.9.8 is NOT affected by CVE-2018-19361. The vulnerability involves polymorphic deserialization of OpenJPA runtime classes that could lead to arbitrary code execution. The fix (commit 72cd4025a2) that adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the SubTypeValidator blocklist was already present in the upstream version 2.9.8 that TuxCare onboarded. The blocklist entries are confirmed present in the target at lines 79-80 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T15:24:04.222754+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.9.8-tuxcare.3 is NOT AFFECTED by CVE-2018-19362. The upstream fix blocking jboss-common-core deserialization gadgets (org.jboss.util.propertyeditor.DocumentEditor and related classes) was already present in the upstream 2.9.8 release. The fix commit 72cd4025a2 by Tatu Saloranta added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at lines 77-81, and this commit shipped in the upstream release before TuxCare's onboarding. The SubTypeValidator is actively enforced during bean deserialization via BeanDeserializerFactory, making the vulnerability pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "Target jackson-databind 2.9.8-tuxcare.3 is NOT AFFECTED by CVE-2018-19362. The upstream fix blocking jboss-common-core deserialization gadgets (org.jboss.util.propertyeditor.DocumentEditor and related classes) was already present in the upstream 2.9.8 release. The fix commit 72cd4025a2 by Tatu Saloranta added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at lines 77-81, and this commit shipped in the upstream release before TuxCare's onboarding. The SubTypeValidator is actively enforced during bean deserialization via BeanDeserializerFactory, making the vulnerability pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.8 is not affected by CVE-2018-5968. The upstream vendor (FasterXML) fix that adds the two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to the deserialization blacklist was already present in the upstream 2.9.8 release before TuxCare onboarded it. The vulnerable pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "Target version 2.9.8 is not affected by CVE-2018-5968. The upstream vendor (FasterXML) fix that adds the two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to the deserialization blacklist was already present in the upstream 2.9.8 release before TuxCare onboarded it. The vulnerable pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T13:41:04.560309+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 fix is present in target jackson-databind 2.9.8-tuxcare.3. The vulnerability allowed RCE via deserialization of c3p0 gadget classes. The fix adds validation in SubTypeValidator.java (lines 185-194) that blocks deserialization of classes matching package prefix \"com.mchange.v2.c3p0.\" combined with suffix \"DataSource\". This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.5 (Feb 2018). The target version 2.9.8 (released later) already contains this upstream fix. The vulnerable pattern is not present in the target because the defense code was included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 fix is present in target jackson-databind 2.9.8-tuxcare.3. The vulnerability allowed RCE via deserialization of c3p0 gadget classes. The fix adds validation in SubTypeValidator.java (lines 185-194) that blocks deserialization of classes matching package prefix \"com.mchange.v2.c3p0.\" combined with suffix \"DataSource\". This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.5 (Feb 2018). The target version 2.9.8 (released later) already contains this upstream fix. The vulnerable pattern is not present in the target because the defense code was included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-02T09:37:00.118269+00:00", "status_notes": "Vulnerability CVE-2019-12086 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.4.", "vulnerability": { "name": "CVE-2019-12086" }, "action_statement": "Vulnerability CVE-2019-12086 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:57:00.074942+00:00", "status_notes": "Vulnerability CVE-2019-12384 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2019-12384" }, "action_statement": "Vulnerability CVE-2019-12384 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:57:25.997738+00:00", "status_notes": "Vulnerability CVE-2019-12814 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2019-12814" }, "action_statement": "Vulnerability CVE-2019-12814 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:57:12.455499+00:00", "status_notes": "Vulnerability CVE-2019-14379 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2019-14379" }, "action_statement": "Vulnerability CVE-2019-14379 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2019-14439 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14439" }, "action_statement": "Vulnerability CVE-2019-14439 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:58:00.076676+00:00", "status_notes": "Vulnerability CVE-2019-14540 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2019-14540" }, "action_statement": "Vulnerability CVE-2019-14540 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:58:00.076676+00:00", "status_notes": "Vulnerability CVE-2019-14892 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2019-14892" }, "action_statement": "Vulnerability CVE-2019-14892 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2019-14893 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14893" }, "action_statement": "Vulnerability CVE-2019-14893 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:58:00.076676+00:00", "status_notes": "Vulnerability CVE-2019-16335 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2019-16335" }, "action_statement": "Vulnerability CVE-2019-16335 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:57:25.997738+00:00", "status_notes": "Vulnerability CVE-2019-16942 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2019-16942" }, "action_statement": "Vulnerability CVE-2019-16942 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2019-16943 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16943" }, "action_statement": "Vulnerability CVE-2019-16943 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:58:00.076676+00:00", "status_notes": "Vulnerability CVE-2019-17267 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2019-17267" }, "action_statement": "Vulnerability CVE-2019-17267 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2019-17531 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17531" }, "action_statement": "Vulnerability CVE-2019-17531 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:57:00.074942+00:00", "status_notes": "Vulnerability CVE-2019-20330 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2019-20330" }, "action_statement": "Vulnerability CVE-2019-20330 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:56:27.868219+00:00", "status_notes": "Vulnerability CVE-2020-10650 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2020-10650" }, "action_statement": "Vulnerability CVE-2020-10650 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-10T10:52:00.051324+00:00", "status_notes": "Vulnerability CVE-2020-10672 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.6.", "vulnerability": { "name": "CVE-2020-10672" }, "action_statement": "Vulnerability CVE-2020-10672 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:56:00.066070+00:00", "status_notes": "Vulnerability CVE-2020-10673 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2020-10673" }, "action_statement": "Vulnerability CVE-2020-10673 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:57:00.074942+00:00", "status_notes": "Vulnerability CVE-2020-10969 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2020-10969" }, "action_statement": "Vulnerability CVE-2020-10969 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:57:00.074942+00:00", "status_notes": "Vulnerability CVE-2020-11111 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11111" }, "action_statement": "Vulnerability CVE-2020-11111 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:56:27.868219+00:00", "status_notes": "Vulnerability CVE-2020-11112 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11112" }, "action_statement": "Vulnerability CVE-2020-11112 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:58:00.076676+00:00", "status_notes": "Vulnerability CVE-2020-11113 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11113" }, "action_statement": "Vulnerability CVE-2020-11113 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:58:00.076676+00:00", "status_notes": "Vulnerability CVE-2020-11619 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2020-11619" }, "action_statement": "Vulnerability CVE-2020-11619 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-10T10:52:00.051324+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-29T11:28:52.479302+00:00", "status_notes": "Vulnerability CVE-2020-14060 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.2.", "vulnerability": { "name": "CVE-2020-14060" }, "action_statement": "Vulnerability CVE-2020-14060 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-01T09:31:00.160617+00:00", "status_notes": "Vulnerability CVE-2020-14061 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3.", "vulnerability": { "name": "CVE-2020-14061" }, "action_statement": "Vulnerability CVE-2020-14061 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-01T09:31:52.889523+00:00", "status_notes": "Vulnerability CVE-2020-14062 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3.", "vulnerability": { "name": "CVE-2020-14062" }, "action_statement": "Vulnerability CVE-2020-14062 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:56:27.868219+00:00", "status_notes": "Vulnerability CVE-2020-14195 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2020-14195" }, "action_statement": "Vulnerability CVE-2020-14195 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-01T09:31:52.889523+00:00", "status_notes": "Vulnerability CVE-2020-24616 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3.", "vulnerability": { "name": "CVE-2020-24616" }, "action_statement": "Vulnerability CVE-2020-24616 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-01T09:31:52.889523+00:00", "status_notes": "Vulnerability CVE-2020-24750 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3.", "vulnerability": { "name": "CVE-2020-24750" }, "action_statement": "Vulnerability CVE-2020-24750 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:21:28.696662+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-29T11:28:52.479302+00:00", "status_notes": "Vulnerability CVE-2020-35491 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.2.", "vulnerability": { "name": "CVE-2020-35491" }, "action_statement": "Vulnerability CVE-2020-35491 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2020-35728 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" }, "action_statement": "Vulnerability CVE-2020-35728 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-06T06:14:00.032168+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-01T09:31:00.160617+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-01T09:31:52.889523+00:00", "status_notes": "Vulnerability CVE-2020-36183 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3.", "vulnerability": { "name": "CVE-2020-36183" }, "action_statement": "Vulnerability CVE-2020-36183 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:21:28.696662+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:21:28.696662+00:00", "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-29T11:28:52.479302+00:00", "status_notes": "Vulnerability CVE-2020-36187 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.2.", "vulnerability": { "name": "CVE-2020-36187" }, "action_statement": "Vulnerability CVE-2020-36187 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:57:00.074942+00:00", "status_notes": "Vulnerability CVE-2020-36189 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2020-36189" }, "action_statement": "Vulnerability CVE-2020-36189 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:57:12.455499+00:00", "status_notes": "Vulnerability CVE-2020-8840 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2020-8840" }, "action_statement": "Vulnerability CVE-2020-8840 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2020-9546 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9546" }, "action_statement": "Vulnerability CVE-2020-9546 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:57:00.074942+00:00", "status_notes": "Vulnerability CVE-2020-9547 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2020-9547" }, "action_statement": "Vulnerability CVE-2020-9547 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-01T09:31:52.889523+00:00", "status_notes": "Vulnerability CVE-2021-20190 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3.", "vulnerability": { "name": "CVE-2021-20190" }, "action_statement": "Vulnerability CVE-2021-20190 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-29T11:28:52.479302+00:00", "status_notes": "Vulnerability CVE-2022-42003 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.2.", "vulnerability": { "name": "CVE-2022-42003" }, "action_statement": "Vulnerability CVE-2022-42003 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:21:28.696662+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-06T18:52:00.040792+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-01T09:32:00.294010+00:00", "status_notes": "Vulnerability CVE-2026-50193 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3.", "vulnerability": { "name": "CVE-2026-50193" }, "action_statement": "Vulnerability CVE-2026-50193 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:20:15.352131+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.8 is NOT affected by CVE-2026-54512. The vulnerability is specific to PolymorphicTypeValidator (PTV), a configurable type validation mechanism introduced in version 2.10.0. The CVE describes a bypass where type parameters escape PTV validation, allowing an attacker to smuggle denied classes as generic type arguments of allowed containers (e.g., ArrayList when only ArrayList is whitelisted). Version 2.9.8 does not have PTV - it only has SubTypeValidator, a hardcoded blacklist of known gadget classes that applies equally to both containers and type parameters during deserializer creation. The specific attack described in the CVE (bypassing a configured PTV allow-list) cannot occur because no such allow-list mechanism exists in 2.9.8.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.9.8 is NOT affected by CVE-2026-54512. The vulnerability is specific to PolymorphicTypeValidator (PTV), a configurable type validation mechanism introduced in version 2.10.0. The CVE describes a bypass where type parameters escape PTV validation, allowing an attacker to smuggle denied classes as generic type arguments of allowed containers (e.g., ArrayList when only ArrayList is whitelisted). Version 2.9.8 does not have PTV - it only has SubTypeValidator, a hardcoded blacklist of known gadget classes that applies equally to both containers and type parameters during deserializer creation. The specific attack described in the CVE (bypassing a configured PTV allow-list) cannot occur because no such allow-list mechanism exists in 2.9.8." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-29T00:12:47.728703+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:21:28.696662+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:21:28.696662+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T03:00:17.070796+00:00", "status_notes": "Vulnerability CVE-2026-54516 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.8-tuxcare.4 is not affected by CVE-2026-54516. The vulnerable code pattern\u2014a conditional check in POJOPropertiesCollector._renameProperties() that processes properties in _ignoredPropertyNames and requires calling prop.removeFields() to prevent field-based deserialization bypass\u2014does not exist in this version. This architectural pattern was introduced in later versions (2.21.0+) whe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54516" }, "impact_statement": "not_affected \u2014 Version 2.9.8-tuxcare.4 is not affected by CVE-2026-54516. The vulnerable code pattern\u2014a conditional check in POJOPropertiesCollector._renameProperties() that processes properties in _ignoredPropertyNames and requires calling prop.removeFields() to prevent field-based deserialization bypass\u2014does not exist in this version. This architectural pattern was introduced in later versions (2.21.0+) whe..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:58:00.076676+00:00", "status_notes": "Vulnerability CVE-2026-54518 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2026-54518" }, "action_statement": "Vulnerability CVE-2026-54518 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-03T01:38:53.629481+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.9.8 is not affected by CVE-2026-59888. This vulnerability is specific to Java Record deserialization, a feature introduced in Java 14 (2020). The target version predates Records by several years, targeting Java 7 (per pom.xml line 34), and contains no Record introspection code. The vulnerable code path\u2014where @JsonIgnore Record components remain in the property map during Proper...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 Target version 2.9.8 is not affected by CVE-2026-59888. This vulnerability is specific to Java Record deserialization, a feature introduced in Java 14 (2020). The target version predates Records by several years, targeting Java 7 (per pom.xml line 34), and contains no Record introspection code. The vulnerable code path\u2014where @JsonIgnore Record components remain in the property map during Proper..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-01T09:33:00.174904+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-01T09:33:00.174904+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-11-09T11:58:00.076676+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-29T11:28:52.479302+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.2.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-29T11:28:52.479302+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.2.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.8-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8-tuxcare.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.8-tuxcare.1.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }