{ "@id": "urn:uuid:7cfb8cad-3d88-4e36-8e4f-15e41e809b2f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 6, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-27T09:58:59.407356+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-27T08:46:11.783944+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.3-tuxcare.2) is NOT AFFECTED by CVE-2019-14540. The vulnerability, which involved polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes, has been fixed by the upstream vendor (FasterXML). The fix was already present in the upstream release 2.9.10.3 that TuxCare onboarded, as evidenced by commits d4983c740 and 73c1c2cc7 being ancestors of the first TuxCare onboarding commit (db0c5ab03). The SubTypeValidator.java file contains the required blocklist entries at lines 101 and 103, preventing deserialization of these dangerous classes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "The target repository (jackson-databind 2.9.10.3-tuxcare.2) is NOT AFFECTED by CVE-2019-14540. The vulnerability, which involved polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes, has been fixed by the upstream vendor (FasterXML). The fix was already present in the upstream release 2.9.10.3 that TuxCare onboarded, as evidenced by commits d4983c740 and 73c1c2cc7 being ancestors of the first TuxCare onboarding commit (db0c5ab03). The SubTypeValidator.java file contains the required blocklist entries at lines 101 and 103, preventing deserialization of these dangerous classes." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-27T08:49:00.073491+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.9.10.3-tuxcare.2 is not affected by CVE-2019-14892. The fix that blocks polymorphic deserialization of commons-configuration JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) is present in SubTypeValidator.java at lines 108-110. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 41b7f9b90 and shipped in upstream release 2.9.10.3, before TuxCare's first onboarding commit. The CVE affects versions before 2.9.10, and this target is version 2.9.10.3 with the upstream fix already applied.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "The target jackson-databind version 2.9.10.3-tuxcare.2 is not affected by CVE-2019-14892. The fix that blocks polymorphic deserialization of commons-configuration JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) is present in SubTypeValidator.java at lines 108-110. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 41b7f9b90 and shipped in upstream release 2.9.10.3, before TuxCare's first onboarding commit. The CVE affects versions before 2.9.10, and this target is version 2.9.10.3 with the upstream fix already applied." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-27T08:51:33.391408+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.3-tuxcare.2) is NOT AFFECTED by CVE-2019-14893. The vulnerability, which allowed arbitrary code execution via polymorphic deserialization of the xalan JNDI gadget class `org.apache.xalan.lib.sql.JNDIConnectionPool`, has been mitigated by the upstream vendor. The fix (adding the dangerous class to the deserialization blacklist in SubTypeValidator.java) was already present in the upstream release 2.9.10.3 that TuxCare onboarded. The fix commit (998efd708, \"Fix #2469\") was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and is an ancestor of the current HEAD. The blacklist entry at line 113 and validation logic at lines 168-203 successfully block deserialization of the malicious class, preventing the attack chain from input to arbitrary code execution.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "The target repository (jackson-databind 2.9.10.3-tuxcare.2) is NOT AFFECTED by CVE-2019-14893. The vulnerability, which allowed arbitrary code execution via polymorphic deserialization of the xalan JNDI gadget class `org.apache.xalan.lib.sql.JNDIConnectionPool`, has been mitigated by the upstream vendor. The fix (adding the dangerous class to the deserialization blacklist in SubTypeValidator.java) was already present in the upstream release 2.9.10.3 that TuxCare onboarded. The fix commit (998efd708, \"Fix #2469\") was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and is an ancestor of the current HEAD. The blacklist entry at line 113 and validation logic at lines 168-203 successfully block deserialization of the malicious class, preventing the attack chain from input to arbitrary code execution." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-27T08:49:00.073491+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 concerns a polymorphic deserialization vulnerability in Jackson-databind where specifying \"com.zaxxer.hikari.HikariDataSource\" in JSON type metadata would enable gadget-chain attacks for RCE/information disclosure. The target repository (jackson-databind 2.9.10.3-tuxcare.2) already contains the upstream fix. The blocklist entry for HikariDataSource is present at SubTypeValidator.java:102-103, preventing instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.10.3 before TuxCare onboarded that version. The vulnerable pattern does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 concerns a polymorphic deserialization vulnerability in Jackson-databind where specifying \"com.zaxxer.hikari.HikariDataSource\" in JSON type metadata would enable gadget-chain attacks for RCE/information disclosure. The target repository (jackson-databind 2.9.10.3-tuxcare.2) already contains the upstream fix. The blocklist entry for HikariDataSource is present at SubTypeValidator.java:102-103, preventing instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.10.3 before TuxCare onboarded that version. The vulnerable pattern does not exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is NOT AFFECTED in jackson-databind 2.9.10.3-tuxcare.2. The vulnerability involves polymorphic deserialization of the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf8, September 19, 2019) added this class to the blocklist in SubTypeValidator.java (line 95), preventing its instantiation during polymorphic deserialization. This fix was already present in the upstream version 2.9.10.3 when TuxCare onboarded it on September 21, 2026 (commit db0c5ab0). The fix is tagged in jackson-databind-2.9.10, 2.9.10.1, 2.9.10.2, and 2.9.10.3. The target repository inherits this protection from the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "CVE-2019-17267 is NOT AFFECTED in jackson-databind 2.9.10.3-tuxcare.2. The vulnerability involves polymorphic deserialization of the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf8, September 19, 2019) added this class to the blocklist in SubTypeValidator.java (line 95), preventing its instantiation during polymorphic deserialization. This fix was already present in the upstream version 2.9.10.3 when TuxCare onboarded it on September 21, 2026 (commit db0c5ab0). The fix is tagged in jackson-databind-2.9.10, 2.9.10.1, 2.9.10.2, and 2.9.10.3. The target repository inherits this protection from the upstream release." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-10650 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10650" }, "action_statement": "Vulnerability CVE-2020-10650 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-10672 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10672" }, "action_statement": "Vulnerability CVE-2020-10672 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-10673 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10673" }, "action_statement": "Vulnerability CVE-2020-10673 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-10969 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10969" }, "action_statement": "Vulnerability CVE-2020-10969 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-11111 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11111" }, "action_statement": "Vulnerability CVE-2020-11111 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-11112 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11112" }, "action_statement": "Vulnerability CVE-2020-11112 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-11113 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11113" }, "action_statement": "Vulnerability CVE-2020-11113 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-11619 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11619" }, "action_statement": "Vulnerability CVE-2020-11619 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-14060 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" }, "action_statement": "Vulnerability CVE-2020-14060 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-14061 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" }, "action_statement": "Vulnerability CVE-2020-14061 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-14062 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" }, "action_statement": "Vulnerability CVE-2020-14062 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-14195 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14195" }, "action_statement": "Vulnerability CVE-2020-14195 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-24616 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" }, "action_statement": "Vulnerability CVE-2020-24616 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-24750 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" }, "action_statement": "Vulnerability CVE-2020-24750 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-35491 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" }, "action_statement": "Vulnerability CVE-2020-35491 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-35728 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" }, "action_statement": "Vulnerability CVE-2020-35728 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-36183 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" }, "action_statement": "Vulnerability CVE-2020-36183 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-36187 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" }, "action_statement": "Vulnerability CVE-2020-36187 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-36189 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" }, "action_statement": "Vulnerability CVE-2020-36189 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-9546 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9546" }, "action_statement": "Vulnerability CVE-2020-9546 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-9547 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9547" }, "action_statement": "Vulnerability CVE-2020-9547 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2021-20190 is fixed in version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2022-42003 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" }, "action_statement": "Vulnerability CVE-2022-42003 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2026-50193 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" }, "action_statement": "Vulnerability CVE-2026-50193 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.10.3 is not affected by CVE-2026-54512. The vulnerability requires PolymorphicTypeValidator (PTV) with configurable allow-lists, introduced in version 2.10.0. Version 2.9.10.3 predates PTV and uses SubTypeValidator with a hardcoded deny-list instead. The vulnerable method DatabindContext._resolveAndValidateGeneric() does not exist in this version. CVE-2026-54512 describes bypassing PTV's allow-list validation by hiding denied classes as generic type parameters - a mechanism that cannot occur when PTV doesn't exist. Git history confirms PTV introduction in commit 61ffa3aaa (April 2019) for version 2.10.0. No backport of CVE-2026-54512 to 2.9.10.3 exists, while backports to 2.14.1, 2.14.2, 2.17.2, and 2.17.3 confirm TuxCare assessed 2.9.x as unaffected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.9.10.3 is not affected by CVE-2026-54512. The vulnerability requires PolymorphicTypeValidator (PTV) with configurable allow-lists, introduced in version 2.10.0. Version 2.9.10.3 predates PTV and uses SubTypeValidator with a hardcoded deny-list instead. The vulnerable method DatabindContext._resolveAndValidateGeneric() does not exist in this version. CVE-2026-54512 describes bypassing PTV's allow-list validation by hiding denied classes as generic type parameters - a mechanism that cannot occur when PTV doesn't exist. Git history confirms PTV introduction in commit 61ffa3aaa (April 2019) for version 2.10.0. No backport of CVE-2026-54512 to 2.9.10.3 exists, while backports to 2.14.1, 2.14.2, 2.17.2, and 2.17.3 confirm TuxCare assessed 2.9.x as unaffected." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3-tuxcare.1" } } ], "timestamp": "2026-10-09T07:39:00.166685+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.10.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } } ] }