{ "@id": "urn:uuid:030f6189-f48f-4bf6-b135-eccb8a10d955", "role": "Document Creator", "author": "https://tuxcare.com", "version": 4, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-23T10:56:00.201933+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-23T10:55:02.012079+00:00", "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.6.7.2 is not vulnerable as it is equal to upstream fix version - 2.6.7.2", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-15095" }, "impact_statement": "Jackson Databind 2.6.7.2 is not vulnerable as it is equal to upstream fix version - 2.6.7.2" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2017-17485 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2017-17485" }, "action_statement": "Vulnerability CVE-2017-17485 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.6.7.2 is NOT affected by CVE-2017-7525. The vulnerability was fixed by upstream vendor (Jackson maintainer Tatu Saloranta) in version 2.6.7.1 via commit fa87c1ddb. Target version 2.6.7.2 inherits this fix and contains comprehensive blocklist-based deserialization defenses that prevent exploitation of the malicious-class-instantiation gadget chains described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "Target version 2.6.7.2 is NOT affected by CVE-2017-7525. The vulnerability was fixed by upstream vendor (Jackson maintainer Tatu Saloranta) in version 2.6.7.1 via commit fa87c1ddb. Target version 2.6.7.2 inherits this fix and contains comprehensive blocklist-based deserialization defenses that prevent exploitation of the malicious-class-instantiation gadget chains described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2018-11307 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-11307" }, "action_statement": "Vulnerability CVE-2018-11307 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2018-12022 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-12022" }, "action_statement": "Vulnerability CVE-2018-12022 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-23T10:56:00.201933+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.6.7.2 is not vulnerable as the issue was introduced in 2.7.0", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "Jackson Databind 2.6.7.2 is not vulnerable as the issue was introduced in 2.7.0" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Not affected. HEAD already contains the CVE-2018-14718 fix: upstream jackson-databind #2097, commit 87d29af \"Fix #2097 for 2.6.7.2\" by Tatu Saloranta. That commit is part of the upstream 2.6.7.2 release, fab5c3877, whose release notes read \"2.6.7.2 (13-Nov-2018) ... #2097: Block more classes from polymorphic deserialization (CVE-2018-14718 - CVE-2018-14721)\". fab5c3877 is also the base ref of tuxcare-current/2.6.7.2 (tuxcare.yaml ref). In HEAD 317b0180c, \"org.slf4j.ext.EventData\" is on the deny-list at SubTypeValidator.java:74-78. SubTypeValidator.validateSubType (lines 185-230) enforces it, and BeanDeserializerFactory.createBeanDeserializer calls that check at line 143, before buildBeanDeserializer at line 145. A JSON type id naming the slf4j-ext gadget therefore fails with \"Illegal type ... prevented for security reasons\" before the object is built. TuxCare commit 83b20b930, a CVE-2020-36184 backport, later moved the inline list into SubTypeValidator and explicitly carried this entry over. It kept the fix; it did not introduce it. The NVD range (\"before 2.6.7.3\") is wrong for the 2.6 line; the code shows the fix shipped in 2.6.7.2. Attribution: the fix author is upstream (iki.fi) and no TuxCare A1-A4 signal applies, because the fix sits on the branch's first-parent mainline and no merge brought it in.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "Not affected. HEAD already contains the CVE-2018-14718 fix: upstream jackson-databind #2097, commit 87d29af \"Fix #2097 for 2.6.7.2\" by Tatu Saloranta. That commit is part of the upstream 2.6.7.2 release, fab5c3877, whose release notes read \"2.6.7.2 (13-Nov-2018) ... #2097: Block more classes from polymorphic deserialization (CVE-2018-14718 - CVE-2018-14721)\". fab5c3877 is also the base ref of tuxcare-current/2.6.7.2 (tuxcare.yaml ref). In HEAD 317b0180c, \"org.slf4j.ext.EventData\" is on the deny-list at SubTypeValidator.java:74-78. SubTypeValidator.validateSubType (lines 185-230) enforces it, and BeanDeserializerFactory.createBeanDeserializer calls that check at line 143, before buildBeanDeserializer at line 145. A JSON type id naming the slf4j-ext gadget therefore fails with \"Illegal type ... prevented for security reasons\" before the object is built. TuxCare commit 83b20b930, a CVE-2020-36184 backport, later moved the inline list into SubTypeValidator and explicitly carried this entry over. It kept the fix; it did not introduce it. The NVD range (\"before 2.6.7.3\") is wrong for the 2.6 line; the code shows the fix shipped in 2.6.7.2. Attribution: the fix author is upstream (iki.fi) and no TuxCare A1-A4 signal applies, because the fix sits on the branch's first-parent mainline and no merge brought it in." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2018-14719 (databind#2097, blaze-ds gadget flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor) is not exploitable in jackson-databind 2.6.7.2 (tuxcare-current/2.6.7.2 @ 6e977cbd5121): the class is on the polymorphic-deserialization deny-list (SubTypeValidator.java:76) and SubTypeValidator.validateSubType() rejects it on the BeanDeserializerFactory.createBeanDeserializer() path before any bean is built. The fix is upstream: commit 87d29af25e82 \"Fix #2097 for 2.6.7.2\" by Tatu Saloranta (2018-08-16) added the entry and is an ancestor of the assessed commit; the CloudLinux commit 83b20b9306dd (Backport CVE-2020-36184) only moved the existing line into SubTypeValidator. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-23; Opus labelled it already_fixed from git blame of the moved line, corrected to the upstream author by a pickaxe search of the branch; the earlier Sonnet run was parked by the author-verification gate]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "not_affected \u2014 CVE-2018-14719 (databind#2097, blaze-ds gadget flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor) is not exploitable in jackson-databind 2.6.7.2 (tuxcare-current/2.6.7.2 @ 6e977cbd5121): the class is on the polymorphic-deserialization deny-list (SubTypeValidator.java:76) and SubTypeValidator.validateSubType() rejects it on the BeanDeserializerFactory.createBeanDeserializer() path before any bean is built. The fix is upstream: commit 87d29af25e82 \"Fix #2097 for 2.6.7.2\" by Tatu Saloranta (2018-08-16) added the entry and is an ancestor of the assessed commit; the CloudLinux commit 83b20b9306dd (Backport CVE-2020-36184) only moved the existing line into SubTypeValidator. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-23; Opus labelled it already_fixed from git blame of the moved line, corrected to the upstream author by a pickaxe search of the branch; the earlier Sonnet run was parked by the author-verification gate]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-23T10:56:00.201933+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.6.7.2 is not vulnerable as it is equal to upstream fix version - 2.6.7.2", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "Jackson Databind 2.6.7.2 is not vulnerable as it is equal to upstream fix version - 2.6.7.2" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 (jackson-databind SSRF via failure to block the axis2-jaxws gadget `org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl` from polymorphic deserialization) is NOT present in the target (jackson-databind 2.6.7.2, SHA 317b0180c). The gadget class is on the polymorphic-deserialization denylist and the denylist is live on the deserialization path, so the attacker input cannot reach the goal.\n\nThe exact axis2-jaxws class is listed at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:78 inside DEFAULT_NO_DESER_CLASS_NAMES. validateSubType() (line 185) rejects any raw class whose name is in that set (line 194) by throwing \"Illegal type (...) to deserialize: prevented for security reasons\" (line 229). This is reachable from BeanDeserializerFactory.buildBeanDeserializer -> _validateSubType (line 143) -> SubTypeValidator.instance().validateSubType (line 850).\n\nAttribution: the block was installed UPSTREAM by commit 87d29af25 (\"Fix #2097 for 2.6.7.2\", Tatu Saloranta, 2018-08-16) \u2014 the exact commit in the patch URL \u2014 which added the #2097 classes to BeanDeserializerFactory. That commit is an ancestor of the TuxCare onboarding commit, so the fix shipped in the version TuxCare onboarded; TuxCare never backported CVE-2018-14721. This is the upstream-vendor-fix branch of not_affected (justification code_not_present).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "CVE-2018-14721 (jackson-databind SSRF via failure to block the axis2-jaxws gadget `org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl` from polymorphic deserialization) is NOT present in the target (jackson-databind 2.6.7.2, SHA 317b0180c). The gadget class is on the polymorphic-deserialization denylist and the denylist is live on the deserialization path, so the attacker input cannot reach the goal.\n\nThe exact axis2-jaxws class is listed at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:78 inside DEFAULT_NO_DESER_CLASS_NAMES. validateSubType() (line 185) rejects any raw class whose name is in that set (line 194) by throwing \"Illegal type (...) to deserialize: prevented for security reasons\" (line 229). This is reachable from BeanDeserializerFactory.buildBeanDeserializer -> _validateSubType (line 143) -> SubTypeValidator.instance().validateSubType (line 850).\n\nAttribution: the block was installed UPSTREAM by commit 87d29af25 (\"Fix #2097 for 2.6.7.2\", Tatu Saloranta, 2018-08-16) \u2014 the exact commit in the patch URL \u2014 which added the #2097 classes to BeanDeserializerFactory. That commit is an ancestor of the TuxCare onboarding commit, so the fix shipped in the version TuxCare onboarded; TuxCare never backported CVE-2018-14721. This is the upstream-vendor-fix branch of not_affected (justification code_not_present)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2018-19360 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19360" }, "action_statement": "Vulnerability CVE-2018-19360 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2018-19361 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19361" }, "action_statement": "Vulnerability CVE-2018-19361 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2018-19362 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19362" }, "action_statement": "Vulnerability CVE-2018-19362 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2018-5968 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-5968" }, "action_statement": "Vulnerability CVE-2018-5968 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2018-7489 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-7489" }, "action_statement": "Vulnerability CVE-2018-7489 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2019-12086 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12086" }, "action_statement": "Vulnerability CVE-2019-12086 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2019-12384 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12384" }, "action_statement": "Vulnerability CVE-2019-12384 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2019-12814 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12814" }, "action_statement": "Vulnerability CVE-2019-12814 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2019-14379 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14379" }, "action_statement": "Vulnerability CVE-2019-14379 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2019-14439 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14439" }, "action_statement": "Vulnerability CVE-2019-14439 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2019-14540 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14540" }, "action_statement": "Vulnerability CVE-2019-14540 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2019-14892 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14892" }, "action_statement": "Vulnerability CVE-2019-14892 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2019-16335 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16335" }, "action_statement": "Vulnerability CVE-2019-16335 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2019-16942 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16942" }, "action_statement": "Vulnerability CVE-2019-16942 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2019-16943 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16943" }, "action_statement": "Vulnerability CVE-2019-16943 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2019-17267 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17267" }, "action_statement": "Vulnerability CVE-2019-17267 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2019-17531 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17531" }, "action_statement": "Vulnerability CVE-2019-17531 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2019-20330 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-20330" }, "action_statement": "Vulnerability CVE-2019-20330 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-10650 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10650" }, "action_statement": "Vulnerability CVE-2020-10650 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-10672 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10672" }, "action_statement": "Vulnerability CVE-2020-10672 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-10673 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10673" }, "action_statement": "Vulnerability CVE-2020-10673 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-10969 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10969" }, "action_statement": "Vulnerability CVE-2020-10969 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-11111 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11111" }, "action_statement": "Vulnerability CVE-2020-11111 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-11112 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11112" }, "action_statement": "Vulnerability CVE-2020-11112 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-11113 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11113" }, "action_statement": "Vulnerability CVE-2020-11113 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-11619 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11619" }, "action_statement": "Vulnerability CVE-2020-11619 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-14060 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" }, "action_statement": "Vulnerability CVE-2020-14060 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-14061 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" }, "action_statement": "Vulnerability CVE-2020-14061 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-14062 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" }, "action_statement": "Vulnerability CVE-2020-14062 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-14195 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14195" }, "action_statement": "Vulnerability CVE-2020-14195 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-24616 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" }, "action_statement": "Vulnerability CVE-2020-24616 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:23:00.262676+00:00", "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:23:00.262676+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-35491 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" }, "action_statement": "Vulnerability CVE-2020-35491 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-35728 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" }, "action_statement": "Vulnerability CVE-2020-35728 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-36183 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" }, "action_statement": "Vulnerability CVE-2020-36183 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:23:00.262676+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-36187 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" }, "action_statement": "Vulnerability CVE-2020-36187 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-36189 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" }, "action_statement": "Vulnerability CVE-2020-36189 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-8840 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-8840" }, "action_statement": "Vulnerability CVE-2020-8840 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-9546 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9546" }, "action_statement": "Vulnerability CVE-2020-9546 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-9547 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9547" }, "action_statement": "Vulnerability CVE-2020-9547 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2021-20190 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" }, "action_statement": "Vulnerability CVE-2021-20190 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2022-42003 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" }, "action_statement": "Vulnerability CVE-2022-42003 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2026-50193 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" }, "action_statement": "Vulnerability CVE-2026-50193 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Version 2.6.7.2 is NOT affected by CVE-2026-54512. The vulnerability describes a PolymorphicTypeValidator (PTV) bypass where PTV validates the container class but fails to validate generic type parameters, allowing attackers to smuggle denied classes as type arguments (e.g., java.util.ArrayList). However, PolymorphicTypeValidator does not exist in version 2.6.7.2 \u2014 it was introduced in version 2.10.0 (git commit 1135b2c1d, ~50 commits before jackson-databind-2.10.0.pr1 tag). The CVE explicitly states it affects \"From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4\", and the target version predates this range. Without PTV, the specific vulnerability pattern (PTV bypass via generic parameters) cannot exist. While 2.6.7.2 lacks polymorphic type validation entirely, this is a different security context than the specific PTV bypass described in CVE-2026-54512.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.6.7.2 is NOT affected by CVE-2026-54512. The vulnerability describes a PolymorphicTypeValidator (PTV) bypass where PTV validates the container class but fails to validate generic type parameters, allowing attackers to smuggle denied classes as type arguments (e.g., java.util.ArrayList). However, PolymorphicTypeValidator does not exist in version 2.6.7.2 \u2014 it was introduced in version 2.10.0 (git commit 1135b2c1d, ~50 commits before jackson-databind-2.10.0.pr1 tag). The CVE explicitly states it affects \"From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4\", and the target version predates this range. Without PTV, the specific vulnerability pattern (PTV bypass via generic parameters) cannot exist. While 2.6.7.2 lacks polymorphic type validation entirely, this is a different security context than the specific PTV bypass described in CVE-2026-54512." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:23:00.262676+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:23:00.262676+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2-tuxcare.1" } } ], "timestamp": "2026-10-19T20:22:23.766714+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" }, "action_statement": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.6.7.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." } ] }