{ "@id": "urn:uuid:f81a7f4b-0a48-4b21-a872-abd99c470f89", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-23T10:53:50.260427+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind 2.7.9.7 (product matches the CVE \u2014 not a false positive). CVE-2018-11307 (data exfiltration via the iBatis org.apache.ibatis.parsing.XPathParser gadget when Jackson default typing is enabled) was fixed upstream in 2.7.9.4 by blocklisting that class in SubTypeValidator. The target ships that exact fix at SubTypeValidator.java:61 (`s.add(\"org.apache.ibatis.parsing.XPathParser\")`, comment \"[databind#2032]: ... data exfiltration via xml parsed ext entities\"). The blocklist is enforced by validateSubType(), which throws \"Illegal type (...) to deserialize: prevented for security reasons\" for any deny-listed class. git blame/describe show line 61 was introduced by upstream commit 27b4defc (Tatu Saloranta, tatu.saloranta@iki.fi) and first appears in tag jackson-databind-2.7.9.4 \u2014 the CVE fix release. It reached this repo as part of the upstream baseline onboarded via onboard/2.7.9.7, not a dedicated TuxCare backport. Because the pattern was removed by an UPSTREAM/vendor-authored fix already present in the shipped version, verdict is not_affected (justification code_not_present); it is not already_fixed because the fix is not TuxCare/CloudLinux-authored. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "not_affected \u2014 Target is jackson-databind 2.7.9.7 (product matches the CVE \u2014 not a false positive). CVE-2018-11307 (data exfiltration via the iBatis org.apache.ibatis.parsing.XPathParser gadget when Jackson default typing is enabled) was fixed upstream in 2.7.9.4 by blocklisting that class in SubTypeValidator. The target ships that exact fix at SubTypeValidator.java:61 (`s.add(\"org.apache.ibatis.parsing.XPathParser\")`, comment \"[databind#2032]: ... data exfiltration via xml parsed ext entities\"). The blocklist is enforced by validateSubType(), which throws \"Illegal type (...) to deserialize: prevented for security reasons\" for any deny-listed class. git blame/describe show line 61 was introduced by upstream commit 27b4defc (Tatu Saloranta, tatu.saloranta@iki.fi) and first appears in tag jackson-databind-2.7.9.4 \u2014 the CVE fix release. It reached this repo as part of the upstream baseline onboarded via onboard/2.7.9.7, not a dedicated TuxCare backport. Because the pattern was removed by an UPSTREAM/vendor-authored fix already present in the shipped version, verdict is not_affected (justification code_not_present); it is not already_fixed because the fix is not TuxCare/CloudLinux-authored. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind 2.7.9.7 (com.fasterxml.jackson.core) \u2014 exact product match for CVE-2018-12022, so not a false positive. CVE-2018-12022 is a polymorphic-deserialization (Default Typing) gadget vulnerability: when the jodd-db jar is on the classpath and Default Typing is enabled, an attacker-supplied JSON type id naming jodd.db.connection.DataSourceConnectionProvider triggers a JNDI/LDAP lookup and remote payload execution. The upstream fix adds that gadget class name to jackson-databind's deserialization deny-list (SubTypeValidator DEFAULT_NO_DESER_CLASS_NAMES). The target ALREADY contains this exact fix at SubTypeValidator.java:63-64 (\"// [databind#2052]: Jodd-db, with jndi/ldap lookup\" + s.add(\"jodd.db.connection.DataSourceConnectionProvider\")), and it is actively enforced: validateSubType() checks _cfgIllegalClassNames.contains(full) at line 170 and throws JsonMappingException \"prevented for security reasons\" at line 203-204. git blame shows line 64 comes from upstream commit 28badf7ef6 by maintainer Tatu Saloranta (tatu.saloranta@iki.fi) \u2014 subject \"Backport #2052, #2058 fixes for 2.7.9.4\" \u2014 which is literally one of the vendor patch commits in the task input. CVE says \"prior to 2.7.9.4\"; the shipped 2.7.9.7 inherits the 2.7.9.4 upstream fix. Because the fix is upstream/vendor-authored (not TuxCare/CloudLinux), the correct verdict is not_affected (vendor-fix sub-case), justification code_not_present \u2014 the vulnerable pattern (Jodd class absent from the deny-list) is not present in HEAD. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "not_affected \u2014 Target is jackson-databind 2.7.9.7 (com.fasterxml.jackson.core) \u2014 exact product match for CVE-2018-12022, so not a false positive. CVE-2018-12022 is a polymorphic-deserialization (Default Typing) gadget vulnerability: when the jodd-db jar is on the classpath and Default Typing is enabled, an attacker-supplied JSON type id naming jodd.db.connection.DataSourceConnectionProvider triggers a JNDI/LDAP lookup and remote payload execution. The upstream fix adds that gadget class name to jackson-databind's deserialization deny-list (SubTypeValidator DEFAULT_NO_DESER_CLASS_NAMES). The target ALREADY contains this exact fix at SubTypeValidator.java:63-64 (\"// [databind#2052]: Jodd-db, with jndi/ldap lookup\" + s.add(\"jodd.db.connection.DataSourceConnectionProvider\")), and it is actively enforced: validateSubType() checks _cfgIllegalClassNames.contains(full) at line 170 and throws JsonMappingException \"prevented for security reasons\" at line 203-204. git blame shows line 64 comes from upstream commit 28badf7ef6 by maintainer Tatu Saloranta (tatu.saloranta@iki.fi) \u2014 subject \"Backport #2052, #2058 fixes for 2.7.9.4\" \u2014 which is literally one of the vendor patch commits in the task input. CVE says \"prior to 2.7.9.4\"; the shipped 2.7.9.7 inherits the 2.7.9.4 upstream fix. Because the fix is upstream/vendor-authored (not TuxCare/CloudLinux), the correct verdict is not_affected (vendor-fix sub-case), justification code_not_present \u2014 the vulnerable pattern (Jodd class absent from the deny-list) is not present in HEAD. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind 2.7.9.7 (SHA 5568e5b), a TuxCare ELS build of the upstream 2.7 line. CVE-2018-12023 is a polymorphic-deserialization RCE gadget: with Default Typing enabled, an attacker supplies JSON naming an Oracle-JDBC/jodd gadget class whose instantiation performs a JNDI/LDAP lookup to an attacker server, executing a malicious payload. The upstream fix (#2052/#2058) adds those gadget class names to jackson-databind's deserialization denylist (SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES). All three fix classes are present in the target: jodd.db.connection.DataSourceConnectionProvider (line 64), oracle.jdbc.connector.OracleManagedConnectionFactory (line 67), oracle.jdbc.rowset.OracleJDBCRowSet (line 68). The enforcement method validateSubType() (lines 161-205) throws JsonMappingException for any denylisted class and is reachable on the deserialization path via BeanDeserializerFactory (line 145 -> _validateSubType 845 -> validateSubType 849). The vulnerable pre-fix state (missing denylist entries) is absent. Verdict: not_affected (code_not_present) \u2014 the fix is an upstream/vendor-authored commit (28badf7, Tatu Saloranta) already applied for the 2.7.9.4 release, which is an ancestor of the 2.7.9.7 HEAD. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "not_affected \u2014 Target is jackson-databind 2.7.9.7 (SHA 5568e5b), a TuxCare ELS build of the upstream 2.7 line. CVE-2018-12023 is a polymorphic-deserialization RCE gadget: with Default Typing enabled, an attacker supplies JSON naming an Oracle-JDBC/jodd gadget class whose instantiation performs a JNDI/LDAP lookup to an attacker server, executing a malicious payload. The upstream fix (#2052/#2058) adds those gadget class names to jackson-databind's deserialization denylist (SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES). All three fix classes are present in the target: jodd.db.connection.DataSourceConnectionProvider (line 64), oracle.jdbc.connector.OracleManagedConnectionFactory (line 67), oracle.jdbc.rowset.OracleJDBCRowSet (line 68). The enforcement method validateSubType() (lines 161-205) throws JsonMappingException for any denylisted class and is reachable on the deserialization path via BeanDeserializerFactory (line 145 -> _validateSubType 845 -> validateSubType 849). The vulnerable pre-fix state (missing denylist entries) is absent. Verdict: not_affected (code_not_present) \u2014 the fix is an upstream/vendor-authored commit (28badf7, Tatu Saloranta) already applied for the 2.7.9.4 release, which is an ancestor of the 2.7.9.7 HEAD. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.7.9.7. The upstream vendor fix (commit 87d29af25 by Tatu Saloranta) that adds \"org.slf4j.ext.EventData\" to the polymorphic deserialization blocklist was already included in version 2.7.9.7 when TuxCare onboarded it. The defense is active at SubTypeValidator.java:71 and blocks the malicious class from being instantiated during JSON deserialization with type information.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.7.9.7. The upstream vendor fix (commit 87d29af25 by Tatu Saloranta) that adds \"org.slf4j.ext.EventData\" to the polymorphic deserialization blocklist was already included in version 2.7.9.7 when TuxCare onboarded it. The defense is active at SubTypeValidator.java:71 and blocks the malicious class from being instantiated during JSON deserialization with type information." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind 2.7.9.7 (product match; not a false_positive). CVE-2018-14719 = RCE via failure to block the blaze-ds (flex.messaging) gadget class from polymorphic/default-typing deserialization. The specific gadget `flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor` is already present in the polymorphic-deserialization deny-list at SubTypeValidator.java:72 (databind#2097 block). The deny-list is on the live deserialization path: BeanDeserializerFactory.createBeanDeserializer -> _validateSubType (line 145) -> SubTypeValidator.instance().validateSubType() (line 849) -> deny-list check (SubTypeValidator.java:170) which throws JsonMappingException \"prevented for security reasons\" (line 203) when the incoming type name matches. The entry was added by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2018-08-16 in commit 0899726ec3 (2.6->2.7 merge of the #2097 fix), an ancestor of HEAD. This matches CVE metadata: fixed upstream in 2.7.9.5; target 2.7.9.7 inherits it. Because the fixing author domain (@iki.fi) is NOT in the TuxCare/CloudLinux allowlist, this is the not_affected vendor-fix sub-case (code_not_present), not already_fixed. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "not_affected \u2014 Target is jackson-databind 2.7.9.7 (product match; not a false_positive). CVE-2018-14719 = RCE via failure to block the blaze-ds (flex.messaging) gadget class from polymorphic/default-typing deserialization. The specific gadget `flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor` is already present in the polymorphic-deserialization deny-list at SubTypeValidator.java:72 (databind#2097 block). The deny-list is on the live deserialization path: BeanDeserializerFactory.createBeanDeserializer -> _validateSubType (line 145) -> SubTypeValidator.instance().validateSubType() (line 849) -> deny-list check (SubTypeValidator.java:170) which throws JsonMappingException \"prevented for security reasons\" (line 203) when the incoming type name matches. The entry was added by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2018-08-16 in commit 0899726ec3 (2.6->2.7 merge of the #2097 fix), an ancestor of HEAD. This matches CVE metadata: fixed upstream in 2.7.9.5; target 2.7.9.7 inherits it. Because the fixing author domain (@iki.fi) is NOT in the TuxCare/CloudLinux allowlist, this is the not_affected vendor-fix sub-case (code_not_present), not already_fixed. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.7.9.7 is NOT affected by CVE-2018-14720. The vulnerability was fixed by the upstream vendor (FasterXML) before this version was released. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are already present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 70-74), preventing polymorphic deserialization XXE attacks. TuxCare onboarded the upstream 2.7.9.7 release which already contained this fix from commit 0899726ec3 by upstream maintainer Tatu Saloranta.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "The target jackson-databind version 2.7.9.7 is NOT affected by CVE-2018-14720. The vulnerability was fixed by the upstream vendor (FasterXML) before this version was released. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are already present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 70-74), preventing polymorphic deserialization XXE attacks. TuxCare onboarded the upstream 2.7.9.7 release which already contained this fix from commit 0899726ec3 by upstream maintainer Tatu Saloranta." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target is not affected by CVE-2018-14721. The vulnerability requires the absence of `org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl` from the polymorphic deserialization blocklist, enabling SSRF attacks. However, this class is already present in the blocklist at SubTypeValidator.java:74. The fix was authored by upstream vendor Tatu Saloranta (commit 87d29af25) and was already included in jackson-databind 2.7.9.7 when TuxCare onboarded it. The blocklist is enforced via BeanDeserializerFactory._validateSubType() during bean deserialization, preventing instantiation of the dangerous class.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "The target is not affected by CVE-2018-14721. The vulnerability requires the absence of `org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl` from the polymorphic deserialization blocklist, enabling SSRF attacks. However, this class is already present in the blocklist at SubTypeValidator.java:74. The fix was authored by upstream vendor Tatu Saloranta (commit 87d29af25) and was already included in jackson-databind 2.7.9.7 when TuxCare onboarded it. The blocklist is enforced via BeanDeserializerFactory._validateSubType() during bean deserialization, preventing instantiation of the dangerous class." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 fix is present in target version 2.7.9.7. The vulnerability involved polymorphic deserialization of dangerous classes including org.apache.axis2.transport.jms.JMSOutTransportInfo. The fix (commit 42912cac4) adds these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was authored by upstream vendor (tatu.saloranta@iki.fi) and was already present in the upstream 2.7.9.7 release before TuxCare onboarded it. No TuxCare engineer created a backport for this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "CVE-2018-19360 fix is present in target version 2.7.9.7. The vulnerability involved polymorphic deserialization of dangerous classes including org.apache.axis2.transport.jms.JMSOutTransportInfo. The fix (commit 42912cac4) adds these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was authored by upstream vendor (tatu.saloranta@iki.fi) and was already present in the upstream 2.7.9.7 release before TuxCare onboarded it. No TuxCare engineer created a backport for this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2018-19361 is the jackson-databind polymorphic-deserialization blacklist gap for the OpenJPA gadget classes (databind#2186), fixed upstream in 2.9.8 and backported upstream to the 2.7.9.x line. The target is jackson-databind 2.7.9.7 (TuxCare ELS branch tuxcare-current/2.7.9.7 at 5568e5bf). The fix is ALREADY PRESENT: src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java lines 76-80 contain the exact [databind#2186] additions, including both OpenJPA gadgets:\n s.add(\"org.apache.openjpa.ee.RegistryManagedRuntime\"); (line 78)\n s.add(\"org.apache.openjpa.ee.JNDIManagedRuntime\"); (line 79)\nand validateSubType() enforces the deny-list at line 170 (_cfgIllegalClassNames.contains(full) -> throws \"Illegal type ... prevented for security reasons\"). The vulnerable pattern (absence of these blacklist entries) is not present in HEAD.\nAttribution: git blame shows lines 78-79 authored by Tatu Saloranta (upstream FasterXML) in commit 42912cac \"Backport #2186 to 2.7.9[.5]\", 2018-11-23. That commit is an ancestor of the onboard commit cc87ef89e, so the fix arrived with the upstream 2.7.9.7 baseline, not via a TuxCare backport. The only TuxCare backports on this branch are CVE-2020-25649 and CVE-2020-36184. Therefore this is an upstream/vendor fix baked into the shipped version -> not_affected + code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "not_affected \u2014 CVE-2018-19361 is the jackson-databind polymorphic-deserialization blacklist gap for the OpenJPA gadget classes (databind#2186), fixed upstream in 2.9.8 and backported upstream to the 2.7.9.x line. The target is jackson-databind 2.7.9.7 (TuxCare ELS branch tuxcare-current/2.7.9.7 at 5568e5bf). The fix is ALREADY PRESENT: src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java lines 76-80 contain the exact [databind#2186] additions, including both OpenJPA gadgets:\n s.add(\"org.apache.openjpa.ee.RegistryManagedRuntime\"); (line 78)\n s.add(\"org.apache.openjpa.ee.JNDIManagedRuntime\"); (line 79)\nand validateSubType() enforces the deny-list at line 170 (_cfgIllegalClassNames.contains(full) -> throws \"Illegal type ... prevented for security reasons\"). The vulnerable pattern (absence of these blacklist entries) is not present in HEAD.\nAttribution: git blame shows lines 78-79 authored by Tatu Saloranta (upstream FasterXML) in commit 42912cac \"Backport #2186 to 2.7.9[.5]\", 2018-11-23. That commit is an ancestor of the onboard commit cc87ef89e, so the fix arrived with the upstream 2.7.9.7 baseline, not via a TuxCare backport. The only TuxCare backports on this branch are CVE-2020-25649 and CVE-2020-36184. Therefore this is an upstream/vendor fix baked into the shipped version -> not_affected + code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind version 2.7.9.7) is not affected by CVE-2018-19362. The vulnerability fix that adds blacklist entries for org.jboss.util.propertyeditor.DocumentEditor and three other gadget classes was already present in the upstream jackson-databind 2.7.9.7 release that TuxCare onboarded. The fix was authored by the upstream maintainer Tatu Saloranta in commit 42912cac4 as part of the upstream 2.7.9.5 release, and was inherited by subsequent releases including 2.7.9.7.", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "The target repository (jackson-databind version 2.7.9.7) is not affected by CVE-2018-19362. The vulnerability fix that adds blacklist entries for org.jboss.util.propertyeditor.DocumentEditor and three other gadget classes was already present in the upstream jackson-databind 2.7.9.7 release that TuxCare onboarded. The fix was authored by the upstream maintainer Tatu Saloranta in commit 42912cac4 as part of the upstream 2.7.9.5 release, and was inherited by subsequent releases including 2.7.9.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-23T10:53:50.260427+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.7.9.7 is not vulnerable as it is higher than upstream fix version - 2.7.9.5", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "Jackson Databind 2.7.9.7 is not vulnerable as it is higher than upstream fix version - 2.7.9.5" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 affects jackson-databind 2.7.x before 2.7.9.3. The target is version 2.7.9.7, which already contains the upstream vendor fix (commit 6799f8f10 by Tatu Saloranta). The c3p0 DataSource deserialization blocking logic is present in SubTypeValidator.java:189-199, rejecting any class matching \"com.mchange.v2.c3p0.*DataSource\". This fix was included in the upstream release 2.7.9.3 and was already present when TuxCare onboarded version 2.7.9.7. No TuxCare-specific backport exists for this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7489" }, "impact_statement": "CVE-2018-7489 affects jackson-databind 2.7.x before 2.7.9.3. The target is version 2.7.9.7, which already contains the upstream vendor fix (commit 6799f8f10 by Tatu Saloranta). The c3p0 DataSource deserialization blocking logic is present in SubTypeValidator.java:189-199, rejecting any class matching \"com.mchange.v2.c3p0.*DataSource\". This fix was included in the upstream release 2.7.9.3 and was already present when TuxCare onboarded version 2.7.9.7. No TuxCare-specific backport exists for this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is not affecting this target. The vulnerability involves polymorphic deserialization of HikariCP configuration classes (HikariConfig and HikariDataSource) that can lead to property-based exploitation. The upstream vendor (Tatu Saloranta) added both classes to the deserialization blacklist in commit bbdbc40029 (Oct 15, 2019), which was included in the upstream jackson-databind 2.7.9.7 release (March 10, 2020). TuxCare onboarded version 2.7.9.7 with this fix already present. The blacklist is enforced via SubTypeValidator.validateSubType() called during bean deserialization, preventing instantiation of these dangerous classes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 is not affecting this target. The vulnerability involves polymorphic deserialization of HikariCP configuration classes (HikariConfig and HikariDataSource) that can lead to property-based exploitation. The upstream vendor (Tatu Saloranta) added both classes to the deserialization blacklist in commit bbdbc40029 (Oct 15, 2019), which was included in the upstream jackson-databind 2.7.9.7 release (March 10, 2020). TuxCare onboarded version 2.7.9.7 with this fix already present. The blacklist is enforced via SubTypeValidator.validateSubType() called during bean deserialization, preventing instantiation of these dangerous classes." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.7.9.7. The upstream vendor fix (commit bbdbc4002 by Tatu Saloranta) that blocks polymorphic deserialization of commons-configuration JNDI classes is already present in the target. The two dangerous classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) are on the deserialization blocklist in SubTypeValidator.java at lines 107-108, preventing the attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.7.9.7. The upstream vendor fix (commit bbdbc4002 by Tatu Saloranta) that blocks polymorphic deserialization of commons-configuration JNDI classes is already present in the target. The two dangerous classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) are on the deserialization blocklist in SubTypeValidator.java at lines 107-108, preventing the attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 affects jackson-databind's polymorphic deserialization, allowing remote code execution via the HikariDataSource gadget class. The target version 2.7.9.7 is NOT vulnerable because the upstream vendor fix is already present. The fix (commit bbdbc40029b10f19710d8510695018c170457fc5 by Tatu Saloranta, Oct 15 2019) adds com.zaxxer.hikari.HikariDataSource to SubTypeValidator's blocklist, preventing deserialization of this gadget type. This fix was included in the upstream 2.7.9.7 release before TuxCare onboarded the version, making this a vendor-fix case of not_affected rather than a TuxCare backport.", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "CVE-2019-16335 affects jackson-databind's polymorphic deserialization, allowing remote code execution via the HikariDataSource gadget class. The target version 2.7.9.7 is NOT vulnerable because the upstream vendor fix is already present. The fix (commit bbdbc40029b10f19710d8510695018c170457fc5 by Tatu Saloranta, Oct 15 2019) adds com.zaxxer.hikari.HikariDataSource to SubTypeValidator's blocklist, preventing deserialization of this gadget type. This fix was included in the upstream 2.7.9.7 release before TuxCare onboarded the version, making this a vendor-fix case of not_affected rather than a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target repository is NOT vulnerable to CVE-2019-16942. The fix preventing deserialization of malicious commons-dbcp datasource classes is present in SubTypeValidator.java (lines 113-116). The vulnerable classes SharedPoolDataSource, PerUserPoolDataSource, and P6DataSource are all blocked. This fix was included in upstream jackson-databind version 2.7.9.7 (released March 10, 2020) which TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta, not by TuxCare.", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "Target repository is NOT vulnerable to CVE-2019-16942. The fix preventing deserialization of malicious commons-dbcp datasource classes is present in SubTypeValidator.java (lines 113-116). The vulnerable classes SharedPoolDataSource, PerUserPoolDataSource, and P6DataSource are all blocked. This fix was included in upstream jackson-databind version 2.7.9.7 (released March 10, 2020) which TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta, not by TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT PRESENT in jackson-databind 2.7.9.7. The vulnerability affects polymorphic deserialization when Default Typing is enabled, allowing RCE via gadget classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource). The fix blocklists these dangerous classes in SubTypeValidator. This fix is already present in the target at SubTypeValidator.java lines 113-116, having been included in the upstream 2.7.9.7 release (March 2020) that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta (commit bbdbc40029, Oct 2019), not by TuxCare. No separate TuxCare backport of CVE-2019-16943 exists. This is the vendor-fix sub-case of not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16943" }, "impact_statement": "CVE-2019-16943 is NOT PRESENT in jackson-databind 2.7.9.7. The vulnerability affects polymorphic deserialization when Default Typing is enabled, allowing RCE via gadget classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource). The fix blocklists these dangerous classes in SubTypeValidator. This fix is already present in the target at SubTypeValidator.java lines 113-116, having been included in the upstream 2.7.9.7 release (March 2020) that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta (commit bbdbc40029, Oct 2019), not by TuxCare. No separate TuxCare backport of CVE-2019-16943 exists. This is the vendor-fix sub-case of not_affected." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2019-17267 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17267" }, "action_statement": "Vulnerability CVE-2019-17267 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is upstream jackson-databind 2.7.9.7 (TuxCare-onboarded). CVE-2019-17531 is a polymorphic-typing RCE: with default typing enabled and apache-log4j-extra 1.2.x on the classpath, attacker JSON can name a log4j-extras gadget (DriverManagerConnectionSource / JNDIConnectionSource) that performs an attacker-directed JNDI lookup, yielding RCE. The vendor patch (b5a304a, databind#2498) blocks this by adding the two gadget class names to SubTypeValidator's deserialization deny list.\n\nThe target ALREADY contains both exact deny-list strings at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:119-120, enforced by validateSubType() (line 170: _cfgIllegalClassNames.contains(full) throws before instantiation). The vulnerable pattern (gadget instantiable via default typing) is therefore absent.\n\nAttribution: the fix commit bbdbc40 is authored by upstream maintainer Tatu Saloranta and is an ancestor of the pristine upstream jackson-databind-2.7.9.7 release commit e8697cdbf; upstream 2.7.9.7 release notes explicitly list \"#2498 ... CVE-2019-17531\". This is an UPSTREAM/vendor fix already shipped in the onboarded version \u2014 not a TuxCare backport. TuxCare's backports in this repo target only CVE-2020-25649 and CVE-2020-36184. Verdict: not_affected (vendor-fix already present), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17531" }, "impact_statement": "not_affected \u2014 Target is upstream jackson-databind 2.7.9.7 (TuxCare-onboarded). CVE-2019-17531 is a polymorphic-typing RCE: with default typing enabled and apache-log4j-extra 1.2.x on the classpath, attacker JSON can name a log4j-extras gadget (DriverManagerConnectionSource / JNDIConnectionSource) that performs an attacker-directed JNDI lookup, yielding RCE. The vendor patch (b5a304a, databind#2498) blocks this by adding the two gadget class names to SubTypeValidator's deserialization deny list.\n\nThe target ALREADY contains both exact deny-list strings at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:119-120, enforced by validateSubType() (line 170: _cfgIllegalClassNames.contains(full) throws before instantiation). The vulnerable pattern (gadget instantiable via default typing) is therefore absent.\n\nAttribution: the fix commit bbdbc40 is authored by upstream maintainer Tatu Saloranta and is an ancestor of the pristine upstream jackson-databind-2.7.9.7 release commit e8697cdbf; upstream 2.7.9.7 release notes explicitly list \"#2498 ... CVE-2019-17531\". This is an UPSTREAM/vendor fix already shipped in the onboarded version \u2014 not a TuxCare backport. TuxCare's backports in this repo target only CVE-2020-25649 and CVE-2020-36184. Verdict: not_affected (vendor-fix already present), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.7.9.7 already contains the upstream vendor's fix for CVE-2019-20330. The two ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and net.sf.ehcache.transaction.manager.selector.GlassfishSelector) are present in the deserialization blocklist at SubTypeValidator.java:122-124. The fix was authored by upstream maintainer Tatu Saloranta and was part of the upstream 2.7.9.7 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20330" }, "impact_statement": "Target version 2.7.9.7 already contains the upstream vendor's fix for CVE-2019-20330. The two ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and net.sf.ehcache.transaction.manager.selector.GlassfishSelector) are present in the deserialization blocklist at SubTypeValidator.java:122-124. The fix was authored by upstream maintainer Tatu Saloranta and was part of the upstream 2.7.9.7 release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-10650 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10650" }, "action_statement": "Vulnerability CVE-2020-10650 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-10672 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10672" }, "action_statement": "Vulnerability CVE-2020-10672 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-10673 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10673" }, "action_statement": "Vulnerability CVE-2020-10673 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind 2.7.9.7 (TuxCare ELS; product-identity confirmed via pom.xml artifactId/groupId). CVE-2020-10969 (databind#2642) is fixed upstream by adding \"javax.swing.JEditorPane\" to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES deny-list, so validateSubType() throws \"Illegal type ... prevented for security reasons\" before that gadget class is instantiated during polymorphic/default-typing deserialization. The target's SubTypeValidator.java already contains this exact entry at line 137, and validateSubType() (line 170) consults that set (line 153). git blame attributes lines 136-137 to upstream commit 6ba4845798 \"Fix #2642\" by Tatu Saloranta (tatu.saloranta@iki.fi), one of the two patch commits provided in this task; it is an ancestor of HEAD, arriving via the onboard/2.7.9.7 baseline import \u2014 NOT a TuxCare backport (no backport/CVE-2020-10969 branch exists; genuine TuxCare backports in this repo use backport/CVE-XXXX branches, e.g. CVE-2020-25649, CVE-2020-36184). The vulnerable pre-fix pattern (deny-list missing this entry) is therefore absent from HEAD. Verdict: not_affected / code_not_present (upstream fix baked into the shipped version). Not already_fixed, because the fix is upstream-authored (iki.fi), not a CloudLinux/TuxCare backport. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10969" }, "impact_statement": "not_affected \u2014 Target is jackson-databind 2.7.9.7 (TuxCare ELS; product-identity confirmed via pom.xml artifactId/groupId). CVE-2020-10969 (databind#2642) is fixed upstream by adding \"javax.swing.JEditorPane\" to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES deny-list, so validateSubType() throws \"Illegal type ... prevented for security reasons\" before that gadget class is instantiated during polymorphic/default-typing deserialization. The target's SubTypeValidator.java already contains this exact entry at line 137, and validateSubType() (line 170) consults that set (line 153). git blame attributes lines 136-137 to upstream commit 6ba4845798 \"Fix #2642\" by Tatu Saloranta (tatu.saloranta@iki.fi), one of the two patch commits provided in this task; it is an ancestor of HEAD, arriving via the onboard/2.7.9.7 baseline import \u2014 NOT a TuxCare backport (no backport/CVE-2020-10969 branch exists; genuine TuxCare backports in this repo use backport/CVE-XXXX branches, e.g. CVE-2020-25649, CVE-2020-36184). The vulnerable pre-fix pattern (deny-list missing this entry) is therefore absent from HEAD. Verdict: not_affected / code_not_present (upstream fix baked into the shipped version). Not already_fixed, because the fix is upstream-authored (iki.fi), not a CloudLinux/TuxCare backport. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-11111 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11111" }, "action_statement": "Vulnerability CVE-2020-11111 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-11112 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11112" }, "action_statement": "Vulnerability CVE-2020-11112 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-11113 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11113" }, "action_statement": "Vulnerability CVE-2020-11113 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-11619 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11619" }, "action_statement": "Vulnerability CVE-2020-11619 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-14060 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" }, "action_statement": "Vulnerability CVE-2020-14060 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-14061 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" }, "action_statement": "Vulnerability CVE-2020-14061 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-14062 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" }, "action_statement": "Vulnerability CVE-2020-14062 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-14195 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14195" }, "action_statement": "Vulnerability CVE-2020-14195 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-24616 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" }, "action_statement": "Vulnerability CVE-2020-24616 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-24750 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" }, "action_statement": "Vulnerability CVE-2020-24750 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-35491 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" }, "action_statement": "Vulnerability CVE-2020-35491 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-35728 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" }, "action_statement": "Vulnerability CVE-2020-35728 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-36183 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" }, "action_statement": "Vulnerability CVE-2020-36183 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:27:00.106913+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-36187 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" }, "action_statement": "Vulnerability CVE-2020-36187 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-36189 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" }, "action_statement": "Vulnerability CVE-2020-36189 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is not present in jackson-databind 2.7.9.7. The upstream vendor (FasterXML) fixed this vulnerability by adding org.apache.xbean.propertyeditor.JndiConverter to the deserialization blocklist in SubTypeValidator.java. This fix (commit 9bb52c712) was authored by Tatu Saloranta on Feb 9, 2020 and was already present when TuxCare onboarded version 2.7.9.7. The CVE explicitly states that 2.7.x versions before 2.7.9.7 are vulnerable, confirming that 2.7.9.7 is the first fixed version.", "vulnerability": { "name": "CVE-2020-8840" }, "impact_statement": "CVE-2020-8840 is not present in jackson-databind 2.7.9.7. The upstream vendor (FasterXML) fixed this vulnerability by adding org.apache.xbean.propertyeditor.JndiConverter to the deserialization blocklist in SubTypeValidator.java. This fix (commit 9bb52c712) was authored by Tatu Saloranta on Feb 9, 2020 and was already present when TuxCare onboarded version 2.7.9.7. The CVE explicitly states that 2.7.x versions before 2.7.9.7 are vulnerable, confirming that 2.7.9.7 is the first fixed version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind 2.7.9.7 (product identity matches CVE-2020-9546 \u2014 same project, so not a false_positive). CVE-2020-9546 is a polymorphic/default-typing deserialization gadget flaw; the upstream fix adds the gadget FQCN 'org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig' to SubTypeValidator's deny list so it is rejected before instantiation. The target ALREADY contains this exact fix at SubTypeValidator.java:130 (with the companion #2634 gadgets JtaTransactionConfig and AnterosDBCPConfig at lines 133-134). The deny list is enforced on the deserialization path: BeanDeserializerFactory.buildBeanDeserializer (:145) -> _validateSubType (:849) -> SubTypeValidator.validateSubType (:161-205), which throws JsonMappingException (\"Illegal type ... prevented for security reasons\") when a class is in _cfgIllegalClassNames. git blame shows line 130 was authored by upstream commit 1e64db6a2f (Tatu Saloranta, tatu.saloranta@iki.fi) \u2014 the literal upstream patch commit \u2014 and it is baseline code present in both parents of the TuxCare onboard merge, i.e. an upstream vendor fix baked into the shipped version, not a TuxCare backport. No CVE-2020-9546 backport branch/MR/Jira exists. Verdict: not_affected (upstream fix already applied); justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9546" }, "impact_statement": "not_affected \u2014 Target is jackson-databind 2.7.9.7 (product identity matches CVE-2020-9546 \u2014 same project, so not a false_positive). CVE-2020-9546 is a polymorphic/default-typing deserialization gadget flaw; the upstream fix adds the gadget FQCN 'org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig' to SubTypeValidator's deny list so it is rejected before instantiation. The target ALREADY contains this exact fix at SubTypeValidator.java:130 (with the companion #2634 gadgets JtaTransactionConfig and AnterosDBCPConfig at lines 133-134). The deny list is enforced on the deserialization path: BeanDeserializerFactory.buildBeanDeserializer (:145) -> _validateSubType (:849) -> SubTypeValidator.validateSubType (:161-205), which throws JsonMappingException (\"Illegal type ... prevented for security reasons\") when a class is in _cfgIllegalClassNames. git blame shows line 130 was authored by upstream commit 1e64db6a2f (Tatu Saloranta, tatu.saloranta@iki.fi) \u2014 the literal upstream patch commit \u2014 and it is baseline code present in both parents of the TuxCare onboard merge, i.e. an upstream vendor fix baked into the shipped version, not a TuxCare backport. No CVE-2020-9546 backport branch/MR/Jira exists. Verdict: not_affected (upstream fix already applied); justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2021-20190 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" }, "action_statement": "Vulnerability CVE-2021-20190 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2022-42003 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" }, "action_statement": "Vulnerability CVE-2022-42003 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:27:00.106913+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2026-50193 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" }, "action_statement": "Vulnerability CVE-2026-50193 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Version 2.7.9.7 is not affected by CVE-2026-54512. This CVE describes a vulnerability in PolymorphicTypeValidator (PTV) where generic type parameters bypass allowlist validation. PTV was introduced in version 2.10.0, and 2.7.9.7 predates this security feature entirely. The CVE explicitly states the affected range is \"From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4.\" Version 2.7.9.7 uses SubTypeValidator, a blocklist-based security mechanism that validates all bean classes individually, including those used as type parameters, preventing the attack pattern described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.7.9.7 is not affected by CVE-2026-54512. This CVE describes a vulnerability in PolymorphicTypeValidator (PTV) where generic type parameters bypass allowlist validation. PTV was introduced in version 2.10.0, and 2.7.9.7 predates this security feature entirely. The CVE explicitly states the affected range is \"From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4.\" Version 2.7.9.7 uses SubTypeValidator, a blocklist-based security mechanism that validates all bean classes individually, including those used as type parameters, preventing the attack pattern described in the CVE." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:27:00.106913+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2026-54515 does not affect version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.7.9.7 is NOT AFFECTED. The vulnerability (CVE-2026-54515) requires per-property @JsonFormat(with = ACCEPT_CASE_INSENSITIVE_PROPERTIES) feature to trigger a BeanPropertyMap rebuild in BeanDeserializerBase.createContextual() that accidentally uses the unfiltered _beanProperties instead of the filtered contextual._beanProperties, thereby restoring @JsonIgnoreProperties-excluded pr...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54515" }, "impact_statement": "not_affected \u2014 Target version 2.7.9.7 is NOT AFFECTED. The vulnerability (CVE-2026-54515) requires per-property @JsonFormat(with = ACCEPT_CASE_INSENSITIVE_PROPERTIES) feature to trigger a BeanPropertyMap rebuild in BeanDeserializerBase.createContextual() that accidentally uses the unfiltered _beanProperties instead of the filtered contextual._beanProperties, thereby restoring @JsonIgnoreProperties-excluded pr..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:27:00.106913+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:26:05.576051+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" }, "action_statement": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.7.9.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." } ] }