{ "@id": "urn:uuid:baa25eb5-0669-4970-8e34-5e25a4bf0d0d", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-19T20:18:00.107592+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-14540 is a jackson-databind polymorphic-typing deserialization gadget issue: with default/polymorphic typing enabled, a JSON payload naming com.zaxxer.hikari.HikariConfig as a type id could be instantiated as a gadget. The upstream fix adds that class name to the SubTypeValidator deny-list so validateSubType rejects it before instantiation. The target is jackson-databind 2.9.10.7 (pom: 2.9.10.20201202), which is AFTER the fixed 2.9.10 release (CVE affects \"before 2.9.10\"). The defense is present in HEAD: SubTypeValidator.java line 105 `s.add(\"com.zaxxer.hikari.HikariConfig\");` (plus line 107 HikariDataSource). git blame ties these exact lines to upstream commits d4983c740f and 73c1c2cc76 \u2014 the two patch commits named in this task \u2014 both authored and committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in 2019 and both ancestors of HEAD. Enforcement is intact: validateSubType() (line 249) checks _cfgIllegalClassNames.contains(full) and throws \"Illegal type (...) to deserialize: prevented for security reasons\" (line 283) before any instantiation. Attribution: this is an UPSTREAM/vendor fix (not a TuxCare/CloudLinux-authored backport), so the correct verdict is not_affected with justification code_not_present rather than already_fixed. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "not_affected \u2014 CVE-2019-14540 is a jackson-databind polymorphic-typing deserialization gadget issue: with default/polymorphic typing enabled, a JSON payload naming com.zaxxer.hikari.HikariConfig as a type id could be instantiated as a gadget. The upstream fix adds that class name to the SubTypeValidator deny-list so validateSubType rejects it before instantiation. The target is jackson-databind 2.9.10.7 (pom: 2.9.10.20201202), which is AFTER the fixed 2.9.10 release (CVE affects \"before 2.9.10\"). The defense is present in HEAD: SubTypeValidator.java line 105 `s.add(\"com.zaxxer.hikari.HikariConfig\");` (plus line 107 HikariDataSource). git blame ties these exact lines to upstream commits d4983c740f and 73c1c2cc76 \u2014 the two patch commits named in this task \u2014 both authored and committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in 2019 and both ancestors of HEAD. Enforcement is intact: validateSubType() (line 249) checks _cfgIllegalClassNames.contains(full) and throws \"Illegal type (...) to deserialize: prevented for security reasons\" (line 283) before any instantiation. Attribution: this is an UPSTREAM/vendor fix (not a TuxCare/CloudLinux-authored backport), so the correct verdict is not_affected with justification code_not_present rather than already_fixed. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is not a vulnerability in this target. The fix is present in the code (SubTypeValidator.java lines 112-114 blocklisting org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration). The fix was authored by the upstream vendor (Tatu Saloranta, tatu.saloranta@iki.fi) as part of jackson-databind 2.9.10 release and inherited by TuxCare when onboarding version 2.9.10.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "CVE-2019-14892 is not a vulnerability in this target. The fix is present in the code (SubTypeValidator.java lines 112-114 blocklisting org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration). The fix was authored by the upstream vendor (Tatu Saloranta, tatu.saloranta@iki.fi) as part of jackson-databind 2.9.10 release and inherited by TuxCare when onboarding version 2.9.10.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-14893 (jackson-databind#2469) is a polymorphic-deserialization gadget CVE. The vendor fix (commit 998efd708284778f29d83d7962a9bd935c228317, author Tatu Saloranta / upstream FasterXML) adds a single deny-list entry \u2014 org.apache.xalan.lib.sql.JNDIConnectionPool \u2014 to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java so the xalan2 JNDI gadget cannot be instantiated during default/@JsonTypeInfo(Id.CLASS|MINIMAL_CLASS) deserialization. The target (com.fasterxml.jackson.core:jackson-databind 2.9.10.7, TuxCare ELS fork) ALREADY contains that exact deny-list entry at SubTypeValidator.java:116-117. The entry is on the live deserialization path: validateSubType() (line 239) is invoked from BeanDeserializerFactory.buildBeanDeserializer via _validateSubType (lines 135/919); at line 249 it matches the class name against _cfgIllegalClassNames (=DEFAULT_NO_DESER_CLASS_NAMES) and, on match, throws JsonMappingException (\"prevented for security reasons\", line 282) before instantiation. git blame shows the line was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-09-19 in the very commit that is the vendor patch, and it entered this repo via the wholesale \"Onboard version 2.9.10.7\" import \u2014 NOT via a TuxCare CVE-2019-14893 backport (the only TuxCare backport merge present is for CVE-2020-36182). The vulnerable pattern (missing deny entry) is therefore absent in HEAD due to an upstream-authored fix already shipped in this version. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "not_affected \u2014 CVE-2019-14893 (jackson-databind#2469) is a polymorphic-deserialization gadget CVE. The vendor fix (commit 998efd708284778f29d83d7962a9bd935c228317, author Tatu Saloranta / upstream FasterXML) adds a single deny-list entry \u2014 org.apache.xalan.lib.sql.JNDIConnectionPool \u2014 to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java so the xalan2 JNDI gadget cannot be instantiated during default/@JsonTypeInfo(Id.CLASS|MINIMAL_CLASS) deserialization. The target (com.fasterxml.jackson.core:jackson-databind 2.9.10.7, TuxCare ELS fork) ALREADY contains that exact deny-list entry at SubTypeValidator.java:116-117. The entry is on the live deserialization path: validateSubType() (line 239) is invoked from BeanDeserializerFactory.buildBeanDeserializer via _validateSubType (lines 135/919); at line 249 it matches the class name against _cfgIllegalClassNames (=DEFAULT_NO_DESER_CLASS_NAMES) and, on match, throws JsonMappingException (\"prevented for security reasons\", line 282) before instantiation. git blame shows the line was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-09-19 in the very commit that is the vendor patch, and it entered this repo via the wholesale \"Onboard version 2.9.10.7\" import \u2014 NOT via a TuxCare CVE-2019-14893 backport (the only TuxCare backport merge present is for CVE-2020-36182). The vulnerable pattern (missing deny entry) is therefore absent in HEAD due to an upstream-authored fix already shipped in this version. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-16335 is a jackson-databind polymorphic-typing (deserialization gadget) issue exploited via the com.zaxxer.hikari.HikariDataSource class when default typing is enabled. The upstream fix (commit 73c1c2cc7, \"Fix #2449\") adds the FQCN \"com.zaxxer.hikari.HikariDataSource\" to the SubTypeValidator deny-list. The target repo (jackson-databind 2.9.10.7, HEAD e36043f6e) ALREADY CONTAINS this exact deny-list entry at SubTypeValidator.java:107, and git history confirms the line was introduced by the very same upstream patch commit (73c1c2cc7), which is an ancestor of HEAD via the onboarded upstream 2.9.10 baseline. The deny-list is actively consumed: validateSubType() checks _cfgIllegalClassNames.contains(full) and throws \"Illegal type ... prevented for security reasons\" for any listed class. The defense is on the deserialization execution path and blocks the Brief's Input from reaching the Goal. The fix is upstream-vendor-authored (Tatu Saloranta, iki.fi), NOT a TuxCare/CloudLinux backport \u2014 so verdict is not_affected (vendor fix already in shipped version), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "not_affected \u2014 CVE-2019-16335 is a jackson-databind polymorphic-typing (deserialization gadget) issue exploited via the com.zaxxer.hikari.HikariDataSource class when default typing is enabled. The upstream fix (commit 73c1c2cc7, \"Fix #2449\") adds the FQCN \"com.zaxxer.hikari.HikariDataSource\" to the SubTypeValidator deny-list. The target repo (jackson-databind 2.9.10.7, HEAD e36043f6e) ALREADY CONTAINS this exact deny-list entry at SubTypeValidator.java:107, and git history confirms the line was introduced by the very same upstream patch commit (73c1c2cc7), which is an ancestor of HEAD via the onboarded upstream 2.9.10 baseline. The deny-list is actively consumed: validateSubType() checks _cfgIllegalClassNames.contains(full) and throws \"Illegal type ... prevented for security reasons\" for any listed class. The defense is on the deserialization execution path and blocks the Brief's Input from reaching the Goal. The fix is upstream-vendor-authored (Tatu Saloranta, iki.fi), NOT a TuxCare/CloudLinux backport \u2014 so verdict is not_affected (vendor fix already in shipped version), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-17267 is a jackson-databind polymorphic-typing (default typing) deserialization-gadget issue involving net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. Upstream fixed it in 2.9.10 / 2.8.11.5 (patch commit 191a4cdf8, GitHub issue #2460) by adding that class name to the SubTypeValidator deny list. The target is jackson-databind 2.9.10.7 (com.fasterxml.jackson.core:jackson-databind) \u2014 same product, a later patch release than the fixed 2.9.10. The deny-list entry is present verbatim at SubTypeValidator.java:99 (\"s.add(\\\"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\\\");\") under the \"[databind#2387], [databind#2460]: EHCache\" comment (line 97), i.e. the exact post-fix state. The enforcement path is intact: validateSubType() (line 239) tests _cfgIllegalClassNames.contains(full) (line 249, backed by DEFAULT_NO_DESER_CLASS_NAMES at line 225/231) and, on a match, breaks to reportBadTypeDefinition(\"Illegal type (%s) to deserialize: prevented for security reasons\", line 282), preventing instantiation. git blame/log shows line 99 was introduced by upstream commit 191a4cdf8 authored by Tatu Saloranta \u2014 the jackson maintainer, not a TuxCare/CloudLinux domain. The fix is baked into the shipped version, so the vulnerable pre-fix pattern (gadget absent from deny list) is not present in HEAD. Verdict: not_affected (upstream/vendor fix already applied), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "not_affected \u2014 CVE-2019-17267 is a jackson-databind polymorphic-typing (default typing) deserialization-gadget issue involving net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. Upstream fixed it in 2.9.10 / 2.8.11.5 (patch commit 191a4cdf8, GitHub issue #2460) by adding that class name to the SubTypeValidator deny list. The target is jackson-databind 2.9.10.7 (com.fasterxml.jackson.core:jackson-databind) \u2014 same product, a later patch release than the fixed 2.9.10. The deny-list entry is present verbatim at SubTypeValidator.java:99 (\"s.add(\\\"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\\\");\") under the \"[databind#2387], [databind#2460]: EHCache\" comment (line 97), i.e. the exact post-fix state. The enforcement path is intact: validateSubType() (line 239) tests _cfgIllegalClassNames.contains(full) (line 249, backed by DEFAULT_NO_DESER_CLASS_NAMES at line 225/231) and, on a match, breaks to reportBadTypeDefinition(\"Illegal type (%s) to deserialize: prevented for security reasons\", line 282), preventing instantiation. git blame/log shows line 99 was introduced by upstream commit 191a4cdf8 authored by Tatu Saloranta \u2014 the jackson maintainer, not a TuxCare/CloudLinux domain. The fix is baked into the shipped version, so the vulnerable pre-fix pattern (gadget absent from deny list) is not present in HEAD. Verdict: not_affected (upstream/vendor fix already applied), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is com.fasterxml.jackson.core:jackson-databind 2.9.10.7 \u2014 exactly the product CVE-2020-25649 concerns (Product-Identity Check passes; not false_positive). CVE-2020-25649 is an XXE flaw: Jackson's DOMDeserializer parsed attacker-supplied XML (a JSON string value bound to org.w3c.dom.Node/Document) into a DOM using a DocumentBuilderFactory that did not disable DOCTYPE/external-entity processing, allowing external entity resolution (local file read / SSRF / integrity impact). The upstream fix (issue #2589) hardens the shared DEFAULT_PARSER_FACTORY in DOMDeserializer.java. At HEAD, DOMDeserializer.java (the ONLY XML-parsing sink in the entire main source) already contains the complete fix: setExpandEntityReferences(false) (#1279), FEATURE_SECURE_PROCESSING=true, and the #2589 additions disallow-doctype-decl=true and load-external-dtd=false. disallow-doctype-decl=true makes the parser throw on any DOCTYPE, structurally eliminating entity declarations and XXE. The fix commit 3d932709abd0b5390efe67451653fc9efa9db677 is an ancestor of HEAD and of the onboard baseline, authored upstream by FasterXML (jon@jrg.me.uk / tatu.saloranta@iki.fi), not TuxCare. Because the vulnerable pattern is not present in the shipped version (upstream fix baked in), verdict is not_affected with justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "not_affected \u2014 Target is com.fasterxml.jackson.core:jackson-databind 2.9.10.7 \u2014 exactly the product CVE-2020-25649 concerns (Product-Identity Check passes; not false_positive). CVE-2020-25649 is an XXE flaw: Jackson's DOMDeserializer parsed attacker-supplied XML (a JSON string value bound to org.w3c.dom.Node/Document) into a DOM using a DocumentBuilderFactory that did not disable DOCTYPE/external-entity processing, allowing external entity resolution (local file read / SSRF / integrity impact). The upstream fix (issue #2589) hardens the shared DEFAULT_PARSER_FACTORY in DOMDeserializer.java. At HEAD, DOMDeserializer.java (the ONLY XML-parsing sink in the entire main source) already contains the complete fix: setExpandEntityReferences(false) (#1279), FEATURE_SECURE_PROCESSING=true, and the #2589 additions disallow-doctype-decl=true and load-external-dtd=false. disallow-doctype-decl=true makes the parser throw on any DOCTYPE, structurally eliminating entity declarations and XXE. The fix commit 3d932709abd0b5390efe67451653fc9efa9db677 is an ancestor of HEAD and of the onboard baseline, authored upstream by FasterXML (jon@jrg.me.uk / tatu.saloranta@iki.fi), not TuxCare. Because the vulnerable pattern is not present in the shipped version (upstream fix baked in), verdict is not_affected with justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2020-35728 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" }, "action_statement": "Vulnerability CVE-2020-35728 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2020-36189 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" }, "action_statement": "Vulnerability CVE-2020-36189 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2022-42004 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" }, "action_statement": "Vulnerability CVE-2022-42004 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.10.7 is NOT affected by CVE-2026-54512. This version predates the introduction of PolymorphicTypeValidator (added in 2.10.0), which is the security mechanism containing the vulnerability. The vulnerable method `_resolveAndValidateGeneric()` does not exist in this version. While the target does process polymorphic type identifiers with generic parameters via `resolveSubType()`, the specific attack goal\u2014bypassing a configured PolymorphicTypeValidator allowlist\u2014cannot be reached because PolymorphicTypeValidator does not exist in this version. Only blacklist-based validation exists via SubTypeValidator.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.9.10.7 is NOT affected by CVE-2026-54512. This version predates the introduction of PolymorphicTypeValidator (added in 2.10.0), which is the security mechanism containing the vulnerability. The vulnerable method `_resolveAndValidateGeneric()` does not exist in this version. While the target does process polymorphic type identifiers with generic parameters via `resolveSubType()`, the specific attack goal\u2014bypassing a configured PolymorphicTypeValidator allowlist\u2014cannot be reached because PolymorphicTypeValidator does not exist in this version. Only blacklist-based validation exists via SubTypeValidator." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2026-54515 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" }, "action_statement": "Vulnerability CVE-2026-54515 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2026-77310 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" }, "action_statement": "Vulnerability CVE-2026-77310 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2026-91776 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" }, "action_statement": "Vulnerability CVE-2026-91776 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:17:00.096690+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.7-tuxcare.1" } } ], "timestamp": "2026-10-19T20:18:00.107592+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.10.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } } ] }