CVE-2020-9547

jackson-databind mishandles the interaction between serialization gadgets and typing

9.8 CriticalPublic exploitFix available

What does this mean?

: 9.8v3.1, from NVD
: 18.4%97th percentile
Fixed in: 2.9.10.4com.fasterxml.jackson.core:jackson-databind
Published: March 2, 2020
Modified: November 12, 2026
Weakness: CWE-502
Also known as: ALSA-2020:1644CLSA-2026-1793207967CLSA-2026-1793208072CLSA-2026-1793260226CLSA-2026-1793295362CLSA-2026-1793521464CLSA-2026-1793521629CLSA-2026-1794221834
Show 50 moreShow less
CLSA-2026-1794223842CLSA-2026-1794223928CLSA-2026-1794223990CLSA-2026-1794224575CLSA-2026-1794224690CLSA-2026-1794225259CLSA-2026-1794225369CLSA-2026-1794225420CLSA-2026-1794225652CLSA-2026-1794225750CLSA-2026-1794226743CLSA-2026-1794232730CLSA-2026-1794233060CLSA-2026-1794303687CLSA-2026-1794304183CLSA-2026-1794331766CLSA-2026-1794465876CLSA-2026-1794465982CLSA-2026-1794466071CLSA-2026-1794466171CLSA-2026-1794466277CLSA-2026-1794466374CLSA-2026-1794466490CLSA-2026-1794466600CLSA-2026-1794466718CLSA-2026-1794484073CLSA-2026-1794484169CLSA-2026-1794484565CLSA-2026-1794484783CLSA-2026-1794484928DEBIAN-CVE-2020-9547DLA-2135-1EUVD-2020-0438GHSA-q93h-jc49-78ggMGASA-2021-0153RHBA-2020:1494RHBA-2020:3255RHSA-2020:1644RHSA-2020:2511RHSA-2020:2512RHSA-2020:2513RHSA-2020:3637RHSA-2020:3638RHSA-2020:3639RHSA-2020:4366RHSA-2025:1746RLSA-2020:1644ROOT-APP-MAVEN-CVE-2020-9547UBUNTU-CVE-2020-9547USN-4813-1

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

18.4%Up 0.4 points since Apr 14, 2021

What each source reports

NVD Score used9.8

Record: CVE-2020-9547
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-502
Updated: 2026-11-02

CVE List9.8

Record: CVE-2020-9547
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

EUVDEUVD-2020-04389.8

Record: EUVD-2020-0438
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-q93h-jc49-78gg9.8

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Record: GHSA-q93h-jc49-78gg
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSV9.8

Record: CVE-2020-9547
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-95479.8

Record: DEBIAN-CVE-2020-9547
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 48 moreShow less

OSVGHSA-q93h-jc49-78gg9.8

jackson-databind mishandles the interaction between serialization gadgets and typing

Record: GHSA-q93h-jc49-78gg
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSVRHBA-2020:14948.1

Red Hat Bug Fix Advisory: Satellite 6.6.3 Async Bug Fix Update

Record: RHBA-2020:1494
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHBA-2020:32558.1

Red Hat Bug Fix Advisory: Satellite 6.7.2 Async Bug Fix Update

Record: RHBA-2020:3255
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:16448.1

Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

Record: RHSA-2020:1644
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:25118.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update

Record: RHSA-2020:2511
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:25128.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update

Record: RHSA-2020:2512
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:25138.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update

Record: RHSA-2020:2513
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:36378.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update

Record: RHSA-2020:3637
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:36388.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update

Record: RHSA-2020:3638
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:36398.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update

Record: RHSA-2020:3639
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:43668.8

Red Hat Security Advisory: Satellite 6.8 release

Record: RHSA-2020:4366
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:17469.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update

Record: RHSA-2025:1746
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2020:16448.1

Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.

Security Fix(es):

jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig (CVE-2019-14540)
jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource (CVE-2019-16335)
jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* (CVE-2019-16942)
jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource (CVE-2019-16943)
jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* (CVE-2019-17531)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

Record: RLSA-2020:1644
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-95479.8

Record: UBUNTU-CVE-2020-9547
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2020:1644No score

Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

The Public Key Infrastructure (PKI) Core contains fundamental packages required by AlmaLinux Certificate System.

Security Fix(es):

jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig (CVE-2019-14540)
jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource (CVE-2019-16335)
jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* (CVE-2019-16942)
jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource (CVE-2019-16943)
jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* (CVE-2019-17531)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALSA-2020:1644
Updated: 2026-11-02

OSVCLSA-2026-1793207967No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.6.7.1-tuxcare.2.

Record: CLSA-2026-1793207967
Updated: 2026-11-06

OSVCLSA-2026-1793208072No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (31 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 31 CVEs. Fixed in 2.5.4-tuxcare.2.

Record: CLSA-2026-1793208072
Updated: 2026-11-06

OSVCLSA-2026-1793260226No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.4.0-tuxcare.2.

Record: CLSA-2026-1793260226
Updated: 2026-11-06

OSVCLSA-2026-1793295362No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.6.7.2-tuxcare.3.

Record: CLSA-2026-1793295362
Updated: 2026-11-06

OSVCLSA-2026-1793521464No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (13 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 13 CVEs. Fixed in 2.8.11.4-tuxcare.2.

Record: CLSA-2026-1793521464
Updated: 2026-11-06

OSVCLSA-2026-1793521629No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (21 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 21 CVEs. Fixed in 2.7.9-tuxcare.4.

Record: CLSA-2026-1793521629
Updated: 2026-11-06

OSVCLSA-2026-1794221834No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (22 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 22 CVEs. Fixed in 2.9.8-tuxcare.5.

Record: CLSA-2026-1794221834
Updated: 2026-11-09

OSVCLSA-2026-1794223842No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (20 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 20 CVEs. Fixed in 2.9.3-tuxcare.7.

Record: CLSA-2026-1794223842
Updated: 2026-11-09

OSVCLSA-2026-1794223928No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (15 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 15 CVEs. Fixed in 2.9.5-tuxcare.5.

Record: CLSA-2026-1794223928
Updated: 2026-11-09

OSVCLSA-2026-1794223990No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (14 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 14 CVEs. Fixed in 2.8.11.3-tuxcare.5.

Record: CLSA-2026-1794223990
Updated: 2026-11-09

OSVCLSA-2026-1794224575No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (15 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 15 CVEs. Fixed in 2.9.9-tuxcare.4.

Record: CLSA-2026-1794224575
Updated: 2026-11-09

OSVCLSA-2026-1794224690No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (15 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 15 CVEs. Fixed in 2.8.4-tuxcare.7.

Record: CLSA-2026-1794224690
Updated: 2026-11-09

OSVCLSA-2026-1794225259No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (19 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 19 CVEs. Fixed in 2.9.1-tuxcare.4.

Record: CLSA-2026-1794225259
Updated: 2026-11-09

OSVCLSA-2026-1794225369No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (18 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 18 CVEs. Fixed in 2.9.7-tuxcare.5.

Record: CLSA-2026-1794225369
Updated: 2026-11-09

OSVCLSA-2026-1794225420No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.9.9.1-tuxcare.6.

Record: CLSA-2026-1794225420
Updated: 2026-11-09

OSVCLSA-2026-1794225652No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (18 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 18 CVEs. Fixed in 2.9.4-tuxcare.6.

Record: CLSA-2026-1794225652
Updated: 2026-11-09

OSVCLSA-2026-1794225750No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.11-tuxcare.7.

Record: CLSA-2026-1794225750
Updated: 2026-11-09

OSVCLSA-2026-1794226743No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.10.2-tuxcare.5.

Record: CLSA-2026-1794226743
Updated: 2026-11-09

OSVCLSA-2026-1794232730No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.9.10-tuxcare.6.

Record: CLSA-2026-1794232730
Updated: 2026-11-09

OSVCLSA-2026-1794233060No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (23 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 23 CVEs. Fixed in 2.9.2-tuxcare.5.

Record: CLSA-2026-1794233060
Updated: 2026-11-09

OSVCLSA-2026-1794303687No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.8.7-tuxcare.7.

Record: CLSA-2026-1794303687
Updated: 2026-11-10

OSVCLSA-2026-1794304183No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.8.5-tuxcare.6.

Record: CLSA-2026-1794304183
Updated: 2026-11-10

OSVCLSA-2026-1794331766No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (15 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 15 CVEs. Fixed in 2.9.9.3-tuxcare.6.

Record: CLSA-2026-1794331766
Updated: 2026-11-11

OSVCLSA-2026-1794465876No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (17 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 17 CVEs. Fixed in 2.7.0-tuxcare.7.

Record: CLSA-2026-1794465876
Updated: 2026-11-12

OSVCLSA-2026-1794465982No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (26 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 26 CVEs. Fixed in 2.1.4-tuxcare.5.

Record: CLSA-2026-1794465982
Updated: 2026-11-12

OSVCLSA-2026-1794466071No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (14 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 14 CVEs. Fixed in 2.7.3-tuxcare.7.

Record: CLSA-2026-1794466071
Updated: 2026-11-12

OSVCLSA-2026-1794466171No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (25 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 25 CVEs. Fixed in 2.6.3-tuxcare.6.

Record: CLSA-2026-1794466171
Updated: 2026-11-12

OSVCLSA-2026-1794466277No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (27 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 27 CVEs. Fixed in 2.4.1-tuxcare.6.

Record: CLSA-2026-1794466277
Updated: 2026-11-12

OSVCLSA-2026-1794466374No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (27 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 27 CVEs. Fixed in 2.4.5-tuxcare.7.

Record: CLSA-2026-1794466374
Updated: 2026-11-12

OSVCLSA-2026-1794466490No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (24 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 24 CVEs. Fixed in 2.2.3-tuxcare.6.

Record: CLSA-2026-1794466490
Updated: 2026-11-12

OSVCLSA-2026-1794466600No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (15 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 15 CVEs. Fixed in 2.7.1-tuxcare.8.

Record: CLSA-2026-1794466600
Updated: 2026-11-12

OSVCLSA-2026-1794466718No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (28 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 28 CVEs. Fixed in 2.4.3-tuxcare.7.

Record: CLSA-2026-1794466718
Updated: 2026-11-12

OSVCLSA-2026-1794484073No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.6.7.3-tuxcare.7.

Record: CLSA-2026-1794484073
Updated: 2026-11-12

Affected products

Show 4 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`com.fasterxml.jackson.core:jackson-databind` Maven	2.9.0 up to 2.9.10.4	2.9.10.4
`com.fasterxml.jackson.core:jackson-databind` Maven	2.8.0 up to 2.8.11.6	2.8.11.6
`com.fasterxml.jackson.core:jackson-databind` Maven	2.0.0 up to 2.7.9.7	2.7.9.7
`apache-commons-collections` AlmaLinux:8 From an advisory covering 12 CVEs	before 3.2.2-10.module_el8.5.0+2577+9e95fe00	3.2.2-10.module_el8.5.0+2577+9e95fe00
`apache-commons-lang` AlmaLinux:8 From an advisory covering 12 CVEs	before 2.6-21.module_el8.5.0+2577+9e95fe00	2.6-21.module_el8.5.0+2577+9e95fe00
`bea-stax-api` AlmaLinux:8 From an advisory covering 12 CVEs	before 1.2.0-16.module_el8.5.0+2577+9e95fe00	1.2.0-16.module_el8.5.0+2577+9e95fe00
`glassfish-fastinfoset` AlmaLinux:8 From an advisory covering 12 CVEs	before 1.2.13-9.module_el8.5.0+2577+9e95fe00	1.2.13-9.module_el8.5.0+2577+9e95fe00
`glassfish-jaxb-api` AlmaLinux:8 From an advisory covering 12 CVEs	before 2.2.12-8.module_el8.5.0+2577+9e95fe00	2.2.12-8.module_el8.5.0+2577+9e95fe00
`glassfish-jaxb-core` AlmaLinux:8 From an advisory covering 12 CVEs	before 2.2.11-11.module_el8.5.0+2577+9e95fe00	2.2.11-11.module_el8.5.0+2577+9e95fe00
`glassfish-jaxb-runtime` AlmaLinux:8 From an advisory covering 12 CVEs	before 2.2.11-11.module_el8.5.0+2577+9e95fe00	2.2.11-11.module_el8.5.0+2577+9e95fe00

Show 290 moreShow less

Affected packages
Package	Affected	Fixed
`glassfish-jaxb-txw2` AlmaLinux:8 From an advisory covering 12 CVEs	before 2.2.11-11.module_el8.5.0+2577+9e95fe00	2.2.11-11.module_el8.5.0+2577+9e95fe00
`jackson-annotations` AlmaLinux:8 From an advisory covering 12 CVEs	before 2.10.0-1.module_el8.5.0+2577+9e95fe00	2.10.0-1.module_el8.5.0+2577+9e95fe00
`jackson-core` AlmaLinux:8 From an advisory covering 12 CVEs	before 2.10.0-1.module_el8.5.0+2577+9e95fe00	2.10.0-1.module_el8.5.0+2577+9e95fe00
`jackson-databind` AlmaLinux:8 From an advisory covering 12 CVEs	before 2.10.0-1.module_el8.5.0+2577+9e95fe00	2.10.0-1.module_el8.5.0+2577+9e95fe00
`jackson-jaxrs-json-provider` AlmaLinux:8 From an advisory covering 12 CVEs	before 2.9.9-1.module_el8.5.0+2577+9e95fe00	2.9.9-1.module_el8.5.0+2577+9e95fe00
`jackson-jaxrs-providers` AlmaLinux:8 From an advisory covering 12 CVEs	before 2.9.9-1.module_el8.5.0+2577+9e95fe00	2.9.9-1.module_el8.5.0+2577+9e95fe00
`jackson-module-jaxb-annotations` AlmaLinux:8 From an advisory covering 12 CVEs	before 2.7.6-4.module_el8.5.0+2577+9e95fe00	2.7.6-4.module_el8.5.0+2577+9e95fe00
`jakarta-commons-httpclient` AlmaLinux:8 From an advisory covering 12 CVEs	before 1:3.1-28.module_el8.5.0+2577+9e95fe00	1:3.1-28.module_el8.5.0+2577+9e95fe00
`javassist` AlmaLinux:8 From an advisory covering 12 CVEs	before 3.18.1-8.module_el8.5.0+2577+9e95fe00	3.18.1-8.module_el8.5.0+2577+9e95fe00
`javassist-javadoc` AlmaLinux:8 From an advisory covering 12 CVEs	before 3.18.1-8.module_el8.5.0+2577+9e95fe00	3.18.1-8.module_el8.5.0+2577+9e95fe00
`python-nss-doc` AlmaLinux:8 From an advisory covering 12 CVEs	before 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma	1.0.1-10.module_el8.5.0+2577+9e95fe00.alma
`python3-nss` AlmaLinux:8 From an advisory covering 12 CVEs	before 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma	1.0.1-10.module_el8.5.0+2577+9e95fe00.alma
`relaxngDatatype` AlmaLinux:8 From an advisory covering 12 CVEs	before 2011.1-7.module_el8.5.0+2577+9e95fe00	2011.1-7.module_el8.5.0+2577+9e95fe00
`slf4j` AlmaLinux:8 From an advisory covering 12 CVEs	before 1.7.25-4.module_el8.5.0+2577+9e95fe00	1.7.25-4.module_el8.5.0+2577+9e95fe00
`slf4j-jdk14` AlmaLinux:8 From an advisory covering 12 CVEs	before 1.7.25-4.module_el8.5.0+2577+9e95fe00	1.7.25-4.module_el8.5.0+2577+9e95fe00
`stax-ex` AlmaLinux:8 From an advisory covering 12 CVEs	before 1.7.7-8.module_el8.5.0+2577+9e95fe00	1.7.7-8.module_el8.5.0+2577+9e95fe00
`velocity` AlmaLinux:8 From an advisory covering 12 CVEs	before 1.7-24.module_el8.5.0+2577+9e95fe00	1.7-24.module_el8.5.0+2577+9e95fe00
`xalan-j2` AlmaLinux:8 From an advisory covering 12 CVEs	before 2.7.1-38.module_el8.5.0+2577+9e95fe00	2.7.1-38.module_el8.5.0+2577+9e95fe00
`xerces-j2` AlmaLinux:8 From an advisory covering 12 CVEs	before 2.11.0-34.module_el8.5.0+2577+9e95fe00	2.11.0-34.module_el8.5.0+2577+9e95fe00
`xml-commons-apis` AlmaLinux:8 From an advisory covering 12 CVEs	before 1.4.01-25.module_el8.5.0+2577+9e95fe00	1.4.01-25.module_el8.5.0+2577+9e95fe00
`xml-commons-resolver` AlmaLinux:8 From an advisory covering 12 CVEs	before 1.2-26.module_el8.5.0+2577+9e95fe00	1.2-26.module_el8.5.0+2577+9e95fe00
`xmlstreambuffer` AlmaLinux:8 From an advisory covering 12 CVEs	before 1.5.4-8.module_el8.5.0+2577+9e95fe00	1.5.4-8.module_el8.5.0+2577+9e95fe00
`xsom` AlmaLinux:8 From an advisory covering 12 CVEs	before 0-19.20110809svn.module_el8.5.0+2577+9e95fe00	0-19.20110809svn.module_el8.5.0+2577+9e95fe00
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 8 CVEs	2.6.7.1 up to 2.6.7.1-tuxcare.2, plus listed versions 2.6.7.1-tuxcare.1	2.6.7.1-tuxcare.2
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 30 CVEs	2.5.4 up to 2.5.4-tuxcare.2, plus listed versions 2.5.4-tuxcare.1	2.5.4-tuxcare.2
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 8 CVEs	2.4.0 up to 2.4.0-tuxcare.2, plus listed versions 2.4.0-tuxcare.1	2.4.0-tuxcare.2
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 7 CVEs	2.6.7.2 up to 2.6.7.2-tuxcare.3, plus listed versions 2.6.7.2-tuxcare.12.6.7.2-tuxcare.2	2.6.7.2-tuxcare.3
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 13 CVEs	2.8.11.4 up to 2.8.11.4-tuxcare.2, plus listed versions 2.8.11.4-tuxcare.1	2.8.11.4-tuxcare.2
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 21 CVEs	2.7.9 up to 2.7.9-tuxcare.4, plus listed versions 2.7.9-tuxcare.12.7.9-tuxcare.22.7.9-tuxcare.3	2.7.9-tuxcare.4
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 22 CVEs	2.9.8 up to 2.9.8-tuxcare.5, plus listed versions 2.9.8-tuxcare.12.9.8-tuxcare.22.9.8-tuxcare.32.9.8-tuxcare.4	2.9.8-tuxcare.5
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 20 CVEs	2.9.3 up to 2.9.3-tuxcare.7, plus listed versions 2.9.3-tuxcare.12.9.3-tuxcare.22.9.3-tuxcare.32.9.3-tuxcare.42.9.3-tuxcare.52.9.3-tuxcare.6	2.9.3-tuxcare.7
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 15 CVEs	2.9.5 up to 2.9.5-tuxcare.5, plus listed versions 2.9.5-tuxcare.12.9.5-tuxcare.22.9.5-tuxcare.32.9.5-tuxcare.4	2.9.5-tuxcare.5
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 14 CVEs	2.8.11.3 up to 2.8.11.3-tuxcare.5, plus listed versions 2.8.11.3-tuxcare.12.8.11.3-tuxcare.22.8.11.3-tuxcare.32.8.11.3-tuxcare.4	2.8.11.3-tuxcare.5
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 15 CVEs	2.9.9 up to 2.9.9-tuxcare.4, plus listed versions 2.9.9-tuxcare.12.9.9-tuxcare.22.9.9-tuxcare.3	2.9.9-tuxcare.4
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 15 CVEs	2.8.4 up to 2.8.4-tuxcare.7, plus listed versions 2.8.4-tuxcare.12.8.4-tuxcare.22.8.4-tuxcare.32.8.4-tuxcare.42.8.4-tuxcare.52.8.4-tuxcare.6	2.8.4-tuxcare.7
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 19 CVEs	2.9.1 up to 2.9.1-tuxcare.4, plus listed versions 2.9.1-tuxcare.12.9.1-tuxcare.22.9.1-tuxcare.3	2.9.1-tuxcare.4
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 18 CVEs	2.9.7 up to 2.9.7-tuxcare.5, plus listed versions 2.9.7-tuxcare.12.9.7-tuxcare.22.9.7-tuxcare.32.9.7-tuxcare.4	2.9.7-tuxcare.5
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 12 CVEs	2.9.9.1 up to 2.9.9.1-tuxcare.6, plus listed versions 2.9.9.1-tuxcare.12.9.9.1-tuxcare.22.9.9.1-tuxcare.32.9.9.1-tuxcare.42.9.9.1-tuxcare.5	2.9.9.1-tuxcare.6
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 18 CVEs	2.9.4 up to 2.9.4-tuxcare.6, plus listed versions 2.9.4-tuxcare.12.9.4-tuxcare.22.9.4-tuxcare.32.9.4-tuxcare.42.9.4-tuxcare.5	2.9.4-tuxcare.6
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 7 CVEs	2.8.11 up to 2.8.11-tuxcare.7, plus listed versions 2.8.11-tuxcare.12.8.11-tuxcare.22.8.11-tuxcare.32.8.11-tuxcare.42.8.11-tuxcare.52.8.11-tuxcare.6	2.8.11-tuxcare.7
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 12 CVEs	2.10.2 up to 2.10.2-tuxcare.5, plus listed versions 2.10.2-tuxcare.12.10.2-tuxcare.22.10.2-tuxcare.32.10.2-tuxcare.4	2.10.2-tuxcare.5
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 12 CVEs	2.9.10 up to 2.9.10-tuxcare.6, plus listed versions 2.9.10-tuxcare.12.9.10-tuxcare.22.9.10-tuxcare.32.9.10-tuxcare.42.9.10-tuxcare.5	2.9.10-tuxcare.6
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 23 CVEs	2.9.2 up to 2.9.2-tuxcare.5, plus listed versions 2.9.2-tuxcare.12.9.2-tuxcare.22.9.2-tuxcare.32.9.2-tuxcare.4	2.9.2-tuxcare.5
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 5 CVEs	2.8.7 up to 2.8.7-tuxcare.7, plus listed versions 2.8.7-tuxcare.12.8.7-tuxcare.22.8.7-tuxcare.32.8.7-tuxcare.42.8.7-tuxcare.52.8.7-tuxcare.6	2.8.7-tuxcare.7
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 12 CVEs	2.8.5 up to 2.8.5-tuxcare.6, plus listed versions 2.8.5-tuxcare.12.8.5-tuxcare.22.8.5-tuxcare.32.8.5-tuxcare.42.8.5-tuxcare.5	2.8.5-tuxcare.6
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 15 CVEs	2.9.9.3 up to 2.9.9.3-tuxcare.6, plus listed versions 2.9.9.3-tuxcare.12.9.9.3-tuxcare.22.9.9.3-tuxcare.32.9.9.3-tuxcare.42.9.9.3-tuxcare.5	2.9.9.3-tuxcare.6
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 17 CVEs	2.7.0 up to 2.7.0-tuxcare.7, plus listed versions 2.7.0-tuxcare.12.7.0-tuxcare.22.7.0-tuxcare.32.7.0-tuxcare.42.7.0-tuxcare.52.7.0-tuxcare.6	2.7.0-tuxcare.7
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 26 CVEs	2.1.4 up to 2.1.4-tuxcare.5, plus listed versions 2.1.4-tuxcare.12.1.4-tuxcare.22.1.4-tuxcare.32.1.4-tuxcare.4	2.1.4-tuxcare.5
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 14 CVEs	2.7.3 up to 2.7.3-tuxcare.7, plus listed versions 2.7.3-tuxcare.12.7.3-tuxcare.22.7.3-tuxcare.32.7.3-tuxcare.42.7.3-tuxcare.52.7.3-tuxcare.6	2.7.3-tuxcare.7
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 25 CVEs	2.6.3 up to 2.6.3-tuxcare.6, plus listed versions 2.6.3-tuxcare.12.6.3-tuxcare.22.6.3-tuxcare.32.6.3-tuxcare.42.6.3-tuxcare.5	2.6.3-tuxcare.6
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 27 CVEs	2.4.1 up to 2.4.1-tuxcare.6, plus listed versions 2.4.1-tuxcare.12.4.1-tuxcare.22.4.1-tuxcare.32.4.1-tuxcare.42.4.1-tuxcare.5	2.4.1-tuxcare.6
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 27 CVEs	2.4.5 up to 2.4.5-tuxcare.7, plus listed versions 2.4.5-tuxcare.12.4.5-tuxcare.22.4.5-tuxcare.32.4.5-tuxcare.42.4.5-tuxcare.52.4.5-tuxcare.6	2.4.5-tuxcare.7
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 24 CVEs	2.2.3 up to 2.2.3-tuxcare.6, plus listed versions 2.2.3-tuxcare.12.2.3-tuxcare.22.2.3-tuxcare.32.2.3-tuxcare.42.2.3-tuxcare.5	2.2.3-tuxcare.6
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 15 CVEs	2.7.1 up to 2.7.1-tuxcare.8, plus listed versions 2.7.1-tuxcare.12.7.1-tuxcare.22.7.1-tuxcare.32.7.1-tuxcare.42.7.1-tuxcare.52.7.1-tuxcare.62.7.1-tuxcare.7	2.7.1-tuxcare.8
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 28 CVEs	2.4.3 up to 2.4.3-tuxcare.7, plus listed versions 2.4.3-tuxcare.12.4.3-tuxcare.22.4.3-tuxcare.32.4.3-tuxcare.42.4.3-tuxcare.52.4.3-tuxcare.6	2.4.3-tuxcare.7
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 8 CVEs	2.6.7.3 up to 2.6.7.3-tuxcare.7, plus listed versions 2.6.7.3-tuxcare.12.6.7.3-tuxcare.22.6.7.3-tuxcare.32.6.7.3-tuxcare.42.6.7.3-tuxcare.52.6.7.3-tuxcare.6	2.6.7.3-tuxcare.7
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 8 CVEs	2.7.5 up to 2.7.5-tuxcare.9, plus listed versions 2.7.5-tuxcare.12.7.5-tuxcare.22.7.5-tuxcare.32.7.5-tuxcare.42.7.5-tuxcare.52.7.5-tuxcare.62.7.5-tuxcare.72.7.5-tuxcare.8	2.7.5-tuxcare.9
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 7 CVEs	2.7.9.3 up to 2.7.9.3-tuxcare.9, plus listed versions 2.7.9.3-tuxcare.12.7.9.3-tuxcare.22.7.9.3-tuxcare.32.7.9.3-tuxcare.42.7.9.3-tuxcare.52.7.9.3-tuxcare.62.7.9.3-tuxcare.72.7.9.3-tuxcare.8	2.7.9.3-tuxcare.9
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 11 CVEs	2.8.11.1 up to 2.8.11.1-tuxcare.8, plus listed versions 2.8.11.1-tuxcare.12.8.11.1-tuxcare.22.8.11.1-tuxcare.32.8.11.1-tuxcare.42.8.11.1-tuxcare.52.8.11.1-tuxcare.62.8.11.1-tuxcare.7	2.8.11.1-tuxcare.8
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven From an advisory covering 10 CVEs	2.8.10 up to 2.8.10-tuxcare.10, plus listed versions 2.8.10-tuxcare.12.8.10-tuxcare.22.8.10-tuxcare.32.8.10-tuxcare.42.8.10-tuxcare.5 Show 4 moreShow less 2.8.10-tuxcare.62.8.10-tuxcare.72.8.10-tuxcare.82.8.10-tuxcare.9	2.8.10-tuxcare.10
`jackson-databind` Debian:12	before 2.11.1-1	2.11.1-1
`jackson-databind` Debian:13	before 2.11.1-1	2.11.1-1
`jackson-databind` Debian:14	before 2.11.1-1	2.11.1-1
`jackson-databind` Debian:8 From an advisory covering 3 CVEs	before 2.4.2-2+deb8u12, plus listed versions 2.4.2-22.4.2-2+deb8u12.4.2-2+deb8u102.4.2-2+deb8u112.4.2-2+deb8u2 Show 7 moreShow less 2.4.2-2+deb8u32.4.2-2+deb8u42.4.2-2+deb8u52.4.2-2+deb8u62.4.2-2+deb8u72.4.2-2+deb8u82.4.2-2+deb8u9	2.4.2-2+deb8u12
`com.fasterxml.jackson.core:jackson-databind` Maven	2.9.0 up to 2.9.10.4, plus listed versions 2.9.0.pr12.9.0.pr22.9.0.pr32.9.0.pr42.9.1 Show 15 moreShow less 2.9.102.9.10.12.9.10.22.9.10.32.9.22.9.32.9.42.9.52.9.62.9.72.9.82.9.92.9.9.12.9.9.22.9.9.3	2.9.10.4
`com.fasterxml.jackson.core:jackson-databind` Maven	2.8.0 up to 2.8.11.6, plus listed versions 2.8.12.8.102.8.112.8.11.12.8.11.2 Show 12 moreShow less 2.8.11.32.8.11.42.8.11.52.8.22.8.32.8.42.8.52.8.62.8.72.8.82.8.8.12.8.9	2.8.11.6
`com.fasterxml.jackson.core:jackson-databind` Maven	2.0.0 up to 2.7.9.7, plus listed versions 2.0.12.0.22.0.42.0.52.0.6 Show 45 moreShow less 2.1.02.1.12.1.22.1.32.1.42.1.52.2.02.2.0-rc12.2.12.2.22.2.32.2.42.3.02.3.0-rc12.3.12.3.22.3.32.3.42.3.52.4.02.4.0-rc12.4.0-rc22.4.0-rc32.4.12.4.1.12.4.1.22.4.1.32.4.22.4.32.4.42.4.52.4.5.12.4.62.4.6.12.5.02.5.0-rc12.5.12.5.22.5.32.5.42.5.52.6.02.6.0-rc12.6.0-rc22.6.0-rc3	2.7.9.7
`jackson-databind` Mageia:7 From an advisory covering 32 CVEs	before 2.9.8-1.2.mga7	2.9.8-1.2.mga7
`foreman` Red Hat:satellite_capsule:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`foreman-debug` Red Hat:satellite_capsule:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`satellite` Red Hat:satellite_capsule:6.6::el7 From an advisory covering 13 CVEs	before 0:6.6.3-1.el7sat	0:6.6.3-1.el7sat
`satellite-capsule` Red Hat:satellite_capsule:6.6::el7 From an advisory covering 13 CVEs	before 0:6.6.3-1.el7sat	0:6.6.3-1.el7sat
`satellite-common` Red Hat:satellite_capsule:6.6::el7 From an advisory covering 13 CVEs	before 0:6.6.3-1.el7sat	0:6.6.3-1.el7sat
`satellite-debug-tools` Red Hat:satellite_capsule:6.6::el7 From an advisory covering 13 CVEs	before 0:6.6.3-1.el7sat	0:6.6.3-1.el7sat
`candlepin` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:2.6.16-1.el7sat	0:2.6.16-1.el7sat
`candlepin-selinux` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:2.6.16-1.el7sat	0:2.6.16-1.el7sat
`foreman` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`foreman-cli` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`foreman-debug` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`foreman-ec2` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`foreman-gce` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`foreman-journald` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`foreman-libvirt` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`foreman-openstack` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`foreman-ovirt` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`foreman-postgresql` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`foreman-rackspace` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`foreman-telemetry` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`foreman-vmware` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.22.0.39-2.el7sat	0:1.22.0.39-2.el7sat
`satellite` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:6.6.3-1.el7sat	0:6.6.3-1.el7sat
`satellite-capsule` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:6.6.3-1.el7sat	0:6.6.3-1.el7sat
`satellite-cli` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:6.6.3-1.el7sat	0:6.6.3-1.el7sat
`satellite-common` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:6.6.3-1.el7sat	0:6.6.3-1.el7sat
`satellite-debug-tools` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:6.6.3-1.el7sat	0:6.6.3-1.el7sat
`tfm-rubygem-fog-ovirt` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:1.2.3-1.el7sat	0:1.2.3-1.el7sat
`tfm-rubygem-foreman_rh_cloud` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:0.9.4.1-2.el7sat	0:0.9.4.1-2.el7sat
`tfm-rubygem-katello` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:3.12.0.41-1.el7sat	0:3.12.0.41-1.el7sat
`tfm-rubygem-runcible` Red Hat:satellite:6.6::el7 From an advisory covering 13 CVEs	before 0:2.13.0-1.el7sat	0:2.13.0-1.el7sat
`foreman` Red Hat:satellite_capsule:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-debug` Red Hat:satellite_capsule:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-installer` Red Hat:satellite_capsule:6.7::el7 From an advisory covering 12 CVEs	before 1:1.24.1.21-1.el7sat	1:1.24.1.21-1.el7sat
`foreman-installer-katello` Red Hat:satellite_capsule:6.7::el7 From an advisory covering 12 CVEs	before 1:1.24.1.21-1.el7sat	1:1.24.1.21-1.el7sat
`pulp-rpm` Red Hat:satellite_capsule:6.7::el7 From an advisory covering 12 CVEs	before 0:2.21.0.6-1.el7sat	0:2.21.0.6-1.el7sat
`pulp-rpm-admin-extensions` Red Hat:satellite_capsule:6.7::el7 From an advisory covering 12 CVEs	before 0:2.21.0.6-1.el7sat	0:2.21.0.6-1.el7sat
`pulp-rpm-plugins` Red Hat:satellite_capsule:6.7::el7 From an advisory covering 12 CVEs	before 0:2.21.0.6-1.el7sat	0:2.21.0.6-1.el7sat
`python-pulp-integrity` Red Hat:satellite_capsule:6.7::el7 From an advisory covering 12 CVEs	before 0:2.21.0.6-1.el7sat	0:2.21.0.6-1.el7sat
`python-pulp-rpm-common` Red Hat:satellite_capsule:6.7::el7 From an advisory covering 12 CVEs	before 0:2.21.0.6-1.el7sat	0:2.21.0.6-1.el7sat
`satellite` Red Hat:satellite_capsule:6.7::el7 From an advisory covering 12 CVEs	before 0:6.7.2-1.el7sat	0:6.7.2-1.el7sat
`satellite-capsule` Red Hat:satellite_capsule:6.7::el7 From an advisory covering 12 CVEs	before 0:6.7.2-1.el7sat	0:6.7.2-1.el7sat
`satellite-common` Red Hat:satellite_capsule:6.7::el7 From an advisory covering 12 CVEs	before 0:6.7.2-1.el7sat	0:6.7.2-1.el7sat
`satellite-debug-tools` Red Hat:satellite_capsule:6.7::el7 From an advisory covering 12 CVEs	before 0:6.7.2-1.el7sat	0:6.7.2-1.el7sat
`candlepin` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:2.9.28-1.el7sat	0:2.9.28-1.el7sat
`candlepin-selinux` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:2.9.28-1.el7sat	0:2.9.28-1.el7sat
`foreman` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-cli` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-debug` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-ec2` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-gce` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-installer` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 1:1.24.1.21-1.el7sat	1:1.24.1.21-1.el7sat
`foreman-installer-katello` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 1:1.24.1.21-1.el7sat	1:1.24.1.21-1.el7sat
`foreman-journald` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-libvirt` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-openstack` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-ovirt` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-postgresql` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-rackspace` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-telemetry` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`foreman-vmware` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.24.1.24-1.el7sat	0:1.24.1.24-1.el7sat
`pulp-rpm` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:2.21.0.6-1.el7sat	0:2.21.0.6-1.el7sat
`pulp-rpm-admin-extensions` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:2.21.0.6-1.el7sat	0:2.21.0.6-1.el7sat
`pulp-rpm-plugins` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:2.21.0.6-1.el7sat	0:2.21.0.6-1.el7sat
`python-pulp-integrity` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:2.21.0.6-1.el7sat	0:2.21.0.6-1.el7sat
`python-pulp-rpm-common` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:2.21.0.6-1.el7sat	0:2.21.0.6-1.el7sat
`satellite` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:6.7.2-1.el7sat	0:6.7.2-1.el7sat
`satellite-capsule` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:6.7.2-1.el7sat	0:6.7.2-1.el7sat
`satellite-cli` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:6.7.2-1.el7sat	0:6.7.2-1.el7sat
`satellite-common` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:6.7.2-1.el7sat	0:6.7.2-1.el7sat
`satellite-debug-tools` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:6.7.2-1.el7sat	0:6.7.2-1.el7sat
`tfm-rubygem-fog-vsphere` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:3.2.1.1-1.el7sat	0:3.2.1.1-1.el7sat
`tfm-rubygem-foreman-tasks` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:0.17.5.6-1.el7sat	0:0.17.5.6-1.el7sat
`tfm-rubygem-foreman_remote_execution` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:2.0.10.1-1.el7sat	0:2.0.10.1-1.el7sat
`tfm-rubygem-foreman_remote_execution-cockpit` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:2.0.10.1-1.el7sat	0:2.0.10.1-1.el7sat
`tfm-rubygem-foreman_rh_cloud` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:1.0.9-1.el7sat	0:1.0.9-1.el7sat
`tfm-rubygem-hammer_cli_foreman` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:0.19.6.5-1.el7sat	0:0.19.6.5-1.el7sat
`tfm-rubygem-katello` Red Hat:satellite:6.7::el7 From an advisory covering 12 CVEs	before 0:3.14.0.25-1.el7sat	0:3.14.0.25-1.el7sat
`apache-commons-collections` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:3.2.2-10.module+el8.1.0+3366+6dfb954c	0:3.2.2-10.module+el8.1.0+3366+6dfb954c
`apache-commons-lang` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.6-21.module+el8.1.0+3366+6dfb954c	0:2.6-21.module+el8.1.0+3366+6dfb954c
`bea-stax` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.2.0-16.module+el8.1.0+3366+6dfb954c	0:1.2.0-16.module+el8.1.0+3366+6dfb954c
`bea-stax-api` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.2.0-16.module+el8.1.0+3366+6dfb954c	0:1.2.0-16.module+el8.1.0+3366+6dfb954c
`glassfish-fastinfoset` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.2.13-9.module+el8.1.0+3366+6dfb954c	0:1.2.13-9.module+el8.1.0+3366+6dfb954c
`glassfish-jaxb` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.2.11-11.module+el8.1.0+3366+6dfb954c	0:2.2.11-11.module+el8.1.0+3366+6dfb954c
`glassfish-jaxb-api` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.2.12-8.module+el8.1.0+3366+6dfb954c	0:2.2.12-8.module+el8.1.0+3366+6dfb954c
`glassfish-jaxb-core` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.2.11-11.module+el8.1.0+3366+6dfb954c	0:2.2.11-11.module+el8.1.0+3366+6dfb954c
`glassfish-jaxb-runtime` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.2.11-11.module+el8.1.0+3366+6dfb954c	0:2.2.11-11.module+el8.1.0+3366+6dfb954c
`glassfish-jaxb-txw2` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.2.11-11.module+el8.1.0+3366+6dfb954c	0:2.2.11-11.module+el8.1.0+3366+6dfb954c
`jackson-annotations` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.10.0-1.module+el8.2.0+5059+3eb3af25	0:2.10.0-1.module+el8.2.0+5059+3eb3af25
`jackson-core` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.10.0-1.module+el8.2.0+5059+3eb3af25	0:2.10.0-1.module+el8.2.0+5059+3eb3af25
`jackson-databind` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.10.0-1.module+el8.2.0+5059+3eb3af25	0:2.10.0-1.module+el8.2.0+5059+3eb3af25
`jackson-jaxrs-json-provider` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.9.9-1.module+el8.1.0+3832+9784644d	0:2.9.9-1.module+el8.1.0+3832+9784644d
`jackson-jaxrs-providers` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.9.9-1.module+el8.1.0+3832+9784644d	0:2.9.9-1.module+el8.1.0+3832+9784644d
`jackson-module-jaxb-annotations` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.7.6-4.module+el8.1.0+3366+6dfb954c	0:2.7.6-4.module+el8.1.0+3366+6dfb954c
`jakarta-commons-httpclient` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 1:3.1-28.module+el8.1.0+3366+6dfb954c	1:3.1-28.module+el8.1.0+3366+6dfb954c
`javassist` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:3.18.1-8.module+el8.1.0+3366+6dfb954c	0:3.18.1-8.module+el8.1.0+3366+6dfb954c
`javassist-javadoc` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:3.18.1-8.module+el8.1.0+3366+6dfb954c	0:3.18.1-8.module+el8.1.0+3366+6dfb954c
`jss` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:4.6.2-4.module+el8.2.0+6123+b4678599	0:4.6.2-4.module+el8.2.0+6123+b4678599
`jss-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:4.6.2-4.module+el8.2.0+6123+b4678599	0:4.6.2-4.module+el8.2.0+6123+b4678599
`jss-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:4.6.2-4.module+el8.2.0+6123+b4678599	0:4.6.2-4.module+el8.2.0+6123+b4678599
`jss-javadoc` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:4.6.2-4.module+el8.2.0+6123+b4678599	0:4.6.2-4.module+el8.2.0+6123+b4678599
`ldapjdk` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:4.21.0-2.module+el8.2.0+4573+c3c38c7b	0:4.21.0-2.module+el8.2.0+4573+c3c38c7b
`ldapjdk-javadoc` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:4.21.0-2.module+el8.2.0+4573+c3c38c7b	0:4.21.0-2.module+el8.2.0+4573+c3c38c7b
`pki-base` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:10.8.3-1.module+el8.2.0+5925+bad5981a	0:10.8.3-1.module+el8.2.0+5925+bad5981a
`pki-base-java` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:10.8.3-1.module+el8.2.0+5925+bad5981a	0:10.8.3-1.module+el8.2.0+5925+bad5981a
`pki-ca` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:10.8.3-1.module+el8.2.0+5925+bad5981a	0:10.8.3-1.module+el8.2.0+5925+bad5981a
`pki-core` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:10.8.3-1.module+el8.2.0+5925+bad5981a	0:10.8.3-1.module+el8.2.0+5925+bad5981a
`pki-core-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:10.8.3-1.module+el8.2.0+5925+bad5981a	0:10.8.3-1.module+el8.2.0+5925+bad5981a
`pki-core-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:10.8.3-1.module+el8.2.0+5925+bad5981a	0:10.8.3-1.module+el8.2.0+5925+bad5981a
`pki-kra` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:10.8.3-1.module+el8.2.0+5925+bad5981a	0:10.8.3-1.module+el8.2.0+5925+bad5981a
`pki-server` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:10.8.3-1.module+el8.2.0+5925+bad5981a	0:10.8.3-1.module+el8.2.0+5925+bad5981a
`pki-servlet-4.0-api` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 1:9.0.7-16.module+el8.1.0+3366+6dfb954c	1:9.0.7-16.module+el8.1.0+3366+6dfb954c
`pki-servlet-engine` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 1:9.0.7-16.module+el8.1.0+3366+6dfb954c	1:9.0.7-16.module+el8.1.0+3366+6dfb954c
`pki-symkey` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:10.8.3-1.module+el8.2.0+5925+bad5981a	0:10.8.3-1.module+el8.2.0+5925+bad5981a
`pki-symkey-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:10.8.3-1.module+el8.2.0+5925+bad5981a	0:10.8.3-1.module+el8.2.0+5925+bad5981a
`pki-tools` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:10.8.3-1.module+el8.2.0+5925+bad5981a	0:10.8.3-1.module+el8.2.0+5925+bad5981a
`pki-tools-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:10.8.3-1.module+el8.2.0+5925+bad5981a	0:10.8.3-1.module+el8.2.0+5925+bad5981a
`python-nss` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.0.1-10.module+el8.1.0+3366+6dfb954c	0:1.0.1-10.module+el8.1.0+3366+6dfb954c
`python-nss-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.0.1-10.module+el8.1.0+3366+6dfb954c	0:1.0.1-10.module+el8.1.0+3366+6dfb954c
`python-nss-doc` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.0.1-10.module+el8.1.0+3366+6dfb954c	0:1.0.1-10.module+el8.1.0+3366+6dfb954c
`python3-nss` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.0.1-10.module+el8.1.0+3366+6dfb954c	0:1.0.1-10.module+el8.1.0+3366+6dfb954c
`python3-nss-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.0.1-10.module+el8.1.0+3366+6dfb954c	0:1.0.1-10.module+el8.1.0+3366+6dfb954c
`python3-pki` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:10.8.3-1.module+el8.2.0+5925+bad5981a	0:10.8.3-1.module+el8.2.0+5925+bad5981a
`relaxngDatatype` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2011.1-7.module+el8.1.0+3366+6dfb954c	0:2011.1-7.module+el8.1.0+3366+6dfb954c
`resteasy` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:3.0.26-3.module+el8.1.0+3366+6dfb954c	0:3.0.26-3.module+el8.1.0+3366+6dfb954c
`slf4j` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.7.25-4.module+el8.1.0+3366+6dfb954c	0:1.7.25-4.module+el8.1.0+3366+6dfb954c
`slf4j-jdk14` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.7.25-4.module+el8.1.0+3366+6dfb954c	0:1.7.25-4.module+el8.1.0+3366+6dfb954c
`stax-ex` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.7.7-8.module+el8.1.0+3366+6dfb954c	0:1.7.7-8.module+el8.1.0+3366+6dfb954c
`tomcatjss` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:7.4.1-2.module+el8.2.0+4573+c3c38c7b	0:7.4.1-2.module+el8.2.0+4573+c3c38c7b
`velocity` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.7-24.module+el8.1.0+3366+6dfb954c	0:1.7-24.module+el8.1.0+3366+6dfb954c
`xalan-j2` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.7.1-38.module+el8.1.0+3366+6dfb954c	0:2.7.1-38.module+el8.1.0+3366+6dfb954c
`xerces-j2` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:2.11.0-34.module+el8.1.0+3366+6dfb954c	0:2.11.0-34.module+el8.1.0+3366+6dfb954c
`xml-commons-apis` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.4.01-25.module+el8.1.0+3366+6dfb954c	0:1.4.01-25.module+el8.1.0+3366+6dfb954c
`xml-commons-resolver` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.2-26.module+el8.1.0+3366+6dfb954c	0:1.2-26.module+el8.1.0+3366+6dfb954c
`xmlstreambuffer` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:1.5.4-8.module+el8.1.0+3366+6dfb954c	0:1.5.4-8.module+el8.1.0+3366+6dfb954c
`xsom` Red Hat:enterprise_linux:8::appstream From an advisory covering 12 CVEs	before 0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c	0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c
`eap7-activemq-artemis` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-cli` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-commons` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-core-client` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-dto` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-hornetq-protocol` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-hqclient-protocol` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-jdbc-store` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-jms-client` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-jms-server` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-journal` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-ra` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-selector` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-server` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-service-extensions` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-activemq-artemis-tools` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.9.0-4.redhat_00010.1.el6eap	0:2.9.0-4.redhat_00010.1.el6eap
`eap7-apache-cxf` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:3.3.5-1.redhat_00001.1.el6eap	0:3.3.5-1.redhat_00001.1.el6eap
`eap7-apache-cxf-rt` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:3.3.5-1.redhat_00001.1.el6eap	0:3.3.5-1.redhat_00001.1.el6eap
`eap7-apache-cxf-services` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:3.3.5-1.redhat_00001.1.el6eap	0:3.3.5-1.redhat_00001.1.el6eap
`eap7-apache-cxf-tools` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:3.3.5-1.redhat_00001.1.el6eap	0:3.3.5-1.redhat_00001.1.el6eap
`eap7-bouncycastle` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:1.60.0-2.redhat_00002.1.el6eap	0:1.60.0-2.redhat_00002.1.el6eap
`eap7-bouncycastle-mail` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:1.60.0-2.redhat_00002.1.el6eap	0:1.60.0-2.redhat_00002.1.el6eap
`eap7-bouncycastle-pkix` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:1.60.0-2.redhat_00002.1.el6eap	0:1.60.0-2.redhat_00002.1.el6eap
`eap7-bouncycastle-prov` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:1.60.0-2.redhat_00002.1.el6eap	0:1.60.0-2.redhat_00002.1.el6eap
`eap7-codehaus-jackson` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:1.9.13-10.redhat_00007.1.el6eap	0:1.9.13-10.redhat_00007.1.el6eap
`eap7-codehaus-jackson-core-asl` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:1.9.13-10.redhat_00007.1.el6eap	0:1.9.13-10.redhat_00007.1.el6eap
`eap7-codehaus-jackson-jaxrs` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:1.9.13-10.redhat_00007.1.el6eap	0:1.9.13-10.redhat_00007.1.el6eap
`eap7-codehaus-jackson-mapper-asl` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:1.9.13-10.redhat_00007.1.el6eap	0:1.9.13-10.redhat_00007.1.el6eap
`eap7-codehaus-jackson-xc` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:1.9.13-10.redhat_00007.1.el6eap	0:1.9.13-10.redhat_00007.1.el6eap
`eap7-codemodel` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.3.3-4.b02_redhat_00001.1.el6eap	0:2.3.3-4.b02_redhat_00001.1.el6eap
`eap7-cryptacular` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:1.2.4-1.redhat_00001.1.el6eap	0:1.2.4-1.redhat_00001.1.el6eap
`eap7-elytron-web` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:1.6.1-1.Final_redhat_00001.1.el6eap	0:1.6.1-1.Final_redhat_00001.1.el6eap
`eap7-glassfish-jaxb` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.3.3-4.b02_redhat_00001.1.el6eap	0:2.3.3-4.b02_redhat_00001.1.el6eap
`eap7-glassfish-jsf` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:2.3.9-10.SP09_redhat_00001.1.el6eap	0:2.3.9-10.SP09_redhat_00001.1.el6eap
`eap7-hal-console` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:3.2.8-1.Final_redhat_00001.1.el6eap	0:3.2.8-1.Final_redhat_00001.1.el6eap
`eap7-hibernate` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:5.3.16-1.Final_redhat_00001.1.el6eap	0:5.3.16-1.Final_redhat_00001.1.el6eap
`eap7-hibernate-core` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:5.3.16-1.Final_redhat_00001.1.el6eap	0:5.3.16-1.Final_redhat_00001.1.el6eap
`eap7-hibernate-entitymanager` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:5.3.16-1.Final_redhat_00001.1.el6eap	0:5.3.16-1.Final_redhat_00001.1.el6eap
`eap7-hibernate-envers` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:5.3.16-1.Final_redhat_00001.1.el6eap	0:5.3.16-1.Final_redhat_00001.1.el6eap
`eap7-hibernate-java8` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:5.3.16-1.Final_redhat_00001.1.el6eap	0:5.3.16-1.Final_redhat_00001.1.el6eap
`eap7-infinispan` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:9.4.18-1.Final_redhat_00001.1.el6eap	0:9.4.18-1.Final_redhat_00001.1.el6eap
`eap7-infinispan-cachestore-jdbc` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:9.4.18-1.Final_redhat_00001.1.el6eap	0:9.4.18-1.Final_redhat_00001.1.el6eap
`eap7-infinispan-cachestore-remote` Red Hat:jboss_enterprise_application_platform:7.3::el6 From an advisory covering 21 CVEs	before 0:9.4.18-1.Final_redhat_00001.1.el6eap	0:9.4.18-1.Final_redhat_00001.1.el6eap
`apache-commons-collections` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:3.2.2-10.module+el8.3.0+53+ea062990	0:3.2.2-10.module+el8.3.0+53+ea062990
`apache-commons-collections` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:3.2.2-10.module+el8.3.0+74+855e3f5d	0:3.2.2-10.module+el8.3.0+74+855e3f5d
`apache-commons-lang` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2.6-21.module+el8.3.0+53+ea062990	0:2.6-21.module+el8.3.0+53+ea062990
`apache-commons-lang` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2.6-21.module+el8.3.0+74+855e3f5d	0:2.6-21.module+el8.3.0+74+855e3f5d
`bea-stax` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.2.0-16.module+el8.3.0+53+ea062990	0:1.2.0-16.module+el8.3.0+53+ea062990
`glassfish-fastinfoset` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.2.13-9.module+el8.3.0+53+ea062990	0:1.2.13-9.module+el8.3.0+53+ea062990
`glassfish-jaxb` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2.2.11-11.module+el8.3.0+53+ea062990	0:2.2.11-11.module+el8.3.0+53+ea062990
`glassfish-jaxb-api` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2.2.12-8.module+el8.3.0+53+ea062990	0:2.2.12-8.module+el8.3.0+53+ea062990
`jackson-annotations` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2.10.0-1.module+el8.3.0+53+ea062990	0:2.10.0-1.module+el8.3.0+53+ea062990
`jackson-core` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2.10.0-1.module+el8.3.0+53+ea062990	0:2.10.0-1.module+el8.3.0+53+ea062990
`jackson-databind` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2.10.0-1.module+el8.3.0+53+ea062990	0:2.10.0-1.module+el8.3.0+53+ea062990
`jackson-jaxrs-providers` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2.9.9-1.module+el8.3.0+53+ea062990	0:2.9.9-1.module+el8.3.0+53+ea062990
`jackson-module-jaxb-annotations` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2.7.6-4.module+el8.3.0+53+ea062990	0:2.7.6-4.module+el8.3.0+53+ea062990
`jakarta-commons-httpclient` Rocky Linux:8 From an advisory covering 12 CVEs	before 1:3.1-28.module+el8.3.0+53+ea062990	1:3.1-28.module+el8.3.0+53+ea062990
`jakarta-commons-httpclient` Rocky Linux:8 From an advisory covering 12 CVEs	before 1:3.1-28.module+el8.3.0+74+855e3f5d	1:3.1-28.module+el8.3.0+74+855e3f5d
`python-nss` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.0.1-10.module+el8.3.0+53+ea062990	0:1.0.1-10.module+el8.3.0+53+ea062990
`javassist` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:3.18.1-8.module+el8.3.0+53+ea062990	0:3.18.1-8.module+el8.3.0+53+ea062990
`javassist` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:3.18.1-8.module+el8.3.0+74+855e3f5d	0:3.18.1-8.module+el8.3.0+74+855e3f5d
`relaxngDatatype` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2011.1-7.module+el8.3.0+53+ea062990	0:2011.1-7.module+el8.3.0+53+ea062990
`resteasy` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:3.0.26-3.module+el8.3.0+53+ea062990	0:3.0.26-3.module+el8.3.0+53+ea062990
`slf4j` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.7.25-4.module+el8.5.0+697+f586bb30	0:1.7.25-4.module+el8.5.0+697+f586bb30
`slf4j` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.7.25-4.module+el8.3.0+74+855e3f5d	0:1.7.25-4.module+el8.3.0+74+855e3f5d
`slf4j` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.7.25-4.module+el8.3.0+133+b8b54b58	0:1.7.25-4.module+el8.3.0+133+b8b54b58
`stax-ex` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.7.7-8.module+el8.3.0+53+ea062990	0:1.7.7-8.module+el8.3.0+53+ea062990
`velocity` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.7-24.module+el8.3.0+53+ea062990	0:1.7-24.module+el8.3.0+53+ea062990
`velocity` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.7-24.module+el8.3.0+74+855e3f5d	0:1.7-24.module+el8.3.0+74+855e3f5d
`xalan-j2` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2.7.1-38.module+el8.3.0+53+ea062990	0:2.7.1-38.module+el8.3.0+53+ea062990
`xalan-j2` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2.7.1-38.module+el8.3.0+74+855e3f5d	0:2.7.1-38.module+el8.3.0+74+855e3f5d
`xerces-j2` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2.11.0-34.module+el8.3.0+53+ea062990	0:2.11.0-34.module+el8.3.0+53+ea062990
`xerces-j2` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:2.11.0-34.module+el8.3.0+74+855e3f5d	0:2.11.0-34.module+el8.3.0+74+855e3f5d
`xml-commons-apis` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.4.01-25.module+el8.5.0+697+f586bb30	0:1.4.01-25.module+el8.5.0+697+f586bb30
`xml-commons-apis` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.4.01-25.module+el8.3.0+74+855e3f5d	0:1.4.01-25.module+el8.3.0+74+855e3f5d
`xml-commons-apis` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.4.01-25.module+el8.3.0+53+ea062990	0:1.4.01-25.module+el8.3.0+53+ea062990
`xml-commons-resolver` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.2-26.module+el8.3.0+53+ea062990	0:1.2-26.module+el8.3.0+53+ea062990
`xml-commons-resolver` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.2-26.module+el8.3.0+74+855e3f5d	0:1.2-26.module+el8.3.0+74+855e3f5d
`xmlstreambuffer` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:1.5.4-8.module+el8.3.0+53+ea062990	0:1.5.4-8.module+el8.3.0+53+ea062990
`xsom` Rocky Linux:8 From an advisory covering 12 CVEs	before 0:0-19.20110809svn.module+el8.3.0+53+ea062990	0:0-19.20110809svn.module+el8.3.0+53+ea062990
`com.fasterxml.jackson.core:jackson-databind` Root:Maven	before 2.3.1-aikido.2	2.3.1-aikido.22.3.1-aikido.32.3.1-aikido.42.3.1-aikido.52.3.1-aikido.6
`io.root.com.fasterxml.jackson.core:jackson-databind` Root:Maven	before 2.3.1-root.io.2	2.3.1-root.io.22.3.1-root.io.32.3.1-root.io.42.3.1-root.io.52.3.1-root.io.6
`jackson-databind` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 2.2.2-12.2.2-1ubuntu0.1~esm1	None known
`jackson-databind` Ubuntu:Pro:16.04:LTS	before 2.4.2-3ubuntu0.1~esm2, plus listed versions 2.4.2-22.4.2-32.4.2-3ubuntu0.1~esm1	2.4.2-3ubuntu0.1~esm2
`jackson-databind` Ubuntu:18.04:LTS	All versions, plus listed versions 2.8.6-12.9.1-12.9.4-12.9.5-12.9.8-1~18.04	None known
`jackson-databind` Ubuntu:20.04:LTS	All versions, plus listed versions 2.9.9.3-12.10.0-22.10.1-12.10.2-1	None known
`jackson-databind` Ubuntu:Pro:16.04:LTS From an advisory covering 39 CVEs	before 2.4.2-3ubuntu0.1~esm2, plus listed versions 2.4.2-22.4.2-32.4.2-3ubuntu0.1~esm1	2.4.2-3ubuntu0.1~esm2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	fairyming/CVE-2020-9547	2020-03-02
Nuclei	FasterXML jackson-databind - Deserialization Remote Code Execution

History

History
Recorded	Changed	Sources
Nov 12, 2026	affected, aliases	OSV
Nov 12, 2026	affected, aliases	OSV
Nov 11, 2026	affected, aliases	OSV
Nov 10, 2026	aliases
Nov 10, 2026	affected, aliases	OSV
Nov 9, 2026	affected, aliases	OSV
Nov 6, 2026	affected, aliases	OSV
Nov 6, 2026	affected
Nov 5, 2026	exploits, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-9547 is a critical vulnerability (CVSS 9.8) in Fasterxml Jackson-databind, published March 2, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.4%, the 97th percentile. Fixed in com.fasterxml.jackson.core:jackson-databind 2.9.10.4.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 1,255 package rows, 33 versions and 899 references. The JSON record has them. Also not on the record: 409 package claims. ID and package lookups still check them. Left out on purpose, here and in the API, to keep responses small: 8 source records.