XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x     before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors     related to a DTD. (CVE-2016-7051)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x
    before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors
    related to a DTD. (CVE-2016-7051)

Fixes CVE-2018-14718 CVE-2018-14719 CVE-2018-19360 CVE-2018-19361 CVE-2018-19362 CVE-2018-12022 CVE-2018-12023 CVE-2018-14720 CVE-2018-14721 and CVE-2016-7051.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
254241	Linux Distros Unpatched Vulnerability : CVE-2016-7051	Nessus	Misc.	Local	high
422482	SCA: security update for com.fasterxml.jackson.dataformat:jackson-dataformat-xml (GHSA-7c2r-3jqf-c9rw)	Tenable Cloud Security	SCA Checks	Local	high
422482	SCA: security update for com.fasterxml.jackson.dataformat:jackson-dataformat-xml (GHSA-7c2r-3jqf-c9rw)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
122290	Fedora 29 : bouncycastle / eclipse-jgit / eclipse-linuxtools / etc (2019-df57551f6d)	Nessus	Fedora Local Security Checks	Local	critical

Detections

Analytics

CVE-2016-7051

high

Tenable Plugins

high

high

high

critical