Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in     Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be     exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds     field of a time value. This vulnerability appears to have been fixed in 2.9.8. (CVE-2018-1000873)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in
    Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be
    exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds
    field of a time value. This vulnerability appears to have been fixed in 2.9.8. (CVE-2018-1000873)

The remote Oracle Database Server is missing the October 2019 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities :

  - An unspecified vulnerability in the Java VM component of Oracle Database Server, which could allow an     unauthenticated, remote attacker to manipulate Java VM accessible data. (CVE-2019-2909)

  - An unspecified vulnerability in the Core RDBMS (jackson-databind) component of Oracle Database Server,     which could allow an authenticated, remote attacker to cause a denial of serivce of Core RDBMS. (CVE-2019-2956)

  - An unspecified vulnerability in the Core RDBMS component of Oracle Database Server, which could allow an     authenticated, remote attacker to read a subset of Core RDBMS accessible data. (CVE-2019-2913)

It is also affected by additional vulnerabilities; see the vendor advisory for more information.

Fixes CVE-2018-14718 CVE-2018-14719 CVE-2018-19360 CVE-2018-19361 CVE-2018-19362 CVE-2018-12022 CVE-2018-12023 CVE-2018-14720 CVE-2018-14721 and CVE-2016-7051.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
252714	Linux Distros Unpatched Vulnerability : CVE-2018-1000873	Nessus	Misc.	medium
422022	SCA: security update for com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (GHSA-h4x4-5qp2-wp46)	Tenable Cloud Security	SCA Checks	medium
422022	SCA: security update for com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (GHSA-h4x4-5qp2-wp46)	Tenable Self-Hosted Container Security	SCA Checks	medium
130058	Oracle Database Server Multiple Vulnerabilities (Oct 2019 CPU)	Nessus	Databases	critical
122290	Fedora 29 : bouncycastle / eclipse-jgit / eclipse-linuxtools / etc (2019-df57551f6d)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2018-1000873

medium

Tenable Plugins

medium

medium

medium

critical

critical