FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the January 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (jackson-databind)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and     14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of     Oracle WebLogic Server. (CVE-2018-7489)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (XStream)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and     14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server.
    (CVE-2022-40150)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2018-7489

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

FasterXML jackson-databind before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is 15.x prior to 15.2.15, 16.x prior to 16.2.8, or 17.x prior to 17.12.3. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Database Server is missing the October 2018 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including remote code execution, as noted in the October 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.15.5. It is, therefore, affected by multiple vulnerabilities.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the July 2018 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities.

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities:

  - An unspecified vulnerability in the Spring Framework     (Sample Apps) subcomponent in Oracle WebLogic allows     an unauthenticated, remote attacker to takeover a     WebLogic server. (CVE-2018-1275)

  - An unspecified vulnerability in the WLS Core Components     subcomponent in Oracle WebLogic allows an     unauthenticated, remote attacker to takeover a     WebLogic server. (CVE-2018-2893)

  - An unspecified vulnerability in the WLS - Web Services     subcomponent in Oracle WebLogic allows an     unauthenticated, remote attacker with HTTP access to     compromise and takeover a WebLogic server.
    (CVE-2018-2894)

In addition, Oracle WebLogic Server is affected by several other lower scoring vulnerabilities in the WLS Core Components, JSF, SAML, and Console (jackson-databind) subcomponents.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2090 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This release of Red Hat JBoss Enterprise Application Platform 7.1.3 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.1.2, and includes bug fixes and enhancements, which are documented     in the Release Notes document linked to in the References.

    Security Fix(es):

    * jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries     (CVE-2018-7489)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2089 advisory.

  - undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a     denial of service (CVE-2018-1114)

  - jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries     (CVE-2018-7489)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1449 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This release of Red Hat JBoss Enterprise Application Platform 6.4.20 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 6.4.19, and includes bug fixes and enhancements, which are     documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)     (CVE-2017-15095)

    * jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for     CVE-2017-15095) (CVE-2017-17485)

    * slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution     (CVE-2018-8088)

    * Apache ActiveMQ Artemis: Deserialization of untrusted input vulnerability (CVE-2016-4978)

    * solr: Directory traversal via Index Replication HTTP API (CVE-2017-3163)

    * tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure     of resources (CVE-2018-1304)

    * jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries     (CVE-2018-7489)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-15095; 0c0c0f from     360 for reporting CVE-2017-17485; and Chris McCown for reporting CVE-2018-8088.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1448 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This release of Red Hat JBoss Enterprise Application Platform 6.4.20 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 6.4.19, and includes bug fixes and enhancements, which are     documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)     (CVE-2017-15095)

    * jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for     CVE-2017-15095) (CVE-2017-17485)

    * slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution     (CVE-2018-8088)

    * Apache ActiveMQ Artemis: Deserialization of untrusted input vulnerability (CVE-2016-4978)

    * solr: Directory traversal via Index Replication HTTP API (CVE-2017-3163)

    * tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure     of resources (CVE-2018-1304)

    * jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries     (CVE-2018-7489)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-15095; 0c0c0f from     360 for reporting CVE-2017-17485; and Chris McCown for reporting CVE-2018-8088.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1451 advisory.

    The jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise     Application Platform running on the Amazon Web Services (AWS) Elastic Compute Cloud (EC2).

    With this update, the jboss-ec2-eap package has been updated to ensure     compatibility with Red Hat JBoss Enterprise Application Platform 6.4.19.

    Security Fix(es):

    * jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)     (CVE-2017-15095)

    * jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for     CVE-2017-15095) (CVE-2017-17485)

    * slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution     (CVE-2018-8088)

    * Apache ActiveMQ Artemis: Deserialization of untrusted input vulnerability (CVE-2016-4978)

    * solr: Directory traversal via Index Replication HTTP API (CVE-2017-3163)

    * tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure     of resources (CVE-2018-1304)

    * jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries     (CVE-2018-7489)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-15095; 0c0c0f from     360 for reporting CVE-2017-17485; and Chris McCown for reporting CVE-2018-8088.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that jackson-databind, a Java library used to parse JSON and other data formats, improperly validated user input prior to deserializing because of an incomplete fix for CVE-2017-7525.

ID	Name	Product	Family	Severity
170165	Oracle WebLogic Server (Jan 2023 CPU)	Nessus	Misc.	critical
120474	Fedora 28 : jackson-databind (2018-633acf0ed6)	Nessus	Fedora Local Security Checks	critical
119272	FreeBSD : payara -- Default typing issue in Jackson Databind (93f8e0ff-f33d-11e8-be46-0019dbb15b3f)	Nessus	FreeBSD Local Security Checks	critical
118714	Oracle Primavera Gateway Multiple Vulnerabilities (Oct 2018 CPU)	Nessus	CGI abuses	critical
118230	Oracle Database Server Multiple Vulnerabilities (October 2018 CPU)	Nessus	Databases	critical
112192	Apache ActiveMQ 5.x < 5.15.5 Multiple Vulnerabilities	Nessus	CGI abuses	critical
111228	Oracle WebCenter Portal Multiple Vulnerabilities (July 2018 CPU)	Nessus	Misc.	critical
111209	Oracle WebLogic Server Multiple Vulnerabilities (July 2018 CPU)	Nessus	Misc.	critical
110798	RHEL 6 : Red Hat JBoss Enterprise Application Platform (RHSA-2018:2090)	Nessus	Red Hat Local Security Checks	critical
110797	RHEL 7 : Red Hat JBoss Enterprise Application Platform (RHSA-2018:2089)	Nessus	Red Hat Local Security Checks	critical
109906	RHEL 6 : Red Hat JBoss Enterprise Application Platform 6.4.20 (RHSA-2018:1449)	Nessus	Red Hat Local Security Checks	critical
109905	RHEL 7 : Red Hat JBoss Enterprise Application Platform 6.4.20 (RHSA-2018:1448)	Nessus	Red Hat Local Security Checks	critical
109838	RHEL 6 : eap6-jboss-ec2-eap (RHSA-2018:1451)	Nessus	Red Hat Local Security Checks	critical
109557	Debian DSA-4190-1 : jackson-databind - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2018-7489

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical