The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1644 advisory.

  - A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to     com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
    (CVE-2019-16335)

  - A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default     Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and     the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a     JNDI service to access, it is possible to make the service execute a malicious payload. (CVE-2019-17531)

  - A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to     com.zaxxer.hikari.HikariConfig. (CVE-2019-14540)

  - A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default     Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and     the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service     endpoint to access, it is possible to make the service execute a malicious payload. This issue exists     because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and     org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling. (CVE-2019-16942)

  - A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default     Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and     the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint     to access, it is possible to make the service execute a malicious payload. This issue exists because of     com.p6spy.engine.spy.P6DataSource mishandling. (CVE-2019-16943)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 8 : pki-core:10.6 / and / pki-deps:10.6 (ELSA-2020-1644)

critical Nessus Plugin ID 180911

Version 1.2