The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0104 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-12384:
    FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by     leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the     classpath content, remote code execution may be possible.

    CVE-2019-14540:
    A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to     com.zaxxer.hikari.HikariConfig.

    CVE-2019-16335:
    A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to     com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2720 advisory.

    jackson-databind

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4813-1 advisory.

    It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly     use this issue to obtain sensitive information. (CVE-2018-11307, CVE-2019-12086, CVE-2019-12814)

    It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly     use this issue to execute arbitrary code or other unspecified impact. (CVE-2018-12022, CVE-2018-12023,     CVE-2018-14718, CVE-2018-14719, CVE-2018-19360, CVE-2018-19361, CVE-2018-19362, CVE-2019-12384,     CVE-2019-14379, CVE-2019-14439, CVE-2019-14540, CVE-2019-16335, CVE-2019-16942, CVE-2019-16943,     CVE-2019-17267, CVE-2019-17531, CVE-2019-20330, CVE-2020-10672, CVE-2020-10673, CVE-2020-10968,     CVE-2020-10969, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-11619, CVE-2020-11620,     CVE-2020-14060, CVE-2020-14061, CVE-2020-14062, CVE-2020-14195, CVE-2020-8840, CVE-2020-9546,     CVE-2020-9547, CVE-2020-9548)

    It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly     use this issue to execute XML entity (XXE) attacks. (CVE-2018-14720)

    It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly     use this issue to execute server-side request forgery (SSRF). (CVE-2018-14721)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by     leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the     classpath content, remote code execution may be possible. (CVE-2019-12384)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2937 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.4 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.3, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.4 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)

    * jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to     remote code execution (CVE-2019-12384)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     via crafted JSON message (CVE-2019-12814)

    * undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files     (CVE-2019-10212)

    * codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities (CVE-2019-10202)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     (CVE-2019-12086)

    * undertow: Information leak in requests for directories without trailing slashes (CVE-2019-10184)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that jackson-databind, a Java library used to parse JSON and other data formats, did not properly validate user input before attempting deserialization. This allowed an attacker providing maliciously crafted input to perform code execution, or read arbitrary files on the server.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
239137	TencentOS Server 3: pki-deps:10.6 (TSSA-2022:0104)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/5	critical
180815	Oracle Linux 8 : pki-deps:10.6 (ELSA-2019-2720)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	medium
183541	Ubuntu 16.04 ESM : Jackson Databind vulnerabilities (USN-4813-1)	Nessus	Ubuntu Local Security Checks	2023/10/20	2024/8/28	critical
251701	Linux Distros Unpatched Vulnerability : CVE-2019-12384	Nessus	Misc.	2025/8/19	2025/9/2	medium
129518	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 8 (RHSA-2019:2937)	Nessus	Red Hat Local Security Checks	2019/10/2	2024/11/6	critical
129597	Debian DSA-4542-1 : jackson-databind - security update	Nessus	Debian Local Security Checks	2019/10/7	2024/4/19	critical

检测

插件搜索

critical

medium

critical

medium

critical

critical