CVE-2019-12086
- State
- Published
- Severity
- Not scored
- Published
- May 17, 2019
- Updated
- Oct 8, 2026
- Reserved
- May 13, 2019
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [spark-reviews] 20190520 [GitHub] [spark] Fokko opened a new pull request #24646: Spark 27757mailing-list
- [debian-lts-announce] 20190521 [SECURITY] [DLA 1798-1] jackson-databind security updatemailing-list
- DSA-4452vendor-advisory
- 20190527 [SECURITY] [DSA 4452-1] jackson-databind security updatemailing-list
- 109227vdb-entry
- FEDORA-2019-99ff6aa32cvendor-advisory
- [cassandra-commits] 20190919 [jira] [Created] (CASSANDRA-15328) Bump jackson version to >= 2.9.9.3 to address security vulnerabilitiesmailing-list
- FEDORA-2019-ae6a703b8fvendor-advisory
- FEDORA-2019-fb23eccc03vendor-advisory
- RHSA-2019:2858vendor-advisory
- RHSA-2019:2937vendor-advisory
- RHSA-2019:2935vendor-advisory
- RHSA-2019:2936vendor-advisory
- RHSA-2019:2938vendor-advisory
- RHSA-2019:2998vendor-advisory
- RHSA-2019:3044vendor-advisory
- RHSA-2019:3045vendor-advisory
- RHSA-2019:3050vendor-advisory
- RHSA-2019:3046vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilitiesmailing-list
- RHSA-2019:3149vendor-advisory
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- RHSA-2019:3200vendor-advisory
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.htmlmailing-list
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.htmlmailing-list
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1mailing-list
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://security.netapp.com/advisory/ntap-20190530-0003/
- http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/
- https://github.com/FasterXML/jackson-databind/issues/2326
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9
- [nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.htmlmailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.