A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.

Project Subscriptions

Vendors Products
Debian Linux Subscribe
Fasterxml Subscribe
Jackson-databind Subscribe
Amq Streams Subscribe
Enterprise Linux Subscribe
Jboss Enterprise Application Platform Subscribe
Jboss Fuse Subscribe
Jboss Single Sign On Subscribe
Openshift Subscribe
Openshift Application Runtimes Subscribe
Red Hat Single Sign On Subscribe
Satellite Subscribe
Satellite Capsule Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-1798-1 jackson-databind security update
Debian DSA Debian DSA DSA-4452-1 jackson-databind security update
Github GHSA Github GHSA GHSA-5ww9-j83m-q7qx Information exposure in FasterXML jackson-databind
Ubuntu USN Ubuntu USN USN-4813-1 Jackson Databind vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/ cve-icon cve-icon
http://www.securityfocus.com/bid/109227 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2858 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2935 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2936 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2937 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2938 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2998 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3044 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3045 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3046 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3050 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3149 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3200 cve-icon cve-icon
https://github.com/FasterXML/jackson-databind/issues/2326 cve-icon cve-icon
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9 cve-icon cve-icon
https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2%40%3Creviews.spark.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/05/msg00030.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/ cve-icon cve-icon
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2019-12086 cve-icon
https://seclists.org/bugtraq/2019/May/68 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20190530-0003/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2019-12086 cve-icon
https://www.debian.org/security/2019/dsa-4452 cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuApr2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2020.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-04T23:10:30.184Z

Reserved: 2019-05-13T00:00:00

Link: CVE-2019-12086

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-05-17T17:29:00.483

Modified: 2024-11-21T04:22:10.617

Link: CVE-2019-12086

cve-icon Redhat

Severity : Moderate

Publid Date: 2019-05-14T00:00:00Z

Links: CVE-2019-12086 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses