Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

CVE

CVE-2019-12086

Information exposure in FasterXML jackson-databind

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.

Base CVSS

7.5

EPSS Score

15.75%

Introduced Version

2.0.0-RC1

Fix Available

2.7.9.6,2.6.7.3,2.8.11.4,2.9.9

Fix without Upgrading

Available Patches

Package

CVEs Fixed

Lines of Code Changed

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

References

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E

https://nvd.nist.gov/vuln/detail/CVE-2019-12086

https://access.redhat.com/errata/RHSA-2019:3200

https://www.oracle.com/security-alerts/cpuapr2022.html

https://access.redhat.com/errata/RHSA-2019:3045

https://access.redhat.com/errata/RHSA-2019:2858

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2@%3Creviews.spark.apache.org%3E

https://access.redhat.com/errata/RHSA-2019:2936

https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E

https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9

https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E

https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062

https://github.com/FasterXML/jackson-databind/commit/efc3c0d02f4743dbaa6d1b9c466772a2f13d966b

https://www.oracle.com/security-alerts/cpuoct2020.html

https://github.com/FasterXML/jackson-databind/commit/d30f036208ab1c60bd5ce429cb4f7f1a3e5682e8

https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679@%3Ccommits.nifi.apache.org%3E

https://access.redhat.com/errata/RHSA-2019:2998

https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E

https://access.redhat.com/errata/RHSA-2019:3044

https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E

https://seclists.org/bugtraq/2019/May/68

https://www.oracle.com/security-alerts/cpuApr2021.html

https://www.oracle.com/security-alerts/cpuapr2020.html

https://access.redhat.com/errata/RHSA-2019:3050

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544

https://access.redhat.com/errata/RHSA-2019:2935

https://access.redhat.com/errata/RHSA-2019:2938

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

https://github.com/FasterXML/jackson-databind

https://www.debian.org/security/2019/dsa-4452

https://www.oracle.com/security-alerts/cpujul2020.html

https://www.oracle.com/security-alerts/cpujan2020.html

https://access.redhat.com/errata/RHSA-2019:3149

https://web.archive.org/web/20200808181049/http://russiansecurity.expert/2016/04/20/mysql-connect-file-read

https://web.archive.org/web/20200227030031/http://www.securityfocus.com/bid/109227

https://access.redhat.com/errata/RHSA-2019:2937

https://access.redhat.com/errata/RHSA-2019:3046

https://github.com/FasterXML/jackson-databind/issues/2326

https://security.netapp.com/advisory/ntap-20190530-0003

https://lists.debian.org/debian-lts-announce/2019/05/msg00030.html

https://github.com/FasterXML/jackson-databind/commit/dda513bd7251b4f32b7b60b1c13740e3b5a43024

AppSec for the Software Development Revolution

Endor Labs builds a complete graph of your software estate, so teams can pinpoint and fix critical risks in complex, dependency-rich code—whether it was written by humans or AI.

Welcome to the resistance

Oops! Something went wrong, please try again.