A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.
Priority MEDIUM 58CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 18 fixed, 15 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.21949 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.9.9, 2.8.11.4, 2.7.9.6 +1Red Hat: 14 advisoriesRed Hat: 18 fixed, 15 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.9.0 to before 2.9.9 | 2.9.9 | Patch available | GHSA-5ww9-j83m-q7qx |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.8.0 to before 2.8.11.4 | 2.8.11.4 | Patch available | GHSA-5ww9-j83m-q7qx |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.7.0 to before 2.7.9.6 | 2.7.9.6 | Patch available | GHSA-5ww9-j83m-q7qx |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.0.0 to before 2.6.7.3 | 2.6.7.3 | Patch available | GHSA-5ww9-j83m-q7qx |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.9.0 to before 2.9.9 Fixed in 2.9.9 Patch available GHSA-5ww9-j83m-q7qx
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.8.0 to before 2.8.11.4 Fixed in 2.8.11.4 Patch available GHSA-5ww9-j83m-q7qx
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.7.0 to before 2.7.9.6 Fixed in 2.7.9.6 Patch available GHSA-5ww9-j83m-q7qx
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.0.0 to before 2.6.7.3 Fixed in 2.6.7.3 Patch available GHSA-5ww9-j83m-q7qx
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | 2.0.0 to before 2.6.7.3; 2.7.0 to before 2.7.9.6; 2.8.0 to before 2.8.11.4; 2.9.0 to before 2.9.9 | Vulnerable | FasterXML |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.6.7.3; 2.7.0 to before 2.7.9.6; 2.8.0 to before 2.8.11.4; 2.9.0 to before 2.9.9 Vulnerable ·FasterXML
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-5ww9-j83m-q7qx com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.9 Advisory →
- Fix · GHSA-5ww9-j83m-q7qx com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.8.11.4 Advisory →
- Fix · GHSA-5ww9-j83m-q7qx com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.7.9.6 Advisory →
- Fix · GHSA-5ww9-j83m-q7qx com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.6.7.3 Advisory →
Red Hat 14 advisories
- RHSA-2020:3192 Released 2020-07-28 · Red Hat rating ImportantRed Hat Fuse 7.7.0 release and security update
- Red Hat Fuse 7.7.0
- RHSA-2020:1454 Released 2020-04-14 · Red Hat rating ImportantSatellite 6.7 release.
- Red Hat Satellite 6.7 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.7.1-1.el7sat +47
- Red Hat Satellite Capsule 6.7 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.7.1-1.el7sat +47
- RHSA-2019:3200 Released 2019-10-24 · Red Hat rating ModerateRed Hat AMQ Streams 1.3.0 release and security update
- Red Hat AMQ Streams 1
Show 11 more Red Hat advisories
- RHSA-2019:3149 Released 2019-10-18 · Red Hat rating ImportantOpenShift Container Platform logging-elasticsearch5-container security update
- Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
- RHSA-2019:3046 Released 2019-10-14 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.4 security update on RHEL 8
- Red Hat Single Sign-On 7.3 for RHEL 8 rh-sso7-keycloak-4.8.13-1.Final_redhat_00001.1.el8sso, rh-sso7-keycloak-server-4.8.13-1.Final_redhat_00001.1.el8sso
- RHSA-2019:3050 Released 2019-10-14 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.4 security update
- Red Hat Single Sign-On 7.3.4 zip
- RHSA-2019:3045 Released 2019-10-14 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.4 security update on RHEL 7
- Red Hat Single Sign-On 7.3 for RHEL 7 Server rh-sso7-keycloak-4.8.13-1.Final_redhat_00001.1.el7sso, rh-sso7-keycloak-server-4.8.13-1.Final_redhat_00001.1.el7sso, rh-sso7-libunix-dbus-java-0.8.0-2.el7sso +1
- RHSA-2019:3044 Released 2019-10-14 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.4 security update on RHEL 6
- Red Hat Single Sign-On 7.3 for RHEL 6 Server rh-sso7-keycloak-4.8.13-1.Final_redhat_00001.1.el6sso, rh-sso7-keycloak-server-4.8.13-1.Final_redhat_00001.1.el6sso
- RHSA-2019:2998 Released 2019-10-10 · Red Hat rating ImportantRed Hat OpenShift Application Runtimes Thorntail 2.5.0 security & bug fix update
- Text-Only RHOAR
- RHSA-2019:2936 Released 2019-10-01 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 7 security update
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.9.0-1.redhat_00005.1.el7eap, eap7-activemq-artemis-cli-2.9.0-1.redhat_00005.1.el7eap, eap7-activemq-artemis-commons-2.9.0-1.redhat_00005.1.el7eap +47
- RHSA-2019:2937 Released 2019-10-01 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 8 security update
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-activemq-artemis-2.9.0-1.redhat_00005.1.el8eap, eap7-activemq-artemis-cli-2.9.0-1.redhat_00005.1.el8eap, eap7-activemq-artemis-commons-2.9.0-1.redhat_00005.1.el8eap +47
- RHSA-2019:2935 Released 2019-10-01 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 6 Security update
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-activemq-artemis-2.9.0-1.redhat_00005.1.el6eap, eap7-activemq-artemis-cli-2.9.0-1.redhat_00005.1.el6eap, eap7-activemq-artemis-commons-2.9.0-1.redhat_00005.1.el6eap +47
- RHSA-2019:2938 Released 2019-09-30 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.4 security update
- Red Hat JBoss EAP 7.2
- RHSA-2019:2858 Released 2019-09-27 · Red Hat rating ImportantOpenShift Container Platform 4.1.18 logging-elasticsearch5 security update
- Red Hat OpenShift Container Platform 4.1 openshift4/ose-logging-elasticsearch5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat Mobile Application Platform 4 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.10 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.9 | Affected | No fix yet |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 9 (Mitaka) | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| streams for Apache Kafka | Affected | No fix yet |
| Red Hat AMQ Streams 1 | Fixed | RHSA-2019:3200 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | — |
| Red Hat Fuse 7.7.0 | Fixed | RHSA-2020:3192 |
| Red Hat JBoss EAP 7.2 | Fixed | RHSA-2019:2938 |
| Red Hat JBoss EAP 7.2 for RHEL 6 Server | Fixed | RHSA-2019:2935 |
| Red Hat JBoss EAP 7.2 for RHEL 7 Server | Fixed | RHSA-2019:2936 |
| Red Hat JBoss EAP 7.2 for RHEL 8 | Fixed | RHSA-2019:2937 |
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2019:3149 |
| Red Hat OpenShift Container Platform 4.1 | Fixed | RHSA-2019:2858 |
| Red Hat Satellite 6.6 | Fixed | — |
| Red Hat Satellite 6.7 | Fixed | RHSA-2020:1454 |
| Red Hat Satellite Capsule 6.6 | Fixed | — |
| Red Hat Satellite Capsule 6.7 | Fixed | RHSA-2020:1454 |
| Red Hat Single Sign-On 7.3 for RHEL 6 Server | Fixed | RHSA-2019:3044 |
| Red Hat Single Sign-On 7.3 for RHEL 7 Server | Fixed | RHSA-2019:3045 |
| Red Hat Single Sign-On 7.3 for RHEL 8 | Fixed | RHSA-2019:3046 |
| Red Hat Single Sign-On 7.3.4 zip | Fixed | RHSA-2019:3050 |
| Text-Only RHOAR | Fixed | RHSA-2019:2998 |
Not affected: 2 products
- Red Hat Decision Manager 7
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12086
- 2026-10-03 Alias added: GHSA-5ww9-j83m-q7qx
- 2026-10-08 CISA SSVC decision points changed
References
Patch 3
Advisory 27
- [debian-lts-announce] 20190521 [SECURITY] [DLA 1798-1] jackson-databind security update
- DSA-4452
- 20190527 [SECURITY] [DSA 4452-1] jackson-databind security update
- FEDORA-2019-99ff6aa32c
- FEDORA-2019-ae6a703b8f
- FEDORA-2019-fb23eccc03
- RHSA-2019:2858
- RHSA-2019:2937
- RHSA-2019:2935
- RHSA-2019:2936
- RHSA-2019:2938
- RHSA-2019:2998
- RHSA-2019:3044
- RHSA-2019:3045
- RHSA-2019:3050
- RHSA-2019:3046
- RHSA-2019:3149
- RHSA-2019:3200
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://security.netapp.com/advisory/ntap-20190530-0003/
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-12086
Other 30
- [spark-reviews] 20190520 [GitHub] [spark] Fokko opened a new pull request #24646: Spark 27757
- [cassandra-commits] 20190919 [jira] [Created] (CASSANDRA-15328) Bump jackson version to >= 2.9.9.3 to address security vulnerabilities
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- [nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html
- https://github.com/FasterXML/jackson-databind/commit/efc3c0d02f4743dbaa6d1b9c466772a2f13d966b
- https://github.com/FasterXML/jackson-databind/commit/dda513bd7251b4f32b7b60b1c13740e3b5a43024
- https://github.com/FasterXML/jackson-databind/commit/d30f036208ab1c60bd5ce429cb4f7f1a3e5682e8
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679@%3Ccommits.nifi.apache.org%3E
- https://lists.fedoraproject.org/archives/list/[email protected]/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544
- https://lists.fedoraproject.org/archives/list/[email protected]/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://security.netapp.com/advisory/ntap-20190530-0003
- https://web.archive.org/web/20200227030031/http://www.securityfocus.com/bid/109227
- https://web.archive.org/web/20200808181049/http://russiansecurity.expert/2016/04/20/mysql-connect-file-read
- https://github.com/FasterXML/jackson-databind
- https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2@%3Creviews.spark.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E
Sources
- CVE-2019-12086 · CVE Program
- CVE-2019-12086 · NVD
- FIRST EPSS
- GHSA-5ww9-j83m-q7qx · GitHub Advisory Database · CC BY 4.0
- CVE-2019-12086 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences