PT-2019-2927 · Mysql Server+4 · Mysql Connector/J+4
Published
2019-05-16
·
Updated
2025-09-29
·
CVE-2019-12086
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
FasterXML jackson-databind versions 2.x before 2.9.9
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled for an externally exposed JSON endpoint and the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing
com.mysql.cj.jdbc.admin.MiniAdmin validation. The issue can be exploited by a remote attacker to access confidential data by sending a specially crafted JSON message.Recommendations
For FasterXML jackson-databind versions 2.x before 2.9.9, update to version 2.9.9 or later to resolve the issue.
As a temporary workaround, consider disabling the Default Typing feature for externally exposed JSON endpoints until a patch is available.
Restrict access to the
mysql-connector-java jar in the classpath to minimize the risk of exploitation.
Avoid using the com.mysql.cj.jdbc.admin.MiniAdmin class in the affected JSON endpoint until the issue is resolved.Exploit
Fix
Deserialization of Untrusted Data
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Red Os
Ubuntu
Jackson-Databind
Mysql Connector/J