CVE-2019-12086: Information exposure in FasterXML jackson-databind
Summary
CVE-2019-12086: Information exposure in FasterXML jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 4 version ranges.
>= 2.0.0, < 2.6.7.3
>= 2.7.0, < 2.7.9.6
>= 2.8.0, < 2.8.11.4
>= 2.9.0, < 2.9.9
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2019-12086 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The FasterXML jackson-databind package is a popular Java library used for serializing and deserializing JSON data. It provides functionality for converting JSON objects to Java objects and vice versa. This vulnerability affects versions 2.x before 2.9.9 of the jackson-databind package. The vulnerability arises when Default Typing is enabled for an externally exposed JSON endpoint and the mysql-connector-java jar (8.0.14 or earlier) is present in the classpath. If an attacker can host a crafted MySQL server that is reachable by the victim, they can exploit this vulnerability to read arbitrary local files on the server.
Vulnerability Detail
The vulnerability, identified as CVE-2019-12086, is a Polymorphic Typing issue in FasterXML jackson-databind. When Default Typing is enabled for an externally exposed JSON endpoint, an attacker can send a specially crafted JSON message to the server. If the server has the vulnerable mysql-connector-java jar in its classpath and the attacker can host a malicious MySQL server, they can exploit this vulnerability to read arbitrary local files on the server. This occurs due to missing com.mysql.cj.jdbc.admin.MiniAdmin validation. The impact of this vulnerability is significant as it allows unauthorized access to sensitive files on the server, potentially leading to further exploitation and compromise of the system.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.6.7.32.6.7.3 -
>= 2.7.0, < 2.7.9.62.7.9.6 -
>= 2.8.0, < 2.8.11.42.8.11.4 -
>= 2.9.0, < 2.9.92.9.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the jackson-databind package and the mysql-connector-java jar is not immediately feasible, a temporary workaround is to disable Default Typing for the externally exposed JSON endpoint. This can be done by modifying the application's configuration to explicitly disable Default Typing. However, it is important to note that this workaround may impact the functionality of the application, and it is strongly recommended to apply the permanent fix by upgrading the vulnerable packages as soon as possible.
Conclusion
In conclusion, the CVE-2019-12086 vulnerability in FasterXML jackson-databind exposes sensitive information by allowing unauthorized access to local files on the server. To mitigate this vulnerability, it is crucial to upgrade the jackson-databind package and the mysql-connector-java jar to non-vulnerable versions. This will ensure the security of the application and prevent potential exploitation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
FasterXML jackson-databind is a Java library used for serializing and deserializing JSON data. It provides functionality for converting JSON objects to Java objects and vice versa.
Default Typing is a feature in jackson-databind that allows automatic detection and inclusion of type information during serialization and deserialization of JSON objects. It helps in preserving the type information of objects when converting them to JSON and vice versa.
This vulnerability allows an attacker to read arbitrary local files on the server hosting the vulnerable application. It can lead to unauthorized access to sensitive information and potential further exploitation of the system.
To fix this vulnerability, it is recommended to upgrade the jackson-databind package to version 2.9.9 or later and update the mysql-connector-java jar to a version that is not vulnerable (8.0.15 or later). This will mitigate the vulnerability and prevent unauthorized file access.
Yes, a temporary workaround is to disable Default Typing for the externally exposed JSON endpoint. However, it is important to note that this workaround may impact the functionality of the application, and it is strongly recommended to apply the permanent fix by upgrading the vulnerable packages.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
