A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
7036DA13-110D-40B3-8494-E361BBF4AFCD
2.6.7.3
2.0.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
89660FC3-9198-414C-B89D-C61A4438BA3B
2.7.9.6
2.7.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
5DB8A2D4-0FDE-4216-896B-52824106B97B
2.8.11.4
2.8.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
0E3E465E-0DE3-4DD3-A023-6444C47895CE
2.9.9
2.9.0
OR
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
OR
A new gadget type (see https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062) was reported, and CVE id allocated was `CVE-2019-12086`.
CVE description is available at: https://nvd.nist.gov/vuln/detail/CVE-2019-12086 for full details, but the specific variation (in addition to needing "default typing", attacker being able to craft specific json message) is that:

* If service has jar `mysql-connector-java` in its classpath

vulnerability applies, and attacker is able to read arbitrary files from service's local file system.

Original vulnerability discoverer: 618 from College of software, Nankai University

-----

Fixed in:

* 2.9.9 and later
* 2.8.11.4
* 2.7.9.6
* 2.6.7.3



Block one more gadget type (mysql, CVE-2019-12086)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block one more gadget type (mysql, CVE-2019-12086)
Issue date:

--- start body ---
A new gadget type (see https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062) was reported, and CVE id allocated was `CVE-2019-12086`.
CVE description is available at: https://nvd.nist.gov/vuln/detail/CVE-2019-12086 for full details, but the specific variation (in addition to needing "default typing", attacker being able to craft specific json message) is that:

* If service has jar `mysql-connector-java` in its classpath

vulnerability applies, and attacker is able to read arbitrary files from service's local file system.

Original vulnerability discoverer: 618 from College of software, Nankai University

-----

Fixed in:

* 2.9.9 and later
* 2.8.11.4
* 2.7.9.6
* 2.6.7.3



--- end body ---

comments :
--- start comments ---

--- end comments ---