# CVE-2019-12086: libjackson2-databind-java: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.xbefore 2.9.9 CVE-2019-12086 is fixed in 47 products on 1 platform, first by RHBA-2019:3416, released November 5, 2019. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2019-12086 - Priority: High - CVSS: 7.5 (Medium) - EPSS: 0.2195 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Nov 5, 2019 ## Description A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.xbefore 2.9.9. When Default Typing is enabled (either globally or for aspecific property) for an externally exposed JSON endpoint, the service hasthe mysql-connector-java jar (8.0.14 or earlier) in the classpath, and anattacker can host a crafted MySQL server reachable by the victim, anattacker can send a crafted JSON message that allows them to read arbitrarylocal files on the server. This occurs because of missingcom.mysql.cj.jdbc.admin.MiniAdmin validation. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | apache-commons-collections RHEL 8 | 0:3.2.2-10.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | apache-commons-lang RHEL 8 | 0:2.6-21.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | bea-stax-api RHEL 8 | 0:1.2.0-16.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | glassfish-fastinfoset RHEL 8 | 0:1.2.13-9.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | glassfish-jaxb-api RHEL 8 | 0:2.2.12-8.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | glassfish-jaxb-core RHEL 8 | 0:2.2.11-11.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | glassfish-jaxb-runtime RHEL 8 | 0:2.2.11-11.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | glassfish-jaxb-txw2 RHEL 8 | 0:2.2.11-11.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | jackson-annotations RHEL 8 | 0:2.9.9-1.module+el8.1.0+3832+9784644d | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | jackson-core RHEL 8 | 0:2.9.9-1.module+el8.1.0+3832+9784644d | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | jackson-databind RHEL 8 | 0:2.9.9.2-1.module+el8.1.0+3832+9784644d | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | jackson-jaxrs-json-provider RHEL 8 | 0:2.9.9-1.module+el8.1.0+3832+9784644d | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | jackson-jaxrs-providers RHEL 8 | 0:2.9.9-1.module+el8.1.0+3832+9784644d | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | jackson-module-jaxb-annotations RHEL 8 | 0:2.7.6-4.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | jakarta-commons-httpclient RHEL 8 | 1:3.1-28.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | javassist RHEL 8 | 0:3.18.1-8.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | javassist-javadoc RHEL 8 | 0:3.18.1-8.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | jss RHEL 8 | 0:4.6.0-5.module+el8.1.0+4218+3fd65c36 | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | jss-javadoc RHEL 8 | 0:4.6.0-5.module+el8.1.0+4218+3fd65c36 | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | ldapjdk RHEL 8 | 0:4.21.0-1.module+el8.1.0+3370+6d076660 | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | ldapjdk-javadoc RHEL 8 | 0:4.21.0-1.module+el8.1.0+3370+6d076660 | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | libjackson2-databind-java Ubuntu 24.10 (oracular) | 2.9.8-2 | [libjackson2-databind-java 2.9.8-2](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libjackson2-databind-java-2.9.8-2.md) | Jan 16, 2026 | | Linux | libjackson2-databind-java Ubuntu 25.04 (plucky) | 2.9.8-2 | [libjackson2-databind-java 2.9.8-2](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libjackson2-databind-java-2.9.8-2.md) | Jan 16, 2026 | | Linux | pki-base RHEL 8 | 0:10.7.3-1.module+el8.1.0+3964+500fc130 | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | pki-base-java RHEL 8 | 0:10.7.3-1.module+el8.1.0+3964+500fc130 | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | pki-ca RHEL 8 | 0:10.7.3-1.module+el8.1.0+3964+500fc130 | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | pki-kra RHEL 8 | 0:10.7.3-1.module+el8.1.0+3964+500fc130 | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | pki-server RHEL 8 | 0:10.7.3-1.module+el8.1.0+3964+500fc130 | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | pki-servlet-4.0-api RHEL 8 | 1:9.0.7-16.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | pki-servlet-engine RHEL 8 | 1:9.0.7-16.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | pki-symkey RHEL 8 | 0:10.7.3-1.module+el8.1.0+3964+500fc130 | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | pki-tools RHEL 8 | 0:10.7.3-1.module+el8.1.0+3964+500fc130 | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | python-nss-doc RHEL 8 | 0:1.0.1-10.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | python3-nss RHEL 8 | 0:1.0.1-10.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | python3-pki RHEL 8 | 0:10.7.3-1.module+el8.1.0+3964+500fc130 | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | relaxngDatatype RHEL 8 | 0:2011.1-7.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | resteasy RHEL 8 | 0:3.0.26-3.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | slf4j RHEL 8 | 0:1.7.25-4.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | slf4j-jdk14 RHEL 8 | 0:1.7.25-4.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | stax-ex RHEL 8 | 0:1.7.7-8.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | tomcatjss RHEL 8 | 0:7.4.1-1.module+el8.1.0+3370+6d076660 | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | velocity RHEL 8 | 0:1.7-24.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | xalan-j2 RHEL 8 | 0:2.7.1-38.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | xerces-j2 RHEL 8 | 0:2.11.0-34.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | xml-commons-apis RHEL 8 | 0:1.4.01-25.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | xml-commons-resolver RHEL 8 | 0:1.2-26.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | xmlstreambuffer RHEL 8 | 0:1.5.4-8.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | | Linux | xsom RHEL 8 | 0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c | [RHBA-2019:3416](https://patchblox.com/security/data/fix/linux/rhba-2019-3416.md) | Nov 5, 2019 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.