dbcve.org
MaprApplication

CVE-2019-12017

CRITICAL · 9.8 CVSS v3.1 Published 2019-10-24
Fix available
A fix is available. Upgrade to 5.2.2 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the CLDB code that handles login and ticket issuance. An attacker can use the 'class' property of the JSON request sent to the CLDB to influence the JSON library's decision on which Java class this JSON request is deserialized to. By doing so, the attacker can force the MapR CLDB to construct a URLClassLoader which loads a malicious Java class from a remote path and instantiate this object in the MapR CLDB, thus executing arbitrary code on the machine running the MapR CLDB and take over the cluster. By switching to the newer Jackson library and ensuring that all incoming JSON requests are only deserialized to the same class that it was serialized from, the vulnerability is fixed. This vulnerability affects the entire MapR core platform.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A deserialization vulnerability in MapR CLDB's JSON framework allows attackers to manipulate the 'class' property in JSON requests to force instantiation of a URLClassLoader that loads malicious classes from remote paths, enabling arbitrary code execution and cluster takeover.

MitigationUpgrade to newer Jackson library and implement strict type checking to ensure all JSON requests are deserialized only to the expected class types they were serialized from.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
MaprApplication
Affected:< 5.2.2

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check MapR cluster version
    Run 'maprcli cluster info' or inspect /opt/mapr/MapRBuildVersion to obtain the installed MapR version
    Affected if The installed version is lower than 5.2.2
  2. Verify CLDB service is running
    Run 'maprcli node list -cldb true' or check for cldb processes via 'ps -ef | grep cldb' to confirm the Container Location Database service is active
    Affected if CLDB is running and responds to requests
  3. Confirm REST API exposure
    Check /opt/mapr/conf/mapr-httpfs.conf or examine open ports (typically 8443, 8080, 10000) using 'netstat -tlnp' to determine if MapR REST services are exposed
    Affected if REST API endpoints are listening and accessible from network paths used by attackers
  4. Identify JSON deserialization endpoints
    Review MapR configuration files in /opt/mapr/conf/ for JSON-handling endpoints, particularly CLDB administrative interfaces that accept JSON payloads
    Affected if CLDB accepts unauthenticated or weakly authenticated JSON requests via HTTP
  5. Check Jackson library version
    Locate Jackson JAR files in /opt/mapr/lib/ or /opt/mapr/3rdparty/ and examine the filename for version information (jackson-core-*.jar, jackson-databind-*.jar)
    Affected if Jackson library version bundled with MapR is older than the fixed release addressing the class property manipulation

Your environment is affected if MapR version is below 5.2.2, CLDB service is active, and JSON deserialization endpoints are accessible over the network without strict type validation.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 5.2.2 or later
Fixed in 5.2.2
Interim mitigation

Upgrade to newer Jackson library and implement strict type checking to ensure all JSON requests are deserialized only to the expected class types they were serialized from.

Recommended fix High confidence

MapR 5.2.2 or later

  1. 1. Back up the current MapR cluster configuration, including the CLDB data and all mapr-clusters.conf files
  2. 2. Download MapR 5.2.2 or later from the official MapR download portal at mapr.com
  3. 3. Review the MapR Upgrade Guide for your current version to ensure compatibility
  4. 4. Stop all MapR services on the cluster nodes in the recommended order (ZooKeeper first, then CLDB, then other services)
  5. 5. Install the MapR 5.2.2 packages or later on all nodes using the package manager or the MapR installer
  6. 6. Upgrade the CLDB (Central Directory Database) service to the new version
  7. 7. Restart ZooKeeper, then CLDB, then all other MapR services in the proper sequence
  8. 8. Verify the CLDB is running and accepting JSON requests correctly by testing login and ticket issuance
Caveat Major MapR version upgrades may introduce breaking changes in CLI syntax, configuration formats, or compatibility with client applications; review the MapR 5.2.2 release notes before upgrading

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Mapr Scoped from the published advisory
  • Consultation12.0 h
  • Implementation32.0 h
  • Testing20.0 h
  • Review / QA10.0 h
74.0 hours of engineering $12,960
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $20,736.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2019-12017 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2019-12017 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data