CVE-2019-12017: A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is use

Q: How do I fix CVE-2019-12017?

mapr: upgrade to 5.2.2. Exact commands for each OS are on this page.

Q: Is CVE-2019-12017 being exploited?

CVE-2019-12017 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2019-12017 affect?

CVE-2019-12017 affects mapr. Severity is critical (CVSS 9.8). A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the CLDB code that handles login and ticket issuance. An attacker can use the 'class' property of the JSON request sent to th

Q: How urgent is CVE-2019-12017?

Priority 61/100. Critical severity; Remotely exploitable, no login, no user action

This week

CRITICAL 9.8REMOTEUPGRADE

CVE-2019-12017 is a critical-severity flaw (CVSS 9.8) affecting mapr. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the CLDB code that handles login and ticket issuance. An attacker can use the 'class' property of the JSON request sent to the CLDB to influence the JSON library's decision on which Java class this JSON request is deserialized to. By doing so, the attacker can force the MapR CLDB to construct a URLClassLoader which loads a malicious

Why this priority

Critical severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	2.9% (top 13%)
CISA exploited list	No
Weakness	CWE-502
Published	2019-10-24
Last modified	2026-06-17

Publisher (CNA): Hewlett Packard Enterprise (HPE) · Vendor: mapr

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2019-10-24 15:15 UTCPublished CVE record published
2026-06-17 02:14 UTCUpdated Record last modified

mapr mapr UPGRADE

Affected: < 5.2.2

Fixed in: 5.2.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy mapr || rpm -q mapr || mapr --version

2. UPGRADE to 5.2.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade mapr

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade mapr

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-12017?

mapr: upgrade to 5.2.2. Exact commands for each OS are on this page.

Is CVE-2019-12017 being exploited?

CVE-2019-12017 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-12017 affect?

CVE-2019-12017 affects mapr. Severity is critical (CVSS 9.8). A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the CLDB code that handles login and ticket issuance. An attacker can use the 'class' property of the JSON request sent to th

How urgent is CVE-2019-12017?

Priority 61/100. Critical severity; Remotely exploitable, no login, no user action

Software pages

Java vulnerabilities

Related CVEs

CVE-2018-15804 HIGH 8.8 UPGRADE An issue was discovered in the MapR File System in MapR Converged Data Platform and MapR-XD 6.x and earlier

References

← Back to latest CVEs