Merge branch '2.7' into 2.8

Author: cowtowncoder

release-notes/VERSION

@@ -3,11 +3,17 @@ Project: jackson-databind
 === Releases ===
 ------------------------------------------------------------------------
 
+<<<<<<< HEAD
 2.8.11.4 (not released)
+=======
+2.7.9.6 (26-Jul-2019)
+>>>>>>> 2.7
 
 #2326: Block one more gadget type (CVE-2019-12086)
 #2334: Block class for CVE-2019-12384
 #2341: Block class for CVE-2019-12814
+#2387: Block yet another deserialization gadget (EHCache, CVE-2019-xxxxx?)
+#2389: Block yet another deserialization gadget (Logback, CVE-2019-xxxxx?)
 
 2.8.11.3 (23-Nov-2018)
 

src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java

@@ -92,6 +92,12 @@ public class SubTypeValidator
         s.add("org.jdom.transform.XSLTransformer");
         s.add("org.jdom2.transform.XSLTransformer");
 
+        // [databind#2387]: EHCache
+        s.add("net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup");
+
+        // [databind#2389]: logback/jndi
+        s.add("ch.qos.logback.core.db.JNDIConnectionSource");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }