Merge branch '2.9' into 2.10

Author: cowtowncoder

release-notes/VERSION-2.x

@@ -135,7 +135,7 @@ Project: jackson-databind
 #2478: Block two more gadget types (commons-dbcp, p6spy,
   CVE-2019-16942 / CVE-2019-16943)
  (reported by b5mali4 / [email protected])
-#2498: Block one more gadget type (log4j-extras/1.2)
+#2498: Block one more gadget type (log4j-extras/1.2, CVE-2019-17531)
 
 2.9.10 (21-Sep-2019)
 
@@ -160,6 +160,7 @@ Project: jackson-databind
 #2462: Block two more gadget types (commons-configuration)
 #2469: Block one more gadget type (xalan2)
 <<<<<<< HEAD:release-notes/VERSION-2.x
+<<<<<<< HEAD:release-notes/VERSION-2.x
 
 2.9.9 (16-May-2019)