Fix #2334

FasterXML · Jun 13, 2019 · c9ef4a1 · c9ef4a1
1 parent b596365
commit c9ef4a1
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/release-notes/VERSION b/release-notes/VERSION
@@ -8,6 +8,7 @@ Not yet released
 
 #2326: Block class for CVE-2019-12086
  (contributed by MaximilianTews@github)
+#2334: Block class for CVE-2019-12384
 
 2.7.9.5 (23-Nov-2018)
 

diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
@@ -81,6 +81,9 @@ public class SubTypeValidator
 
         // [databind#2326] (2.7.9.6): one more 3rd party gadget
         s.add("com.mysql.cj.jdbc.admin.MiniAdmin");
+
+        // [databind#2334] (2.9.9.1): logback-core
+        s.add("ch.qos.logback.core.db.DriverManagerConnectionSource");
 
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }