https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-11619

https://github.com/FasterXML/jackson-databind/commit/113e89fb08b1b6b072d60b3e4737ed407c13db9a

--- jackson-databind-jackson-databind-2.7.6/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java.cve11619

+++ jackson-databind-jackson-databind-2.7.6/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java

@@ -45,6 +45,10 @@

         // [databind#1737]; 3rd party

 //s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor"); // deprecated by [databind#1855]

         s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");

+        // [databind#2680]

+        s.add("org.springframework.aop.config.MethodLocatingFactoryBean");

+        s.add("org.springframework.beans.factory.config.BeanReferenceFactoryBean");

+        

         s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");

         s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");

         // [databind#1855]: more 3rd party