From e5a8af130fbaa9644e50cf95e9bd9a772da81a32 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Dec 10 2019 15:27:03 +0000
Subject: import rh-maven35-jackson-databind-2.7.6-2.8.el7


---

diff --git a/SOURCES/CVE-2019-17531.patch b/SOURCES/CVE-2019-17531.patch
new file mode 100644
index 0000000..d63b517
--- /dev/null
+++ b/SOURCES/CVE-2019-17531.patch
@@ -0,0 +1,27 @@
+From 91ac9210837f534d47dc7eca35eb77f8b1d94478 Mon Sep 17 00:00:00 2001
+From: Marian Koncek <mkoncek@redhat.com>
+Date: Wed, 4 Dec 2019 16:18:31 +0100
+Subject: [PATCH] CVE-2019-17531
+
+---
+ .../jackson/databind/jsontype/impl/SubTypeValidator.java      | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+index 64e1373..907adcd 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
++++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+@@ -82,6 +82,10 @@ public class SubTypeValidator
+         // [databind#2389]: logback/jndi
+         s.add("ch.qos.logback.core.db.JNDIConnectionSource");
+ 
++        // [databind#2498]: log4j-extras (1.2)
++        s.add("org.apache.log4j.receivers.db.DriverManagerConnectionSource");
++        s.add("org.apache.log4j.receivers.db.JNDIConnectionSource");
++
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }
+ 
+-- 
+2.21.0
+
diff --git a/SPECS/jackson-databind.spec b/SPECS/jackson-databind.spec
index c162ca1..f0953d2 100644
--- a/SPECS/jackson-databind.spec
+++ b/SPECS/jackson-databind.spec
@@ -3,7 +3,7 @@
 
 Name:          %{?scl_prefix}jackson-databind
 Version:       2.7.6
-Release:       2.7%{?dist}
+Release:       2.8%{?dist}
 Summary:       General data-binding package for Jackson (2.x)
 License:       ASL 2.0 and LGPLv2+
 URL:           http://wiki.fasterxml.com/JacksonHome
@@ -24,6 +24,7 @@ Patch12:       CVE-2018-19361.patch
 Patch13:       CVE-2018-19362.patch
 Patch14:       CVE-2019-12384.patch
 Patch15:       CVE-2019-14379.patch
+Patch16:       CVE-2019-17531.patch
 
 BuildRequires: %{?scl_prefix}maven-local
 BuildRequires: %{?scl_prefix}mvn(com.fasterxml.jackson:jackson-parent:pom:)
@@ -64,6 +65,7 @@ This package contains javadoc for %{pkg_name}.
 %patch13 -p1
 %patch14 -p1
 %patch15 -p1
+%patch16 -p1
 
 cp -p src/main/resources/META-INF/LICENSE .
 cp -p src/main/resources/META-INF/NOTICE .
@@ -102,6 +104,9 @@ rm src/test/java/com/fasterxml/jackson/databind/ser/TestJdkTypes.java \
 %license LICENSE NOTICE
 
 %changelog
+* Wed Dec 04 2019 Marian Koncek <mkoncek@redhat.com> - 2.7.6-2.8
+- Fix CVE-2019-17531
+
 * Thu Sep 05 2019 Marian Koncek <mkoncek@redhat.com> - 2.7.6-2.7
 - Fix CVE-2019-14379