Backport databind#2326 to 2.7 CVE-2019-12086 (#2333)

FasterXML · May 28, 2019 · d30f036 · d30f036
1 parent 2684204
commit d30f036
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
@@ -77,7 +77,11 @@ public class SubTypeValidator
         s.add("org.jboss.util.propertyeditor.DocumentEditor");
         s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
         s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
-        s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");        
+        s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");   
+
+        // [databind#2326] (2.7.9.6): one more 3rd party gadget
+        s.add("com.mysql.cj.jdbc.admin.MiniAdmin");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }