CVE-2018-14720: Improper Restriction of XML External Entity Reference (CWE-611)
value: FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2019-01-02T18:29Z
Repository: https://github.com/FasterXML/jackson-databind
Language: Other
Files changed: release-notes/VERSION, src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
Commit date: 2018-08-16 14:42:57 -0700
Commit message: Fix #2097 for 2.6.7.2

Diff: diff --git a/release-notes/VERSION b/release-notes/VERSION
index 859acc715..30efa6f3b 100644
--- a/release-notes/VERSION
+++ b/release-notes/VERSION
@@ -3,11 +3,14 @@ Project: jackson-databind
 ------------------------------------------------------------------------
 === Releases ===
 ------------------------------------------------------------------------
 
 2.6.7.2 (not yet released)
+
 #1737: Block more JDK types from polymorphic deserialization
+#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
+  - CVE-2018-14721)
 
 2.6.7.1 (11-Jul-2017)
 
 #1383: Problem with `@JsonCreator` with 1-arg factory-method, implicit param names
 #1599: Backport the extra safety checks for polymorphic deserialization
diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
index 0b1613b04..fb4c904b7 100644
--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
@@ -66,10 +66,16 @@ public class BeanDeserializerFactory
         s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor");
         s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
         s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
         s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
 
+        // [databind#2097]: some 3rd party, one JDK-bundled
+        s.add("org.slf4j.ext.EventData");
+        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
+        s.add("com.sun.deploy.security.ruleset.DRSHelper");
+        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }
 
     /**
      * Set of class names of types that are never to be deserialized.

Fixed code: 
#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
  - CVE-2018-14721)
        // [databind#2097]: some 3rd party, one JDK-bundled
        s.add("org.slf4j.ext.EventData");
        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
        s.add("com.sun.deploy.security.ruleset.DRSHelper");
        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");