CVE-2018-14721: Server-Side Request Forgery (SSRF) (CWE-918)
value: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 10
Published: 2019-01-02T18:29Z
Repository: https://github.com/FasterXML/jackson-databind
Language: Other
Files changed: release-notes/VERSION, src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
Commit date: 2018-08-16 14:42:57 -0700
Commit message: Fix #2097 for 2.6.7.2

Diff: diff --git a/release-notes/VERSION b/release-notes/VERSION
index 859acc715..30efa6f3b 100644
--- a/release-notes/VERSION
+++ b/release-notes/VERSION
@@ -3,11 +3,14 @@ Project: jackson-databind
 ------------------------------------------------------------------------
 === Releases ===
 ------------------------------------------------------------------------
 
 2.6.7.2 (not yet released)
+
 #1737: Block more JDK types from polymorphic deserialization
+#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
+  - CVE-2018-14721)
 
 2.6.7.1 (11-Jul-2017)
 
 #1383: Problem with `@JsonCreator` with 1-arg factory-method, implicit param names
 #1599: Backport the extra safety checks for polymorphic deserialization
diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
index 0b1613b04..fb4c904b7 100644
--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
@@ -66,10 +66,16 @@ public class BeanDeserializerFactory
         s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor");
         s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
         s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
         s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
 
+        // [databind#2097]: some 3rd party, one JDK-bundled
+        s.add("org.slf4j.ext.EventData");
+        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
+        s.add("com.sun.deploy.security.ruleset.DRSHelper");
+        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }
 
     /**
      * Set of class names of types that are never to be deserialized.

Fixed code: 
#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
  - CVE-2018-14721)
        // [databind#2097]: some 3rd party, one JDK-bundled
        s.add("org.slf4j.ext.EventData");
        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
        s.add("com.sun.deploy.security.ruleset.DRSHelper");
        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");