Add patch for CVE-2018-5968

CVE-2018-5968.patch

@@ -0,0 +1,15 @@
+diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+index 42273e084..37b122734 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
++++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+@@ -50,6 +50,10 @@
+         // [databind#1855]: more 3rd party
+         s.add("org.apache.tomcat.dbcp.dbcp2.BasicDataSource");
+         s.add("com.sun.org.apache.bcel.internal.util.ClassLoader");
++        // [databind#1899]: more 3rd party
++        s.add("org.hibernate.jmx.StatisticsService");
++        s.add("org.apache.ibatis.datasource.jndi.JndiDataSourceFactory");
++
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }
+ 

jackson-databind.spec

@@ -1,6 +1,6 @@
 Name:          jackson-databind
 Version:       2.7.6
-Release:       7%{?dist}
+Release:       8%{?dist}
 Summary:       General data-binding package for Jackson (2.x)
 License:       ASL 2.0 and LGPLv2+
 URL:           http://wiki.fasterxml.com/JacksonHome
@@ -11,6 +11,7 @@ Patch0: CVE-2017-7525.patch
 Patch1: CVE-2017-15095.patch
 Patch2: CVE-2017-17485-1.patch
 Patch3: CVE-2017-17485-2.patch
+Patch4: CVE-2018-5968.patch
 
 BuildRequires: maven-local
 BuildRequires: mvn(com.fasterxml.jackson:jackson-parent:pom:)
@@ -39,6 +40,7 @@ This package contains javadoc for %{name}.
 %patch1
 %patch2 -p1
 %patch3 -p1
+%patch4 -p1
 
 cp -p src/main/resources/META-INF/LICENSE .
 cp -p src/main/resources/META-INF/NOTICE .
@@ -77,6 +79,9 @@ rm src/test/java/com/fasterxml/jackson/databind/ser/TestJdkTypes.java \
 %license LICENSE NOTICE
 
 %changelog
+* Fri Jan 26 2018 Mat Booth <mat.booth@redhat.com> - 2.7.6-8
+- Add patch for CVE-2018-5968
+
 * Mon Jan 15 2018 Mat Booth <mat.booth@redhat.com> - 2.7.6-7
 - Better patch for CVE-2017-17485