https://bugzilla.redhat.com/show_bug.cgi?id=1462702
--- Doc Text *updated* by Eric Christensen sparks@redhat.com --- A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
java-sig-commits@lists.fedoraproject.org