update release notes

Author: cowtowncoder

release-notes/VERSION-2.x

@@ -7,7 +7,7 @@ Project: jackson-databind
 2.9.9.2 (27-Jul-2019)
 
 #2331: `JsonMappingException` through nested getter with generic wildcard return type
-#2387: Block yet another deserialization gadget (EHCache, CVE-2019-xxxxx?)
+#2387: Block yet another deserialization gadget (CVE-2019-14379)
 #2389: Block yet another deserialization gadget (Logback, CVE-2019-xxxxx?)
 
 2.9.9.1 (03-Jul-2019)