update release notes

Author: cowtowncoder

release-notes/VERSION-2.x

@@ -13,7 +13,7 @@ Project: jackson-databind
 
 #2331: `JsonMappingException` through nested getter with generic wildcard return type
 #2387: Block yet another deserialization gadget (CVE-2019-14379)
-#2389: Block yet another deserialization gadget (CVE-2019-14361)
+#2389: Block yet another deserialization gadget (CVE-2019-14439)
  (reported by xiexq)
 
 2.9.9.1 (03-Jul-2019)