jackson-databind: CVE-2019-14379 and CVE-2019-14439

[msymons]

URL: CVE-2019-14379 and CVE-2019-14439
format: maven
name: com.fasterxml.jackson.core:jackson-databind
versions: < 2.9.9.3

Note that the fix version that I give here is not the same as that listed in the CVE (2.9.9.2). That's because 2.9.9.2 introduced a recursion:

FasterXML/jackson-databind#2395

Example purl that should link to the CVE in OSS Index:

pkg:maven/com.fasterxml.jackson.core/[email protected]?type=jar

[ken-duck]

We had an exception preventing the processing of some CVEs. This has been resolved. Thanks for the heads up!

https://ossindex.sonatype.org/component/pkg:maven/com.fasterxml.jackson.core/[email protected]