Red Hat Security Advisory 2017-1840-01 - The jackson-databind package provides general data-binding functionality for Jackson, which works on top of Jackson core streaming API. Security Fix: A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
ddd84e1c28044f497afd84cb2e121261164c88de9c73f5305489781ccea648d2