jackson-databind (2.4.2-3ubuntu0.1~esm2) xenial-security; urgency=medium

  * SECURITY UPDATE: Deserialization flaws.
    - debian/patches/CVE-2018-11307.patch: add iBatis to blocklist.
    - debian/patches/CVE-2018-12022.patch: add some jdbc gadgets to
      blocklist.
    - debian/patches/CVE-2018-14718.patch: add some 3rd party JDK-bundled
      gadgets to blocklist.
    - debian/patches/CVE-2018-19360.patch: add some more 3rd party gadgets to
      blocklist.
    - debian/patches/CVE-2019-12086.patch: add 3rd party gadget MiniAdmin to
      blocklist.
    - debian/patches/CVE-2019-12384.patch: add logback-core to blocklist.
    - debian/patches/CVE-2019-12814.patch: add jdom/jdom2 to blocklist.
    - debian/patches/More-Polymorhpic-Typing-issue-fixes.patch: add
      commons-configuration and xalan2 to blocklist.
    - debian/patches/CVE-2019-14379_CVE-2019-14439.patch: add EHCache and
      logback/jndi to blocklist.
    - debian/patches/CVE-2019-14540.patch: add HikariCP/metricRegistry
      config and CXF/JAX-RS provider/XSLT to blocklist.
    - debian/patches/CVE-2019-16335.patch: add HikariDataSource to
      blocklist.
    - debian/patches/CVE-2019-16942-and-CVE-2019-16943.patch: add
      commons-dbcp and p6spy to blocklist.
    - debian/patches/CVE-2019-17267-and-CVE-2019-17531.patch: add another
      EHCache gadget and log4j-extras to blocklist.
    - debian/patches/CVE-2019-20330.patch: add some more EHCache to
      blocklist.
    - debian/patches/CVE-2020-8840.patch: add xbean-reflect to blocklist.
    - debian/patches/CVE-2020-954{6-8}.patch: add hikari-config,
      ibatis-sqlmap and anteros-core to blocklist.
    - debian/patches/CVE-2020-1067{2-3}.patch: add aries jms and
      caucho-quercus to blocklist.
    - debian/patches/CVE-2020-10969.patch: add javax.swing to blocklist.
    - debian/patches/CVE-2020-1{0968,1111,1112}.patch: add aoju/bus-proxy,
      activemq-jms and apache/commons-jms to blocklist.
    - debian/patches/CVE-2020-11113.patch: add some more 3rd party
      gadgets to blocklist.
    - debian/patches/CVE-2020-11619.patch: add some springframework
      gadgets to blocklist.
    - debian/patches/CVE-2020-11620.patch: add commons-jelly to gadgets
      blocklist.
    - debian/patches/CVE-2020-14{060,061,062,195}.patch: add some more
      gadgets to blocklist.
    - CVE-2018-11307
    - CVE-2018-12022
    - CVE-2018-12023
    - CVE-2018-14718
    - CVE-2018-14719
    - CVE-2018-14720
    - CVE-2018-14721
    - CVE-2018-19360
    - CVE-2018-19361
    - CVE-2018-19362
    - CVE-2019-12086
    - CVE-2019-12384
    - CVE-2019-12814
    - CVE-2019-14379
    - CVE-2019-14439
    - CVE-2019-14540
    - CVE-2019-16335
    - CVE-2019-16942
    - CVE-2019-16943
    - CVE-2019-17267
    - CVE-2019-17531
    - CVE-2019-20330
    - CVE-2020-8840
    - CVE-2020-9546
    - CVE-2020-9547
    - CVE-2020-9548
    - CVE-2020-10672
    - CVE-2020-10673
    - CVE-2020-10969
    - CVE-2020-10968
    - CVE-2020-11111
    - CVE-2020-11112
    - CVE-2020-11113
    - CVE-2020-11619
    - CVE-2020-11620
    - CVE-2020-14060
    - CVE-2020-14061
    - CVE-2020-14062
    - CVE-2020-14195

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Tue, 22 Sep 2020 18:42:06 -0300

jackson-databind (2.4.2-3ubuntu0.1~esm1) xenial-security; urgency=medium

  * SECURITY UPDATE: Code execution in readValue()
    - debian/patches/CVE-2017-7525.patch: Create blacklist of class types and 
      add check for such illegal types.
    - debian/patches/CVE-2017-15095-1.patch: Extend blacklist of class types.
    - debian/patches/CVE-2017-15095-2.patch: Extend blacklist of class types.
    - debian/patches/CVE-2017-15095-3.patch: Extend blacklist of class types
      and improve IllegalTypesCheckTest.
    - debian/patches/CVE-2017-17485-1.patch: Extend blacklist of class types
      and fix IllegalTypesCheckTest.
    - debian/patches/CVE-2017-17485-2.patch: Move blacklist and check for
      illegal types to its own class.
    - debian/patches/CVE-2017-17485-3.patch: Fix errors on previous patch.
    - debian/patches/CVE-2017-17485-4.patch: Fix regression from previous
      patch.
    - debian/patches/CVE-2018-5968.patch: Add some more class types to
      blacklist.
    - debian/patches/CVE-2018-7489.patch: Extend blacklist types and improve
      IllegalTypesCheckTest.
    - CVE-2017-7525
    - CVE-2017-15095
    - CVE-2017-17485
    - CVE-2018-5968
    - CVE-2018-7489

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Mon, 27 Jan 2020 16:34:11 -0300

jackson-databind (2.4.2-3) unstable; urgency=medium

  * Team upload.
  * Transition to Groovy 2

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 20 Nov 2015 13:06:01 +0100

jackson-databind (2.4.2-2) unstable; urgency=medium

  * Team upload.
  * Build depend on libcglib3-java instead of libcglib-java
  * Standards-Version updated to 3.9.6 (no changes)
  * Removed the build dependency on libmaven-cobertura-plugin-java

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 29 Sep 2014 16:30:49 +0200

jackson-databind (2.4.2-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.
  * ignoreRules: Ignore replacer.
  * ignoreRules: Ignore release plugin.
  * control: Add libmaven-bundle-plugin to build-deps.
  * fix-using-bundle.diff: Use extensions with bundle plugin.
  * maven.{publishedR,r}ules: Fix version mangling.
  * control: Bump dependency on -core and -annotations.
  * properties: Set encoding to UTF-8.
  * control: Add libmaven-cobertura-plugin-java to build-depends.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 24 Sep 2014 17:14:02 +0300

jackson-databind (2.2.2-2) unstable; urgency=low

  * Team upload.
  * Update Maven settings to use correct coordinates for Groovy 1.8.x.
    (Closes: #750267).
  * Bump Standards-Version to 3.9.5. No changes were required.

 -- Miguel Landaeta <nomadium@debian.org>  Mon, 26 May 2014 14:53:06 -0300

jackson-databind (2.2.2-1) unstable; urgency=low

  * Initial release. (Closes: #720504)

 -- Wolodja Wentland <debian@babilen5.org>  Thu, 22 Aug 2013 15:24:34 +0000
