Jackson Release 2.6.7.x

After last full version of 2.6, 2.6.7, was released branch was closed. However, following micro-patches have been released since.

Databind, 2.6.7.1 (11-Jul-2017)

An important security fix (see 1599 below) was backported into 2.6.x branch, resulting in patch version with following fixes:

#1383: Problem with @JsonCreator with 1-arg factory-method, implicit param names
#1599: Backport the extra safety checks for polymorphic deserialization

As per earlier cases, CVE-related backport(s):

Backported all CVE fixes up to 2.9.10

#1680: Block more JDK gadget types (com.sun.rowset)
#1855: Block more serialization gadgets (dbcp/tomcat, spring / CVE-2017-17485]
#1899: Another two gadgets to exploit default typing issue in jackson-databind (CVE-2018-5968)
#2032: Block one more gadget type (mybatis, CVE-2018-11307)
#2052: Block one more gadget type (jodd-db, CVE-2018-12022)
#2058: Block one more gadget type (oracle-jdbc, CVE-2018-12023)
#2097
#2186
#2326
#2334
#2341
#2387
#2389
#2410
#2420
#2449
#2462
#2478
#2498