Jackson-databind: Block one more gadget type (ehcache, CVE-2019-17267)

[lufeirider]

Another gadget (*) type report regarding a class of ehcache package (follow up for #2387)

Mitre id: CVE-2019-17267
Reporter: lufeirider

Fix included in:

• 2.9.10
• 2.8.11.5
• does not affect 2.10.0 and later

---

(*) See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for more on general problem type

[cowtowncoder]

Thank you -- email received, will track progress with this issue. Will update description and title appropriately with more information.

[abergmann]

CVE-2019-17267 was assigned to this issue.

[cowtowncoder]

@abergmann thanks!