Merge branch '2.8' into 2.9

Author: cowtowncoder

release-notes/VERSION-2.x

@@ -334,6 +334,11 @@ Project: jackson-databind
   `MapperFeature.ALLOW_COERCION_OF_SCALARS`
  (requested by magdel@github)
 
+2.8.11.3 (23-Nov-2018)
+
+#2326: Block class for CVE-2019-12086
+ (contributed by MaximilianTews@github)
+
 2.8.11.2 (08-Jun-2018)
 
 #1941: `TypeFactory.constructFromCanonical()` throws NPE for Unparameterized
@@ -569,10 +574,16 @@ Project: jackson-databind
 #1277: Add caching of resolved generic types for `TypeFactory`
  (requested by Andriy P)
 
-2.7.10 (not yet released)
+2.7.9.5 (23-Nov-2018)
 
-#1628: Don't print to error stream about failure to load JDK 7 types
- (reported by Villane@github)
+#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
+  - CVE-2018-14721)
+ (reported by Guixiong Wu)
+#2109: Canonical string for reference type is built incorrectly
+ (reported by svarzee@github)
+#2186: Block more classes from polymorphic deserialization (CVE-2018-19360,
+  CVE-2018-19361, CVE-2018-19362)
+ (reported by Guixiong Wu)
 
 2.7.9 (04-Feb-2017)