title: Small fix for CVE-2016-3720 with older versions of jackson-all-1.9.11, and in jackson 2.x which is not patched
body: <p>The explanation of CVE-2016-3720  <a href="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3720" rel="nofollow">https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3720</a>  is vague, but reading the code I found the following issues.  Even after fixing the issues, the OWasp Dependency Check Tool still reports the jar file as vulnerable to the attack.  I think it has a false positive after the fix has been applied.</p>
  
  <p>CVE-2016-3720 exposes an XML Entity injection attack in the Jackson Library.
   <a href="https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing" rel="nofollow">https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing</a> 
  An XML Entity injection attack can create an infinite loop in the parsing of an XML file.<br>
  Which will ultimate eat up all the memory in an Application Server,
  or it can inject a reference to an external site (this is the issue reported).</p>
  
  <p>Unfortunately the source code for the older version of Jackson is 
  not available on Github, the project source versions only go back to the 
  jackson-databind-2.0.0-RC1 level.</p>
  
  <p>If you are using an older version of Spring, then you may not 
  be able to upgrade to the newest version of Jackson 2.x, 
  so now you have a security dilemma.  How to fix the vulnerability, 
  without upgrading Spring.</p>