Those 6 vulnerabilities occur in a very specific situation (all of those must be true):

1. JSON content is sent by an untrusted client

2. Must have one of those libraries in classpath: Logback, HikariCP, commons-dbcp, P6Spy

3. Default typing must be enabled with enableDefaultTyping (very insecure, if your program has this, it's insecure even after this patch)

4. There must be a property with permissive type (such as Object, Serializable, Comparable, Cloneable, and so on)