Turns out the ES REST Sniffer doesn't use jackson-databind, only jackson-core, which is unaffected by the CVEs. Closing.