https://bugzilla.redhat.com/show_bug.cgi?id=2030932
--- Comment #67 from Stoyan Nikolov snikolov@redhat.com --- Red Hat Virtualization ships rhvm-appliance which includes a vulnerable version of log4j released by Red Hat EAP. Once EAP releases a fixed version of the package Red Hat Virtualization users can consume the fix with a regular update via the package manager inside the rhvm-appliance.
java-sig-commits@lists.fedoraproject.org