[Bug 1887664] CVE-2020-25649 jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1887664
--- Comment #23 from Summer Long <slong(a)redhat.com> ---
Statement:
* Red Hat Enterprise Linux 8 ships a vulnerable version of jackson-databind in
the pki-deps:10.6 module. pki-deps:10.6 is for pki-core dependencies, but
pki-core does not use the vulnerable DOMDeserializer class and thus has been
set to low impact. Future updates may include fixed version of
jackson-databind.
* Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable
jackson-databind code. However, OpenDaylight does not expose jackson-databind
in a way that would make it vulnerable, lowering the impact of the
vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix
for OpenDaylight at this time.
* Red Hat Virtualization ships a vulnerable version of jackson-databind,
however the vulnerable DOMDeserializer class is not used in the code, therefore
reducing impact to low.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 6 months