https://bugzilla.redhat.com/show_bug.cgi?id=1848960
--- Comment #14 from Riccardo Schirone <rschiron(a)redhat.com> ---
Statement:
While OpenShift Container Platform's elasticsearch plugins do ship the
vulnerable component, it doesn't do any of the unsafe things described in
https://access.redhat.com/solutions/3279231. We may update the jackson-databind
dependency in a future release.
Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable
jackson-databind. However, OpenDaylight does not expose jackson-databind in a
way that would make it vulnerable, lowering the impact of the vulnerability for
OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at
this time.
The PKI module as shipped in Red Hat Enterprise Linux 8 does not enable
polymorphic deserialization which is a required configuration for the
vulnerability to be used, lowering the impact of the vulnerability for the
Product. We may update the jackson-databind dependency in a future release.
The version of jackson-databind as shipped in Red Hat Software Collections
rh-maven35 is used only while building maven, thus it does not deserialize data
coming from untrusted sources, lowering the impact of the vulnerability for the
Product.
--
You are receiving this mail because:
You are on the CC list for the bug.