https://bugzilla.redhat.com/show_bug.cgi?id=1913934
--- Comment #9 from RaTasha Tillery-Smith <rtillery(a)redhat.com> ---
Statement:
The following Red Hat products do ship the vulnerable component, but do not
enable the unsafe conditions needed to exploit, lowering their vulnerability
impact:
* JBoss Data Grid 7
* Business Process Management Suite 6
* Business Rules Management Suite 6
* JBoss Data Virtualization 6
* Red Hat Fuse Service Works 6
* Red Hat OpenStack Platform
* Red Hat OpenShift containers: ose-metering-hadoop, ose-metering-hive,
ose-logging-elasticsearch5, ose-logging-elasticsearch6
These products may update the jackson-databind dependency in a future release.
In Red Hat Openshift 4 there are no plans to maintain the
ose-logging-elasticsearch5 container, hence it has been marked wontfix at this
time and maybe fixed in a future update.
The following Red Hat products ship OpenDaylight, which contains the vulnerable
jackson-databind, but they do not expose jackson-databind in a way that would
make it exploitable:
* Red Hat OpenStack Platform 13
As such, Red Hat will not be providing a fix for OpenDaylight at this time.
The following Red Hat products are not affected by this flaw because they use a
more recent version of jackson-databind that does not contain the vulnerable
code:
* CodeReady Studio 12.16.0
* Red Hat Enterprise Linux 8
* Red Hat Enterprise Virtualization
* Red Hat Satellite 6
* Red Hat OpenShift container: ose-metering-presto
--
You are receiving this mail because:
You are on the CC list for the bug.