https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Comment #19 from Todd Cullum <tcullum(a)redhat.com> ---
Statement:
The following Red Hat Products ship jackson-databind version 2.10.0 or later
which is not considered affected by this CVE (see
https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0...)
* JBoss Data Grid 7
* JBoss Data Grid 8
* Enterprise Application Platform 7
* Red Hat Decision Manager 7
* Red Hat Process Automation Manager 7
* Red Hat Single Sign-On (RH-SSO) 7
* Red Hat JBoss Fuse 7
* Red Hat JBoss A-MQ
* Red Hat Enterprise Linux 8
* Red Hat Satellite 6.6
* Red Hat Satellite 6.7
* Red Hat Satellite 6.8
* Red Hat CodeReady Studio 12.17.0
Red Hat OpenStack Platform does ship the vulnerable component, but does not
enable the unsafe conditions needed to exploit, lowering the vulnerability
impact.
Red Hat OpenStack Platform 13 ships OpenDaylight, which contains the vulnerable
jackson-databind, but does not expose jackson-databind in a way that would make
it exploitable. As such, Red Hat will not be providing a fix for OpenDaylight
at this time.
--
You are receiving this mail because:
You are on the CC list for the bug.