https://bugzilla.redhat.com/show_bug.cgi?id=1758167
--- Comment #36 from Jason Shepherd <jshepherd(a)redhat.com> ---
Statement:
Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable
jackson-databind. However, OpenDaylight does not expose jackson-databind in a
way that would make it vulnerable, lowering the impact of the vulnerability for
OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at
this time.
Red Hat OpenShift Container Platform does ship the vulnerable component, but
does not enable the unsafe conditions needed to exploit, lowering their
vulnerability impact.
--
You are receiving this mail because:
You are on the CC list for the bug.