https://bugzilla.redhat.com/show_bug.cgi?id=1848962
--- Comment #12 from Anten Skrabec <askrabec(a)redhat.com> ---
Statement:
While OpenShift Container Platform's elasticsearch plugins do ship the
vulnerable component, it doesn't do any of the unsafe things described in
https://access.redhat.com/solutions/3279231. We may update the jackson-databind
dependency in a future release. \n Red Hat OpenStack Platform ships
OpenDaylight, which contains the vulnerable jackson-databind. However,
OpenDaylight does not expose jackson-databind in a way that would make it
vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such,
Red Hat will not be providing a fix for OpenDaylight at this time.
--
You are receiving this mail because:
You are on the CC list for the bug.