https://bugzilla.redhat.com/show_bug.cgi?id=1904221
--- Comment #14 from Todd Cullum <tcullum(a)redhat.com> ---
Statement:
Red Hat Enterprise Linux 8's Identity Management and Certificate System are
using a vulnerable version of Tomcat that is bundled into the
pki-servlet-engine component. However, HTTP/2 is not enabled in such a
configuration, and it is not possible to trigger the flaw in a supported setup.
A future update may fix the code.
Red Hat Enterprise Linux 7's tomcat package, Identity Management, and
Certificate System are all not affected by this flaw because HTTP/2 is not
supported in the shipped version of tomcat in those packages.
tomcat5 and tomcat6 in Red Hat Enterprise Linux 5 and 6 (respectively) are not
affected by this flaw because HTTP/2 is not supported in the shipped versions
of those packages.
--
You are receiving this mail because:
You are on the CC list for the bug.