https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #12 from Stefan Cornelius <scorneli(a)redhat.com> ---
Statement:
While OpenShift Container Platform's elasticsearch plugins do ship the
vulnerable component, it doesn't do any of the unsafe things described in
https://access.redhat.com/solutions/3279231. We may update the jackson-databind
dependency in a future release.
Similarly, Satellite 6 does not enable polymorphic unmarshmalling, which is a
required configuration for the vulnerability to be used. We may update the
jackson-databind dependency in a future release.
This issue affects the versions of jackson-databind as shipped with Red Hat
Enterprise Linux 8.
This issue affects the versions of rh-maven35-jackson-databind as shipped with
Red Hat Software Collections.
--
You are receiving this mail because:
You are on the CC list for the bug.