https://bugzilla.redhat.com/show_bug.cgi?id=1378613
--- Comment #7 from Jason Shepherd <jshepherd(a)redhat.com> ---
I don't think waiting 22 day is a problem for this issue. This issue is rated
as important because if a user is affected, a malicious user can cause a RCE by
remote HTTP request.
A couple of mitigating factors:
- The library needs to be deployed to a servlet engine, such as Tomcat
- The Java Runtime also needs to have a 'Gadget Chain' in it's classpath,
such
as Apache Commons Collections.
--
You are receiving this mail because:
You are on the CC list for the bug.