--- Comment #19 from Cedric Buissart 🐶 <cbuissar(a)redhat.com> ---
OpenShift Container Platform ships a vulnerable netty library as part of the
logging-elasticsearch5 container. ElasticSearch's security team has stated that
the previous vulnerability, CVE-2019-16869, does not pose a substantial
practical threat to ElasticSearch 6. We agree that these issues would be
difficult to exploit on OpenShift Container Platform so we're reducing the
impact of this issue to moderate and may fix it in the future release.
Red Hat Satellite ships a vulnerable version of netty embedded in Candlepin.
However, the flaw can not be triggered in that context, because HTTP requests
are handled by Tomcat, not by netty. A future release may fix this.
You are receiving this mail because:
You are on the CC list for the bug.