https://bugzilla.redhat.com/show_bug.cgi?id=1887664
--- Comment #12 from Stoyan Nikolov snikolov@redhat.com --- Statement:
Red Hat Virtualization ships vulnerable version of jackson-databind, however the vulnerable DOMDeserializer class is not used in the code, therefore reducing impact to low. Future updates may include fixed version of jackson-databind.