https://bugzilla.redhat.com/show_bug.cgi?id=1709860
--- Comment #4 from Doran Moppert <dmoppert(a)redhat.com> ---
Statement:
Red Hat Satellite 6 is not vulnerable to this issue, because the candlepin
component who uses the c3p0 jar never passes a XML configuration file to c3p0,
even though it includes a vulnerable version of the latter. Since this issue
requires a XML files to be loaded by c3p0, an exploitation path doesn't exist.
--
You are receiving this mail because:
You are on the CC list for the bug.