https://bugzilla.redhat.com/show_bug.cgi?id=1879042
--- Comment #25 from Jonathan Christison jochrist@redhat.com --- Marking Red Hat Integration Service Registry as having a low impact, this is because although the vulnerable version of resteasy-client is shipped and used, its use in Service Registry is not susceptible to the vulnerability, this is because its use in the maven plugin it does not communicate with further upstream/backend services from a service context, that is to say the Service Registry service itself does not use the resteasy-client to call onto other services, this is a precondition of the vulnerability.
java-sig-commits@lists.fedoraproject.org