https://bugzilla.redhat.com/show_bug.cgi?id=1815470
--- Comment #5 from Jason Shepherd <jshepherd(a)redhat.com> ---
Statement:
Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable
jackson-databind. However, OpenDaylight does not expose jackson-databind in a
way that would make it vulnerable, lowering the impact of the vulnerability for
OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at
this time. Additionally, the gadget is not available within Red Hat Openstack
Platform's OpenDaylight.
While OpenShift Container Platform's elasticsearch plugins do ship the
vulnerable component, it doesn't do any of the unsafe things described in
https://access.redhat.com/solutions/3279231. We may update the jackson-databind
dependency in a future release.
--
You are receiving this mail because:
You are on the CC list for the bug.