/usr/lib64/libgdal.so.20.3.2 in gdal-libs-2.2.3-11.fc28.x86_64 and /usr/lib/java/gdal/libgdalconstjni.so (and other DSOs) in gdal-java-2.2.3-11.fc28.x86_64 are not linked with the standard Fedora linker flags (LDFLAGS) from redhat-rpm-config. It seems that -specs=/usr/lib/rpm/redhat/redhat-hardened-ld was dropped from the linker command line. See https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md for information on RPM macros and environment variables provided by the build environment.
The gdal-2.2.3-12.fc28 rebuild fixed this issue, due to the redhat-rpm-config workaround in bug 1548397.