More information about this security flaw is available in the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=2297636 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Without publicly available details of the CVE it's hard to judge if the bundled libtiff 3.0 is affected. First of all it's pretty hard to get to that information at all. A link in the title of this bug report leading to a Red Hat landing page, which lists only affected RHEL releases, is not very helpful. The two external reference links don't lead to any further information: 1. This ID has been reserved by a CNA 2. CVE ID Not Found Unless details become available, I will close this as WONTFIX.
Closing this tracker as NOTABUG as this CVE has been rejected by upstream.