FasterXML jackson-databind 2.x before 22.214.171.124 lacks certain net.sf.ehcache blocking.
fedora seems to be not affected by this, as we have jackson-databind 2.10.1 in fedora 30, 31, and rawhide:
While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.
Red Hat Mobile Application Platform is now End of Life: