CVE-2016-4607

Red Hat statement

Initial assessment incorrectly noted RHEL8 as being affected, due to the lack of detail in all available reports, including upstream. Apple’s advisory provided no usable or meaningful information. Further investigation determined that upstream corrected this in version 1.1.29, via one of a number of security-relevant commits that did not disclose CVE names. RHEL 8.0 shipped with libxslt 1.1.32, which included all of these patches. The CVE page has been updated to reflect that RHEL 8 is in fact not affected. Red Hat OpenStack will consume fixes from the base Red Hat Enterprise Linux Operating System. Therefore the package provided by Red Hat OpenStack has been marked as will not fix. Red Hat Product Security could not determine whether Red Hat Enterprise Linux is affected by this flaw due to lack of information on the flaw. Therefore this issue is being marked as won't fix.