Update information on CVE-2018-8035

Originally assigned to uimaj, but the CVE is assigned to UIMA DUCC a
subproject of Apache UIMA itself. DUCC is a Linuc cluster controller
esigned to scale out any UIMA pipeline, but it's not included in
src:uimaj source.

As such if triaging was correct here, this is actually a NFU.