Skip to content
OpenAdvisories
Critical · 9.8 CVE-2021-41411 EUVD-2022-6146GHSA-rc57-9r3x-98cq

XML External Entity Reference in drools

Published Jun 16, 2022 · Updated Aug 4, 2024 · Assigned by mitre

Package: org.drools:drools-core Ecosystem: Maven

Description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Manager Server Module 4.3 cobbler 3.3.3-150400.5.7.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 drools 7.17.0-150400.3.6.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 image-sync-formula 0.1.1661440542.6cbe0da-150400.3.6.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 inter-server-sync 0.2.3-150400.3.6.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 locale-formula 0.3-150400.3.3.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 python-magic 5.32-150000.7.16.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 python-schema 0.6.7-150400.10.3.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 python-urlgrabber 4.1.0-150400.3.6.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 reprepro 5.4.0-150400.3.6.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 saltboot-formula 0.1.1661440542.6cbe0da-150400.3.3.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 spacecmd 4.3.15-150400.3.6.4 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 spacewalk-admin 4.3.10-150400.3.3.2 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 spacewalk-backend 4.3.16-150400.3.6.8 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 spacewalk-certs-tools 4.3.15-150400.3.6.2 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 spacewalk-client-tools 4.3.12-150400.3.6.6 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 spacewalk-java 4.3.38-150400.3.8.3 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 spacewalk-search 4.3.7-150400.3.6.2 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 spacewalk-setup 4.3.12-150400.3.8.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 spacewalk-utils 4.3.14-150400.3.6.3 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 spacewalk-web 4.3.24-150400.3.6.4 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 subscription-matcher 0.29-150400.3.7.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 susemanager 4.3.19-150400.3.6.4 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 susemanager-build-keys 15.4.3-150400.3.6.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 susemanager-docs_en 4.3-150400.9.6.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 susemanager-schema 4.3.14-150400.3.6.5 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 susemanager-sls 4.3.25-150400.3.6.4 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 susemanager-sync-data 4.3.9-150400.3.3.1 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 susemanager-tftpsync 4.3.2-150400.3.3.4 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 uyuni-common-libs 4.3.6-150400.3.6.4 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.3 uyuni-reportdb-schema 4.3.6-150400.3.3.6 SUSE-SU-2022:3750-1
SUSE Manager Server Module 4.2 drools 7.17.0-150300.4.6.2 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 httpcomponents-asyncclient 4.1.4-150300.3.3.2 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 image-sync-formula 0.1.1661440526.b08d95b-150300.3.3.2 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 inter-server-sync 0.2.3-150300.8.22.2 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 patterns-suse-manager 4.2-150300.4.12.2 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 py27-compat-salt 3000.3-150300.7.7.23.2 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 salt-netapi-client 0.20.0-150300.3.9.4 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 saltboot-formula 0.1.1661440526.b08d95b-150300.3.12.2 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 spacecmd 4.2.19-150300.4.27.2 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 spacewalk-admin 4.2.12-150300.3.15.3 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 spacewalk-backend 4.2.24-150300.4.29.5 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 spacewalk-certs-tools 4.2.18-150300.3.24.3 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 spacewalk-client-tools 4.2.20-150300.4.24.3 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 spacewalk-java 4.2.41-150300.3.43.5 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 spacewalk-search 4.2.8-150300.3.12.2 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 spacewalk-web 4.2.29-150300.3.27.3 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 subscription-matcher 0.29-150300.6.12.2 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 susemanager 4.2.37-150300.3.41.1 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 susemanager-doc-indexes 4.2-150300.12.33.4 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 susemanager-docs_en 4.2-150300.12.33.2 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 susemanager-schema 4.2.24-150300.3.27.3 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 susemanager-sls 4.2.27-150300.3.33.4 SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2 uyuni-common-libs 4.2.7-150300.3.9.2 SUSE-SU-2022:3314-1
SUSE Manager Server 4.3 release-notes-susemanager 4.3.2-150400.3.15.1 SUSE-SU-2022:3761-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Manager Server 4.2 release-notes-susemanager 4.2.9-150300.3.54.1 SUSE-SU-2022:3313-1
SUSE Manager Retail Branch Server 4.3 release-notes-susemanager-proxy 4.3.2-150400.3.9.3 SUSE-SU-2022:3761-1
SUSE Manager Retail Branch Server 4.2 release-notes-susemanager-proxy 4.2.9-150300.3.43.1 SUSE-SU-2022:3313-1
SUSE Manager Proxy Module 4.3 mgr-daemon +1 4.3.6-150400.3.6.4 SUSE-SU-2022:3750-1
SUSE Manager Proxy Module 4.3 spacecmd 4.3.15-150400.3.6.4 SUSE-SU-2022:3750-1
SUSE Manager Proxy Module 4.3 spacewalk-backend 4.3.16-150400.3.6.8 SUSE-SU-2022:3750-1
SUSE Manager Proxy Module 4.3 spacewalk-certs-tools 4.3.15-150400.3.6.2 SUSE-SU-2022:3750-1
SUSE Manager Proxy Module 4.3 spacewalk-client-tools 4.3.12-150400.3.6.6 SUSE-SU-2022:3750-1
SUSE Manager Proxy Module 4.3 spacewalk-web 4.3.24-150400.3.6.4 SUSE-SU-2022:3750-1
SUSE Manager Proxy Module 4.3 susemanager-build-keys 15.4.3-150400.3.6.1 SUSE-SU-2022:3750-1
SUSE Manager Proxy Module 4.3 susemanager-tftpsync-recv 4.3.7-150400.3.3.3 SUSE-SU-2022:3750-1
SUSE Manager Proxy Module 4.2 mgr-daemon 4.2.10-150300.2.9.4 SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2 patterns-suse-manager 4.2-150300.4.12.2 SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2 spacecmd 4.2.19-150300.4.27.2 SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2 spacewalk-backend 4.2.24-150300.4.29.5 SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2 spacewalk-certs-tools 4.2.18-150300.3.24.3 SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2 spacewalk-client-tools 4.2.20-150300.4.24.3 SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2 spacewalk-proxy 4.2.12-150300.3.21.3 SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2 spacewalk-web 4.2.29-150300.3.27.3 SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2 susemanager-tftpsync-recv 4.2.5-150300.3.6.2 SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2 uyuni-common-libs 4.2.7-150300.3.9.2 SUSE-SU-2022:3314-1
SUSE Manager Proxy 4.3 release-notes-susemanager-proxy 4.3.2-150400.3.9.3 SUSE-SU-2022:3761-1
SUSE Manager Proxy 4.2 release-notes-susemanager-proxy 4.2.9-150300.3.43.1 SUSE-SU-2022:3313-1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.drools:drools-core < 7.60.0.Final 7.60.0.Final GHSA-rc57-9r3x-98cq

Advisories 6

References