Skip to content
OpenAdvisories
High · 8.1 CVE-2022-1415 EUVD-2023-2544GHSA-m5q8-58wh-xxq4

Drools: unsafe data deserialization in streamutils

Published Sep 11, 2023 · Updated Sep 25, 2024 · Assigned by redhat

Vendor: Red Hat Product: Red Hat build of Apache Camel for Spring Boot Product: Red Hat build of Quarkus Product: Red Hat Decision Manager 7 Product: Red Hat Integration Camel K Product: Red Hat Integration Camel Quarkus Product: Red Hat JBoss Data Grid 7 Product: Red Hat JBoss Data Virtualization 6 Product: Red Hat JBoss Enterprise Application Platform 6 Product: Red Hat JBoss Enterprise Application Platform 7 Product: Red Hat JBoss Enterprise Application Platform Expansion Pack Product: Red Hat JBoss Fuse 6 Product: Red Hat JBoss Fuse 7 Product: Red Hat JBoss Fuse Service Works 6 Product: Red Hat Process Automation 7 Product: RHPAM 7.13.1 async Package: org.drools:drools-core Ecosystem: Maven

Description

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

Affected products

VendorProductAffectedFixed
Red Hat RHPAM 7.13.1 async — —
Red Hat Red Hat build of Apache Camel for Spring Boot — —
Red Hat Red Hat build of Quarkus — —
Red Hat Red Hat Decision Manager 7 — —
Red Hat Red Hat Integration Camel K — —
Red Hat Red Hat Integration Camel Quarkus — —
Red Hat Red Hat JBoss Data Grid 7 — —
Red Hat Red Hat JBoss Data Virtualization 6 — —
Red Hat Red Hat JBoss Enterprise Application Platform 6 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack — —
Red Hat Red Hat JBoss Fuse 6 — —
Red Hat Red Hat JBoss Fuse 7 — —
Red Hat Red Hat JBoss Fuse Service Works 6 — —
Red Hat Red Hat Process Automation 7 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Manager Server Module 4.3 cobbler 3.3.3-150400.5.17.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 drools 7.17.0-150400.3.9.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 grafana-formula 0.8.0-150400.3.6.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 image-sync-formula 0.1.1673279145.e7616bd-150400.3.9.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 inter-server-sync 0.2.6-150400.3.12.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 mgr-osad 4.3.7-150400.3.3.4 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 mgr-push 4.3.5-150400.3.3.5 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 rhnlib 4.3.5-150400.3.3.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 saltboot-formula 0.1.1673279145.e7616bd-150400.3.6.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 spacecmd 4.3.18-150400.3.12.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 spacewalk-backend 4.3.18-150400.3.12.5 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 spacewalk-certs-tools 4.3.17-150400.3.12.4 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 spacewalk-client-tools 4.3.14-150400.3.12.5 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 spacewalk-java 4.3.46-150400.3.28.1 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 spacewalk-search 4.3.8-150400.3.9.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 spacewalk-utils 4.3.16-150400.3.12.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 spacewalk-web 4.3.27-150400.3.12.5 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 supportutils-plugin-susemanager 4.3.6-150400.3.6.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 susemanager 4.3.23-150400.3.16.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 susemanager-build-keys 15.4.7-150400.3.12.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 susemanager-docs_en 4.3-150400.9.19.1 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 susemanager-schema 4.3.16-150400.3.12.4 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 susemanager-sls 4.3.29-150400.3.16.1 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 susemanager-sync-data 4.3.12-150400.3.11.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 susemanager-tftpsync 4.3.3-150400.3.6.5 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 uyuni-common-libs 4.3.7-150400.3.9.4 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 uyuni-setup-reportdb 4.3.6-150400.3.3.4 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.3 virtual-host-gatherer 1.0.24-150400.3.6.3 SUSE-SU-2023:0345-1
SUSE Manager Server Module 4.2 cobbler 3.1.2-150300.5.19.1 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 drools 7.17.0-150300.4.9.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 grafana-formula 0.8.1-150300.3.9.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 inter-server-sync 0.2.7-150300.8.28.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 mgr-osad 4.2.9-150300.2.12.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 prometheus-formula 0.7.0-150300.3.17.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 py27-compat-salt 3000.3-150300.7.7.29.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 rhnlib 4.2.7-150300.4.12.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 salt-netapi-client 0.21.0-150300.3.12.4 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 saltboot-formula 0.1.1676908681.e90e0b1-150300.3.15.1 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 smdba 1.7.11-0.150300.3.12.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 spacecmd 4.2.21-150300.4.33.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 spacewalk-admin 4.2.13-150300.3.18.1 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 spacewalk-backend 4.2.26-150300.4.35.6 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 spacewalk-certs-tools 4.2.19-150300.3.27.4 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 spacewalk-client-tools 4.2.22-150300.4.30.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 spacewalk-java 4.2.47-150300.3.58.1 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 spacewalk-search 4.2.9-150300.3.15.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 spacewalk-web 4.2.32-150300.3.36.4 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 supportutils-plugin-susemanager 4.2.5-150300.3.9.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 susemanager 4.2.40-150300.3.49.1 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 susemanager-build-keys 15.3.6-150300.3.6.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 susemanager-doc-indexes 4.2-150300.12.39.4 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 susemanager-docs_en 4.2-150300.12.39.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 susemanager-schema 4.2.27-150300.3.35.1 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 susemanager-sls 4.2.31-150300.3.43.1 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 uyuni-common-libs 4.2.9-150300.3.14.1 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 virtual-host-gatherer 1.0.24-150300.3.9.2 SUSE-SU-2023:0592-1
SUSE Manager Server Module 4.2 woodstox 4.4.2-150300.3.6.2 SUSE-SU-2023:0592-1
SUSE Manager Server 4.3 release-notes-susemanager 4.3.4-150400.3.43.1 SUSE-SU-2023:0373-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Manager Proxy Module 4.2 mgr-osad 4.2.9-150300.2.12.2 SUSE-SU-2023:0592-1
SUSE Manager Proxy Module 4.2 rhnlib 4.2.7-150300.4.12.2 SUSE-SU-2023:0592-1
SUSE Manager Proxy Module 4.2 spacecmd 4.2.21-150300.4.33.2 SUSE-SU-2023:0592-1
SUSE Manager Proxy Module 4.2 spacewalk-backend 4.2.26-150300.4.35.6 SUSE-SU-2023:0592-1
SUSE Manager Proxy Module 4.2 spacewalk-certs-tools 4.2.19-150300.3.27.4 SUSE-SU-2023:0592-1
SUSE Manager Proxy Module 4.2 spacewalk-client-tools 4.2.22-150300.4.30.2 SUSE-SU-2023:0592-1
SUSE Manager Proxy Module 4.2 spacewalk-proxy 4.2.13-150300.3.24.2 SUSE-SU-2023:0592-1
SUSE Manager Proxy Module 4.2 spacewalk-proxy-installer 4.2.11-150300.3.14.2 SUSE-SU-2023:0592-1
SUSE Manager Proxy Module 4.2 spacewalk-web 4.2.32-150300.3.36.4 SUSE-SU-2023:0592-1
SUSE Manager Proxy Module 4.2 susemanager-build-keys 15.3.6-150300.3.6.2 SUSE-SU-2023:0592-1
SUSE Manager Proxy Module 4.2 uyuni-common-libs 4.2.9-150300.3.14.1 SUSE-SU-2023:0592-1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.drools:drools-core < 7.69.0.Final 7.69.0.Final GHSA-m5q8-58wh-xxq4

Advisories 3

References