Vulnerability · Published Sep 11, 2023 · Assigned by redhat
CVE-2022-1415Drools: unsafe data deserialization in streamutils
High 8.1
In plain English
A high-severity unsafe deserialization in Red Hat build of Apache Camel for Spring Boot from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)1.0%top 35.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.drools:drools-core | 7.69.0.Final | GHSA-m5q8-58wh-xxq4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | RHPAM 7.13.1 async | see references |
| Red Hat | Red Hat build of Apache Camel for Spring Boot | see references |
| Red Hat | Red Hat build of Quarkus | see references |
| Red Hat | Red Hat Decision Manager 7 | see references |
| Red Hat | Red Hat Integration Camel K | see references |
| Red Hat | Red Hat Integration Camel Quarkus | see references |
| Red Hat | Red Hat JBoss Data Grid 7 | see references |
| Red Hat | Red Hat JBoss Data Virtualization 6 | see references |
| Red Hat | Red Hat JBoss Enterprise Application Platform 6 | see references |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | see references |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | see references |
| Red Hat | Red Hat JBoss Fuse 6 | see references |
| Red Hat | Red Hat JBoss Fuse 7 | see references |
| Red Hat | Red Hat JBoss Fuse Service Works 6 | see references |
| Red Hat | Red Hat Process Automation 7 | see references |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- RHSA-2022:6813 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2022-1415 vdb-entry, x_refsource_REDHAT
- RHBZ#2065505 issue-tracking, x_refsource_REDHAT