CVE-2022-1415 Drools: unsafe data deserialization in streamutils
An authenticated attacker can achieve remote code execution on the server by sending malicious serialized objects to Drools core utility classes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-1415?
CVE-2022-1415 is a high-severity unsafe deserialization vulnerability in Red Hat RHPAM 7.13.1 async, published on 11 Sep 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
Weakness: CWE-502
Which versions are affected by CVE-2022-1415?
2 open source packages ship an affected version, including org.drools:drools-core. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
org.drools:drools-core Maven | All versions | 7.69.0.Final |
org.drools:drools-core Maven | All versions | 7.69.0.Final |
Linux distribution packages (29)
release-notes-susemanager SUSE:Manager Server 4.3 | All versions | 4.3.4-150400.3.43.1 |
cobbler SUSE:Manager Server Module 4.3 | All versions | 3.3.3-150400.5.17.3 |
drools SUSE:Manager Server Module 4.3 | All versions | 7.17.0-150400.3.9.3 |
grafana-formula SUSE:Manager Server Module 4.3 | All versions | 0.8.0-150400.3.6.3 |
image-sync-formula SUSE:Manager Server Module 4.3 | All versions | 0.1.1673279145.e7616bd-150400.3.9.3 |
inter-server-sync SUSE:Manager Server Module 4.3 | All versions | 0.2.6-150400.3.12.3 |
mgr-osad SUSE:Manager Server Module 4.3 | All versions | 4.3.7-150400.3.3.4 |
mgr-push SUSE:Manager Server Module 4.3 | All versions | 4.3.5-150400.3.3.5 |
rhnlib SUSE:Manager Server Module 4.3 | All versions | 4.3.5-150400.3.3.3 |
saltboot-formula SUSE:Manager Server Module 4.3 | All versions | 0.1.1673279145.e7616bd-150400.3.6.3 |
spacecmd SUSE:Manager Server Module 4.3 | All versions | 4.3.18-150400.3.12.3 |
spacewalk-backend SUSE:Manager Server Module 4.3 | All versions | 4.3.18-150400.3.12.5 |
spacewalk-certs-tools SUSE:Manager Server Module 4.3 | All versions | 4.3.17-150400.3.12.4 |
spacewalk-client-tools SUSE:Manager Server Module 4.3 | All versions | 4.3.14-150400.3.12.5 |
spacewalk-java SUSE:Manager Server Module 4.3 | All versions | 4.3.46-150400.3.28.1 |
spacewalk-search SUSE:Manager Server Module 4.3 | All versions | 4.3.8-150400.3.9.3 |
spacewalk-utils SUSE:Manager Server Module 4.3 | All versions | 4.3.16-150400.3.12.3 |
spacewalk-web SUSE:Manager Server Module 4.3 | All versions | 4.3.27-150400.3.12.5 |
supportutils-plugin-susemanager SUSE:Manager Server Module 4.3 | All versions | 4.3.6-150400.3.6.3 |
susemanager SUSE:Manager Server Module 4.3 | All versions | 4.3.23-150400.3.16.3 |
susemanager-build-keys SUSE:Manager Server Module 4.3 | All versions | 15.4.7-150400.3.12.3 |
susemanager-docs_en SUSE:Manager Server Module 4.3 | All versions | 4.3-150400.9.19.1 |
susemanager-schema SUSE:Manager Server Module 4.3 | All versions | 4.3.16-150400.3.12.4 |
susemanager-sls SUSE:Manager Server Module 4.3 | All versions | 4.3.29-150400.3.16.1 |
susemanager-sync-data SUSE:Manager Server Module 4.3 | All versions | 4.3.12-150400.3.11.3 |
susemanager-tftpsync SUSE:Manager Server Module 4.3 | All versions | 4.3.3-150400.3.6.5 |
uyuni-common-libs SUSE:Manager Server Module 4.3 | All versions | 4.3.7-150400.3.9.4 |
uyuni-setup-reportdb SUSE:Manager Server Module 4.3 | All versions | 4.3.6-150400.3.3.4 |
virtual-host-gatherer SUSE:Manager Server Module 4.3 | All versions | 1.0.24-150400.3.6.3 |
Products include Redhat Decision Manager, Redhat Drools, Redhat Jboss Middleware Text-Only Advisories, Redhat Process Automation.
How do I fix CVE-2022-1415?
Upgrade org.drools:drools-core to 7.69.0.Final or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-1415 being exploited?
There is no known exploitation of CVE-2022-1415 in the wild and no public exploit code.
Other vulnerabilities in Red Hat RHPAM 7.13.1 async
Sources
Also known as GHSA-m5q8-58wh-xxq4, SUSE-SU-2023:0345-1, SUSE-SU-2023:0373-1.