8.1
High
CVE-2022-1415 A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data
Description
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RHPAM 7.13.1 async | Versions not published | |
| Red Hat build of Apache Camel for Spring Boot | Versions not published | |
| Red Hat build of Quarkus | Versions not published | |
| Red Hat Decision Manager 7 | Versions not published | |
| Red Hat Integration Camel K | Versions not published | |
| Red Hat Integration Camel Quarkus | Versions not published | |
| Red Hat JBoss Data Grid 7 | Versions not published | |
| Red Hat JBoss Data Virtualization 6 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 6 | Versions not published |
Show the 6 other branches Hide the 6 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat JBoss Fuse 6 | Versions not published | |
| Red Hat JBoss Fuse 7 | Versions not published | |
| Red Hat JBoss Fuse Service Works 6 | Versions not published | |
| Red Hat Process Automation 7 | Versions not published |
References
- RHSA-2022:6813 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2065505 bugzilla.redhat.com
Timeline
- Published
- Last modified