Deserialization of Untrusted Data in Drools - CVE-2022-1415

Vulnerability identifier: #VU72126

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1415

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote user can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Drools
SUSE Manager Proxy
SUSE Manager Proxy Module
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Server Module
SUSE Linux Enterprise Module for SUSE Manager Server
saltboot-formula
image-sync-formula
inter-server-sync-debuginfo
inter-server-sync
prometheus-formula
grafana-formula
salt-netapi-client
virtual-host-gatherer-Kubernetes
virtual-host-gatherer-libcloud
virtual-host-gatherer
virtual-host-gatherer-Nutanix
virtual-host-gatherer-VMware
smdba
cobbler
supportutils-plugin-susemanager
python3-rhnlib
python3-mgr-osad
python3-mgr-osa-common
mgr-osa-dispatcher
python3-mgr-osa-dispatcher
mgr-osad
python3-uyuni-common-libs
spacewalk-search
spacewalk-proxy-installer
spacewalk-admin
spacewalk-proxy-redirect
spacewalk-proxy-salt
spacewalk-proxy-broker
spacewalk-proxy-management
spacewalk-proxy-common
spacewalk-proxy-package-manager
python3-spacewalk-certs-tools
spacewalk-certs-tools
spacecmd
spacewalk-check
python3-spacewalk-client-tools
spacewalk-client-tools
python3-spacewalk-client-setup
spacewalk-client-setup
python3-spacewalk-check
spacewalk-backend-config-files-tool
spacewalk-backend-tools
spacewalk-backend
spacewalk-backend-config-files-common
spacewalk-backend-server
spacewalk-backend-iss
spacewalk-backend-xmlrpc
spacewalk-backend-sql-postgresql
spacewalk-backend-iss-export
spacewalk-backend-sql
spacewalk-backend-xml-export-libs
spacewalk-backend-config-files
spacewalk-backend-package-push-server
spacewalk-backend-applet
spacewalk-backend-app
susemanager-schema
uyuni-config-modules
susemanager-sls
spacewalk-base
spacewalk-html
spacewalk-base-minimal
spacewalk-base-minimal-config
susemanager
susemanager-tools
spacewalk-java-lib
spacewalk-java
spacewalk-java-postgresql
spacewalk-java-config
spacewalk-taskomatic
susemanager-docs_en-pdf
susemanager-docs_en
susemanager-doc-indexes
susemanager-tftpsync
release-notes-susemanager
python3-mgr-push
mgr-push
uyuni-setup-reportdb
susemanager-sync-data
spacewalk-utils-extras
spacewalk-utils
susemanager-schema-utility
woodstox
drools
susemanager-build-keys-web
susemanager-build-keys
py27-compat-salt
IBM Spectrum Control
IBM Security Verify Governance

Install updates from vendor's website.

Drools - update to 7.69.0
saltboot-formula - addressed in versions 0.1.1673279145.e7616bd-150400.3.6.3, 0.1.1676908681.e90e0b1-150300.3.15.1
image-sync-formula - update to 0.1.1673279145.e7616bd-150400.3.9.3
inter-server-sync-debuginfo - addressed in versions 0.2.6-150400.3.12.3, 0.2.7-150300.8.28.2
inter-server-sync - addressed in versions 0.2.6-150400.3.12.3, 0.2.7-150300.8.28.2
prometheus-formula - update to 0.7.0-150300.3.17.2
grafana-formula - addressed in versions 0.8.0-150400.3.6.3, 0.8.1-150300.3.9.2
salt-netapi-client - update to 0.21.0-150300.3.12.4
virtual-host-gatherer-Kubernetes - addressed in versions 1.0.24-150300.3.9.2, 1.0.24-150400.3.6.3
virtual-host-gatherer-libcloud - addressed in versions 1.0.24-150300.3.9.2, 1.0.24-150400.3.6.3
virtual-host-gatherer - addressed in versions 1.0.24-150300.3.9.2, 1.0.24-150400.3.6.3
virtual-host-gatherer-Nutanix - addressed in versions 1.0.24-150300.3.9.2, 1.0.24-150400.3.6.3
virtual-host-gatherer-VMware - addressed in versions 1.0.24-150300.3.9.2, 1.0.24-150400.3.6.3
smdba - update to 1.7.11-0.150300.3.12.2
cobbler - addressed in versions 3.1.2-150300.5.19.1, 3.3.3-150400.5.17.3
supportutils-plugin-susemanager - addressed in versions 4.2.5-150300.3.9.2, 4.3.6-150400.3.6.3
python3-rhnlib - addressed in versions 4.2.7-150300.4.12.2, 4.3.5-150400.3.3.3
python3-mgr-osad - update to 4.2.9-150300.2.12.2
python3-mgr-osa-common - addressed in versions 4.2.9-150300.2.12.2, 4.3.7-150400.3.3.4
mgr-osa-dispatcher - addressed in versions 4.2.9-150300.2.12.2, 4.3.7-150400.3.3.4
python3-mgr-osa-dispatcher - addressed in versions 4.2.9-150300.2.12.2, 4.3.7-150400.3.3.4
mgr-osad - update to 4.2.9-150300.2.12.2
python3-uyuni-common-libs - addressed in versions 4.2.9-150300.3.14.1, 4.3.7-150400.3.9.4
spacewalk-search - addressed in versions 4.2.9-150300.3.15.2, 4.3.8-150400.3.9.3
spacewalk-proxy-installer - update to 4.2.11-150300.3.14.2
spacewalk-admin - update to 4.2.13-150300.3.18.1
spacewalk-proxy-redirect - update to 4.2.13-150300.3.24.2
spacewalk-proxy-salt - update to 4.2.13-150300.3.24.2
spacewalk-proxy-broker - update to 4.2.13-150300.3.24.2
spacewalk-proxy-management - update to 4.2.13-150300.3.24.2
spacewalk-proxy-common - update to 4.2.13-150300.3.24.2
spacewalk-proxy-package-manager - update to 4.2.13-150300.3.24.2
python3-spacewalk-certs-tools - addressed in versions 4.2.19-150300.3.27.4, 4.3.17-150400.3.12.4
spacewalk-certs-tools - addressed in versions 4.2.19-150300.3.27.4, 4.3.17-150400.3.12.4
spacecmd - addressed in versions 4.2.21-150300.4.33.2, 4.3.18-150400.3.12.3
spacewalk-check - update to 4.2.22-150300.4.30.2
python3-spacewalk-client-tools - addressed in versions 4.2.22-150300.4.30.2, 4.3.14-150400.3.12.5
spacewalk-client-tools - addressed in versions 4.2.22-150300.4.30.2, 4.3.14-150400.3.12.5
python3-spacewalk-client-setup - update to 4.2.22-150300.4.30.2
spacewalk-client-setup - update to 4.2.22-150300.4.30.2
python3-spacewalk-check - update to 4.2.22-150300.4.30.2
spacewalk-backend-config-files-tool - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend-tools - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend-config-files-common - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend-server - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend-iss - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend-xmlrpc - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend-sql-postgresql - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend-iss-export - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend-sql - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend-xml-export-libs - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend-config-files - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend-package-push-server - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend-applet - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
spacewalk-backend-app - addressed in versions 4.2.26-150300.4.35.6, 4.3.18-150400.3.12.5
susemanager-schema - addressed in versions 4.2.27-150300.3.35.1, 4.3.16-150400.3.12.4
uyuni-config-modules - addressed in versions 4.2.31-150300.3.43.1, 4.3.29-150400.3.16.1
susemanager-sls - addressed in versions 4.2.31-150300.3.43.1, 4.3.29-150400.3.16.1
spacewalk-base - addressed in versions 4.2.32-150300.3.36.4, 4.3.27-150400.3.12.5
spacewalk-html - addressed in versions 4.2.32-150300.3.36.4, 4.3.27-150400.3.12.5
spacewalk-base-minimal - addressed in versions 4.2.32-150300.3.36.4, 4.3.27-150400.3.12.5
spacewalk-base-minimal-config - addressed in versions 4.2.32-150300.3.36.4, 4.3.27-150400.3.12.5
susemanager - addressed in versions 4.2.40-150300.3.49.1, 4.3.23-150400.3.16.3
susemanager-tools - addressed in versions 4.2.40-150300.3.49.1, 4.3.23-150400.3.16.3
spacewalk-java-lib - addressed in versions 4.2.47-150300.3.58.1, 4.3.46-150400.3.28.1
spacewalk-java - addressed in versions 4.2.47-150300.3.58.1, 4.3.46-150400.3.28.1
spacewalk-java-postgresql - addressed in versions 4.2.47-150300.3.58.1, 4.3.46-150400.3.28.1
spacewalk-java-config - addressed in versions 4.2.47-150300.3.58.1, 4.3.46-150400.3.28.1
spacewalk-taskomatic - addressed in versions 4.2.47-150300.3.58.1, 4.3.46-150400.3.28.1
susemanager-docs_en-pdf - addressed in versions 4.2-150300.12.39.2, 4.3-150400.9.19.1
susemanager-docs_en - addressed in versions 4.2-150300.12.39.2, 4.3-150400.9.19.1
susemanager-doc-indexes - update to 4.2-150300.12.39.4
susemanager-tftpsync - update to 4.3.3-150400.3.6.5
release-notes-susemanager - update to 4.3.4-150400.3.43.1
python3-mgr-push - update to 4.3.5-150400.3.3.5
mgr-push - update to 4.3.5-150400.3.3.5
uyuni-setup-reportdb - update to 4.3.6-150400.3.3.4
susemanager-sync-data - update to 4.3.12-150400.3.11.3
spacewalk-utils-extras - update to 4.3.16-150400.3.12.3
spacewalk-utils - update to 4.3.16-150400.3.12.3
susemanager-schema-utility - update to 4.3.16-150400.3.12.4
woodstox - update to 4.4.2-150300.3.6.2
IBM Spectrum Control - update to 5.4.10.1
drools - addressed in versions 7.17.0-150300.4.9.2, 7.17.0-150400.3.9.3
IBM Security Verify Governance - update to 10.0.2.0.2
susemanager-build-keys-web - addressed in versions 15.3.6-150300.3.6.2, 15.4.7-150400.3.12.3
susemanager-build-keys - addressed in versions 15.3.6-150300.3.6.2, 15.4.7-150400.3.12.3
py27-compat-salt - update to 3000.3-150300.7.7.29.2

• https://www.suse.com/support/update/announcement/2023/suse-su-20230345-1/

• Remote code execution in Drools
• SUSE update for SUSE Manager Server 4.3
• SUSE update for SUSE Manager Server 4.3
• Deserialization of untrusted data in IBM Spectrum Control
• SUSE update for SUSE Manager 4.2.11
• Multiple vulnerabilities in IBM Security Verify Governance