PT-2022-11391 · Drools+1 · Drools+1

Published 2022-06-16 · Updated 2022-10-26 · CVE-2021-41411

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions drools versions prior to 7.60

Description The issue is related to an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

Recommendations For drools versions prior to 7.60, update to a version that correctly utilizes the Validator class to prevent XXE injection. As a temporary workaround, consider restricting the use of KieModuleMarshaller.java until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-41411

GHSA-RC57-9R3X-98CQ

SUSE-SU-2022:3313-1

SUSE-SU-2022:3314-1

SUSE-SU-2022:3750-1

SUSE-SU-2022:3761-1

Affected Products

Suse

Drools

References · 87

• https://github.com/kiegroup/drools/pull/3808 · Patch
• https://osv.dev/vulnerability/GHSA-rc57-9r3x-98cq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41411 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:3314-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3761-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3750-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41411 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3313-1 · Vendor Advisory
• https://github.com/apache/incubator-kie-drools/pull/3808 · Note
• https://github.com/kiegroup/drools · Note
• https://bugzilla.suse.com/1201607 · Note
• https://bugzilla.suse.com/1203484 · Note
• https://bugzilla.suse.com/1202464 · Note
• https://bugzilla.suse.com/1195624 · Note
• https://bugzilla.suse.com/1199659 · Note