EUVD-2023-2544

Malicious code in bioql PyPI...

GHSA-M5Q8-58WH-XXQ4 Drools Core Deserialization of Untrusted Data vulnerability

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects usually called gadgets and achieve code execution on the server...

org.drools:drools-ant (5.0.0.m3), org.drools:drools-compiler (5.0.0.m3) +2 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.0.0.m3)

org.drools:drools-core MAVEN version 5.0.0.m3 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools:drools-ant 5.0.0.m3 - org.drools:drools-compiler 5.0.0.m3 - org.drools:drools-decisiontables 5.0.0.m3...

org.boretti.drools.integration:drools5-integration-helper-archetype (>=1.0.0, <=1.3.0), org.boretti.drools.integration:drools5-integration-helper-library (>=1.0.0, <=1.3.0) +25 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.0.1)

org.drools:drools-core MAVEN version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.boretti.drools.integration:drools5-integration-helper-archetype =1.0.0, =1.0.0, =1.2.0, =1.0.0, =5.0.1, =5.0.1,...

org.drools:drools-bam (5.1.0.m2), org.drools:drools-mc (5.1.0.m2) +3 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.1.0.m2)

org.drools:drools-core MAVEN version 5.1.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools:drools-bam 5.1.0.m2 - org.drools:drools-mc 5.1.0.m2 - org.drools:drools-messenger-jms 5.1.0.m2 -...

org.drools.planner:drools-planner-core (5.1.0.cr1), org.drools.planner:drools-planner-examples (5.1.0.cr1) +17 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.1.0.cr1)

org.drools:drools-core MAVEN version 5.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.1.0.cr1 - org.drools.planner:drools-planner-examples 5.1.0.cr1 -...

org.drools.planner:drools-planner-core (5.1.0), org.drools.planner:drools-planner-examples (5.1.0) +17 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.1.0)

org.drools:drools-core MAVEN version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.1.0 - org.drools.planner:drools-planner-examples 5.1.0 -...

com.googlecode.jannocessor:jannocessor (>=0.5.0, <=0.7.2), com.googlecode.jannocessor:jannocessor-collections (0.6.0) +45 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.1.1)

org.drools:drools-core MAVEN version 5.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - com.googlecode.jannocessor:jannocessor =0.5.0, =0.7.0, =0.6.0, =0.7.2 - com.googlecode.jannocessor:jannocessor-rend...

org.drools.planner:drools-planner-core (5.2.0.m2), org.drools.planner:drools-planner-distribution (5.2.0.m2) +25 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.2.0.m2)

org.drools:drools-core MAVEN version 5.2.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.2.0.m2 - org.drools.planner:drools-planner-distribution 5.2.0.m2 -...

org.drools.planner:drools-planner-core (5.2.0.cr1), org.drools.planner:drools-planner-distribution (5.2.0.cr1) +25 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.2.0.cr1)

org.drools:drools-core MAVEN version 5.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.2.0.cr1 - org.drools.planner:drools-planner-distribution 5.2.0.cr1 -...

de.lightful.maven.drools:knowledge-io (>=0.3.0, <=0.3.1), org.codehaus.fabric3:fabric3-drools (1.9) +34 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.2.0.final)

org.drools:drools-core MAVEN version 5.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - de.lightful.maven.drools:knowledge-io =0.3.0, =0.3.1 - org.codehaus.fabric3:fabric3-drools 1.9 -...

org.drools.planner:drools-planner-core (5.2.1.final), org.drools.planner:drools-planner-examples (5.2.1.final) +25 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.2.1.final)

org.drools:drools-core MAVEN version 5.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.2.1.final - org.drools.planner:drools-planner-examples 5.2.1.final -...

org.drools.planner:drools-planner-core (5.3.0.beta1), org.drools.planner:drools-planner-distribution (5.3.0.beta1) +20 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.3.0.beta1)

org.drools:drools-core MAVEN version 5.3.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.3.0.beta1 - org.drools.planner:drools-planner-distribution 5.3.0.bet...

org.drools.planner:drools-planner-core (5.3.0.cr1), org.drools.planner:drools-planner-distribution (5.3.0.cr1) +22 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.3.0.cr1)

org.drools:drools-core MAVEN version 5.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.3.0.cr1 - org.drools.planner:drools-planner-distribution 5.3.0.cr1 -...

org.apache.sling:maven-launchpad-plugin (>=2.1.2, <=2.3.4), org.apache.sling:org.apache.sling.paxexam.util (>=1.0.2, <=1.0.4) +34 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.3.1.final)

org.drools:drools-core MAVEN version 5.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.apache.sling:maven-launchpad-plugin =2.1.2, =1.0.2, =1.0.4 - org.drools.planner:drools-planner-core...

org.drools.planner:drools-planner-core (5.3.2.final), org.drools.planner:drools-planner-distribution (5.3.2.final) +32 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.3.2.final)

org.drools:drools-core MAVEN version 5.3.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.3.2.final - org.drools.planner:drools-planner-distribution 5.3.2.fin...

org.drools.planner:drools-planner-core (5.3.3.final), org.drools.planner:drools-planner-distribution (5.3.3.final) +32 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.3.3.final)

org.drools:drools-core MAVEN version 5.3.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.3.3.final - org.drools.planner:drools-planner-distribution 5.3.3.fin...

org.drools.planner:drools-planner-core (5.3.4.final), org.drools.planner:drools-planner-distribution (5.3.4.final) +32 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.3.4.final)

org.drools:drools-core MAVEN version 5.3.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.3.4.final - org.drools.planner:drools-planner-distribution 5.3.4.fin...

org.drools.planner:drools-planner-core (5.4.0.beta1), org.drools.planner:drools-planner-distribution (5.4.0.beta1) +23 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.4.0.beta1)

org.drools:drools-core MAVEN version 5.4.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.4.0.beta1 - org.drools.planner:drools-planner-distribution 5.4.0.bet...

org.drools.planner:drools-planner-core (5.4.0.beta2), org.drools.planner:drools-planner-distribution (5.4.0.beta2) +23 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.4.0.beta2)

org.drools:drools-core MAVEN version 5.4.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.4.0.beta2 - org.drools.planner:drools-planner-distribution 5.4.0.bet...