CVE-2021-41411

A flaw was found in the XML external entity injection vulnerability in the KieModuleMarshaller.java module of drools-compiler. This issue may lead to the disclosure of sensitive information...

org.drools:cdi-example (6.0.0.beta2), org.drools:cdi-example-with-inclusion (6.0.0.beta2) +114 more potentially affected by CVE-2022-1415 via org.drools:drools-core (6.0.0.beta2)

org.drools:drools-core MAVEN version 6.0.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools:cdi-example 6.0.0.beta2 - org.drools:cdi-example-with-inclusion 6.0.0.beta2 -...

org.drools:drools-ant (5.0.0.m3), org.drools:drools-compiler (5.0.0.m3) +2 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.0.0.m3)

org.drools:drools-core MAVEN version 5.0.0.m3 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools:drools-ant 5.0.0.m3 - org.drools:drools-compiler 5.0.0.m3 - org.drools:drools-decisiontables 5.0.0.m3...

org.drools:drools-ant (5.1.0.m1), org.drools:drools-bam (5.1.0.m1) +16 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.1.0.m1)

org.drools:drools-core MAVEN version 5.1.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools:drools-ant 5.1.0.m1 - org.drools:drools-bam 5.1.0.m1 - org.drools:drools-clips 5.1.0.m1 -...

org.drools.planner:drools-planner-benchmark (5.5.0.beta1), org.drools.planner:drools-planner-core (5.5.0.beta1) +39 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.5.0.beta1)

org.drools:drools-core MAVEN version 5.5.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-benchmark 5.5.0.beta1 - org.drools.planner:drools-planner-core 5.5.0.beta1 ...

Deserialization Of Untrusted Data

org.drools:drools-compiler is vulnerable to deserialization of untrusted data. The vulnerability exists due to lack of serialization in multiple functions in CompositeKnowledgeBuilderImpl.java and KnowledgeBuilderImpl.java which allows an attacker to execute arbitrary malicious code on the system...

XML External Entity (XXE)

Drools Compiler is vulnerable to xml external entity. The vulnerability exists in validate function in KieModuleMarshaller.java due to incorrect use of Validator class which allows an attacker to submit a malicious XML document to perform requests on behalf of the server...

org.drools.planner:drools-planner-benchmark (5.5.0.beta1), org.drools.planner:drools-planner-core (5.5.0.beta1) +39 more potentially affected by CVE-2021-41411 via org.drools:drools-core (5.5.0.beta1)

org.drools:drools-core MAVEN version 5.5.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-benchmark 5.5.0.beta1 - org.drools.planner:drools-planner-core 5.5.0.beta1 ...

org.drools.planner:drools-planner-core (5.2.1.final), org.drools.planner:drools-planner-examples (5.2.1.final) +25 more potentially affected by CVE-2021-41411 via org.drools:drools-core (5.2.1.final)

org.drools:drools-core MAVEN version 5.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.2.1.final - org.drools.planner:drools-planner-examples 5.2.1.final -...

org.drools.solver:drools-solver-core (5.0.0.m5), org.drools.solver:drools-solver-examples (5.0.0.m5) +15 more potentially affected by CVE-2021-41411 via org.drools:drools-core (5.0.0.m5)

org.drools:drools-core MAVEN version 5.0.0.m5 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.solver:drools-solver-core 5.0.0.m5 - org.drools.solver:drools-solver-examples 5.0.0.m5 -...

org.drools:drools-ant (5.0.0.m4), org.drools:drools-compiler (5.0.0.m4) +2 more potentially affected by CVE-2021-41411 via org.drools:drools-core (5.0.0.m4)

org.drools:drools-core MAVEN version 5.0.0.m4 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools:drools-ant 5.0.0.m4 - org.drools:drools-compiler 5.0.0.m4 - org.drools:drools-decisiontables 5.0.0.m4...

org.drools:drools-ant (5.0.0.m3), org.drools:drools-compiler (5.0.0.m3) +2 more potentially affected by CVE-2014-8125 via org.drools:drools-core (5.0.0.m3)

org.drools:drools-core MAVEN version 5.0.0.m3 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools:drools-ant 5.0.0.m3 - org.drools:drools-compiler 5.0.0.m3 - org.drools:drools-decisiontables 5.0.0.m3...

org.drools.planner:drools-planner-core (5.3.5.final), org.drools.planner:drools-planner-distribution (5.3.5.final) +32 more potentially affected by CVE-2014-8125 via org.drools:drools-core (5.3.5.final)

org.drools:drools-core MAVEN version 5.3.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.3.5.final - org.drools.planner:drools-planner-distribution 5.3.5.fin...

org.drools.solver:drools-solver-core (5.0.0.m5), org.drools.solver:drools-solver-examples (5.0.0.m5) +15 more potentially affected by CVE-2014-8125 via org.drools:drools-core (5.0.0.m5)

org.drools:drools-core MAVEN version 5.0.0.m5 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.solver:drools-solver-core 5.0.0.m5 - org.drools.solver:drools-solver-examples 5.0.0.m5 -...

org.drools.planner:drools-planner-core (5.2.1.final), org.drools.planner:drools-planner-examples (5.2.1.final) +25 more potentially affected by CVE-2014-8125 via org.drools:drools-core (5.2.1.final)

org.drools:drools-core MAVEN version 5.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.2.1.final - org.drools.planner:drools-planner-examples 5.2.1.final -...