Drools: unsafe data deserialization in streamutils
Priority MEDIUM 42CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01044 64th percentileScored 2026-11-07
Fix Partial org.drools:drools-core (Maven): 7.69.0.FinalRed Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | RHPAM 7.13.1 async | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apache Camel for Spring Boot | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Quarkus | — | — | Not affected | CNA |
| Red Hat | Red Hat Decision Manager 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Integration Camel K | — | — | Not affected | CNA |
| Red Hat | Red Hat Integration Camel Quarkus | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Data Virtualization 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Fuse 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Fuse 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Fuse Service Works 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Process Automation 7 | — | — | No fix listed | CNA |
| — | org.drools:drools-core (Maven) | before 7.69.0.Final | 7.69.0.Final | Patch available | GHSA-m5q8-58wh-xxq4 |
- RHPAM 7.13.1 async VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apache Camel for Spring Boot VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Decision Manager 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Integration Camel K VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Integration Camel Quarkus VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Data Virtualization 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Fuse 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Fuse 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Fuse Service Works 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- org.drools:drools-core (Maven) Vendor— Affected before 7.69.0.Final Fixed in 7.69.0.Final Patch available GHSA-m5q8-58wh-xxq4
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:drools:7.69.0:*:*:*:*:*:*:* | 7.69.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:drools:7.69.0:*:*:*:*:*:*:* Versions 7.69.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-m5q8-58wh-xxq4 org.drools:drools-core (Maven) Fixed in 7.69.0.Final Advisory →
Red Hat 1 advisory
- RHSA-2022:6813 Released 2022-10-05 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.1 security update
- RHPAM 7.13.1 async
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Decision Manager 7 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix yet |
| RHPAM 7.13.1 async | Fixed | RHSA-2022:6813 |
Not affected: 9 products
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat Integration Camel Quarkus 1
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat build of Apache Camel for Spring Boot 3
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1415
- 2026-10-03 Alias added: GHSA-m5q8-58wh-xxq4
References
More Red Hat Decision Manager vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2019-11045 Insufficiently protected credentials in Business-central CVSS 3.1HIGH 7.5
- TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2018-13721 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
- TI-2018-13720 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
- TI-2018-13719 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2022-1415 · CVE Program
- CVE-2022-1415 · NVD
- FIRST EPSS
- GHSA-m5q8-58wh-xxq4 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-1415 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences