{"id":"CVE-2022-1415","aliases":["EUVD-2023-2544","GHSA-m5q8-58wh-xxq4","SUSE-SU-2023:0345-1","SUSE-SU-2023:0373-1","SUSE-SU-2023:0592-1"],"status":"published","title":"Drools: unsafe data deserialization in streamutils","description":"A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01044,"percentile":0.64409,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2023-02-10T14:06:32Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Maven","package":"org.drools:drools-core","fixed_in":["7.69.0.Final"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"cobbler","fixed_in":["3.3.3-150400.5.17.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"drools","fixed_in":["7.17.0-150400.3.9.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"grafana-formula","fixed_in":["0.8.0-150400.3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"image-sync-formula","fixed_in":["0.1.1673279145.e7616bd-150400.3.9.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"inter-server-sync","fixed_in":["0.2.6-150400.3.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"mgr-osad","fixed_in":["4.3.7-150400.3.3.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"mgr-push","fixed_in":["4.3.5-150400.3.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"rhnlib","fixed_in":["4.3.5-150400.3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"saltboot-formula","fixed_in":["0.1.1673279145.e7616bd-150400.3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacecmd","fixed_in":["4.3.18-150400.3.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-backend","fixed_in":["4.3.18-150400.3.12.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-certs-tools","fixed_in":["4.3.17-150400.3.12.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-client-tools","fixed_in":["4.3.14-150400.3.12.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-java","fixed_in":["4.3.46-150400.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-search","fixed_in":["4.3.8-150400.3.9.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-utils","fixed_in":["4.3.16-150400.3.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-web","fixed_in":["4.3.27-150400.3.12.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"supportutils-plugin-susemanager","fixed_in":["4.3.6-150400.3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager","fixed_in":["4.3.23-150400.3.16.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-build-keys","fixed_in":["15.4.7-150400.3.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-docs_en","fixed_in":["4.3-150400.9.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-schema","fixed_in":["4.3.16-150400.3.12.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sls","fixed_in":["4.3.29-150400.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sync-data","fixed_in":["4.3.12-150400.3.11.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-tftpsync","fixed_in":["4.3.3-150400.3.6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-common-libs","fixed_in":["4.3.7-150400.3.9.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-setup-reportdb","fixed_in":["4.3.6-150400.3.3.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"virtual-host-gatherer","fixed_in":["1.0.24-150400.3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","fixed_in":["4.3.4-150400.3.43.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.drools:drools-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.69.0.Final"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.drools:drools-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.69.0.Final"}]}],"versions":["5.0.0.CR1","5.0.0.M3","5.0.0.M4","5.0.0.M5","5.0.1","5.1.0","5.1.0.CR1","5.1.0.M1","5.1.0.M2","5.1.1","5.2.0.CR1","5.2.0.Final","5.2.0.M2","5.2.1.Final","5.3.0.Beta1","5.3.0.CR1","5.3.0.Final","5.3.1.Final","5.3.2.Final","5.3.3.Final","5.3.4.Final","5.3.5.Final","5.4.0.Beta1","5.4.0.Beta2","5.4.0.CR1","5.4.0.Final","5.5.0.Beta1","5.5.0.CR1","5.5.0.Final","5.6.0.CR1","5.6.0.Final","6.0.0.Alpha4","6.0.0.Alpha5","6.0.0.Alpha6","6.0.0.Alpha7","6.0.0.Alpha9","6.0.0.Beta1","6.0.0.Beta2","6.0.0.Beta3","6.0.0.Beta4","6.0.0.Beta5","6.0.0.CR1","6.0.0.CR2","6.0.0.CR3","6.0.0.CR4","6.0.0.CR4-Pre1","6.0.0.CR5","6.0.0.Final","6.0.1.Final","6.1.0.Beta1","6.1.0.Beta2","6.1.0.Beta3","6.1.0.Beta4","6.1.0.CR1","6.1.0.CR2","6.1.0.Final","6.2.0.Beta1","6.2.0.Beta2","6.2.0.Beta3","6.2.0.CR1","6.2.0.CR2","6.2.0.CR3","6.2.0.CR4","6.2.0.Final","6.3.0.Beta1","6.3.0.Beta2","6.3.0.CR1","6.3.0.CR2","6.3.0.Final","6.4.0.Beta1","6.4.0.Beta2","6.4.0.CR1","6.4.0.CR2","6.4.0.Final","6.5.0.Beta1","6.5.0.CR1","6.5.0.CR2","6.5.0.Final","7.0.0.Beta1","7.0.0.Beta2","7.0.0.Beta3","7.0.0.Beta4","7.0.0.Beta5","7.0.0.Beta6","7.0.0.Beta7","7.0.0.Beta8","7.0.0.CR1","7.0.0.CR2","7.0.0.CR3","7.0.0.Final","7.1.0.Beta1","7.1.0.Beta2","7.1.0.Beta3","7.1.0.Final","7.10.0.Final","7.11.0.Final","7.12.0.Final","7.13.0.Final","7.14.0.Final","7.15.0.Final","7.16.0.Final","7.17.0.Final","7.18.0.Final","7.19.0.Final","7.2.0.Final","7.20.0.Final","7.21.0.Final","7.22.0.Final","7.22.0.t042","7.23.0.Final","7.24.0.Final","7.24.0.t043","7.25.0.Final","7.26.0.Final","7.27.0.Final","7.28.0.Final","7.29.0.Final","7.3.0.Final","7.30.0.Final","7.31.0.Final","7.32.0.Final","7.32.0.k20191220","7.32.0.k20191223","7.33.0.Final","7.34.0.Final","7.35.0.Final","7.36.0.20200330","7.36.0.20200331","7.36.0.Final","7.36.1.Final","7.37.0.Final","7.38.0.Final","7.39.0.CR1","7.39.0.Final","7.4.0.Final","7.4.1.Final","7.40.0.20200703","7.40.0.Final","7.41.0.Final","7.41.0.t20200723","7.42.0.Final","7.43.0.Final","7.43.0.t20200824","7.43.1.Final","7.44.0.Final","7.45.0.Final","7.45.0.t20201009","7.45.0.t20201014","7.46.0.Beta1","7.46.0.Final","7.46.0.t20201030","7.47.0.Final","7.48.0.Final","7.49.0.Final","7.49.0.t20210118","7.5.0.Final","7.5.0.t018","7.50.0.Final","7.50.0.t20210209","7.51.0.Final","7.51.0.t20210303","7.52.0.Beta1","7.52.0.Final","7.52.0.t20210322","7.53.0.Final","7.53.1.Final","7.54.0.Beta1","7.54.0.Final","7.55.0.Beta1","7.55.0.Final","7.56.0.Final","7.57.0.Beta1","7.57.0.Final","7.58.0.Beta1","7.58.0.Final","7.59.0.Beta1","7.59.0.Final","7.6.0.Final","7.6.0.t022","7.60.0.Final","7.61.0.Final","7.62.0.Final","7.63.0.Final","7.63.0.t20211129","7.64.0.Final","7.65.0.Final","7.66.0.Final","7.67.0.Final","7.68.0.Final","7.7.0.Final","7.8.0.Final","7.9.0.Final"]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-150400.5.17.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"drools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.17.0-150400.3.9.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-150400.3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"image-sync-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1673279145.e7616bd-150400.3.9.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.6-150400.3.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.7-150400.3.3.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-150400.3.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-150400.3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"saltboot-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1673279145.e7616bd-150400.3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.18-150400.3.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.18-150400.3.12.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.17-150400.3.12.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.14-150400.3.12.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.46-150400.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.8-150400.3.9.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.3.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.27-150400.3.12.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"supportutils-plugin-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-150400.3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.23-150400.3.16.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4.7-150400.3.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-150400.9.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.3.12.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.29-150400.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.12-150400.3.11.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-tftpsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-150400.3.6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.7-150400.3.9.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-setup-reportdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-150400.3.3.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"virtual-host-gatherer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.24-150400.3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-150400.3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-150300.2.12.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7-150300.4.12.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.21-150300.4.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.26-150300.4.35.6"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.19-150300.3.27.4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.22-150300.4.30.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.13-150300.3.24.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-proxy-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150300.3.14.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.32-150300.3.36.4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.3.6-150300.3.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-150300.3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150300.5.19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"drools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.17.0-150300.4.9.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1-150300.3.9.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.7-150300.8.28.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-150300.2.12.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"prometheus-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-150300.3.17.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"py27-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000.3-150300.7.7.29.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7-150300.4.12.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-150300.3.12.4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"saltboot-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1676908681.e90e0b1-150300.3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"smdba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.11-0.150300.3.12.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.21-150300.4.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.13-150300.3.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.26-150300.4.35.6"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.19-150300.3.27.4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.22-150300.4.30.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.47-150300.3.58.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-150300.3.15.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.32-150300.3.36.4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"supportutils-plugin-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5-150300.3.9.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.40-150300.3.49.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.3.6-150300.3.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.12.39.4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.12.39.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.27-150300.3.35.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.31-150300.3.43.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-150300.3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"virtual-host-gatherer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.24-150300.3.9.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"woodstox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-150300.3.6.2"}]}],"bundled":5}],"products":[{"vendor":"red hat","product":"red hat build of apache camel for spring boot"},{"vendor":"red hat","product":"red hat build of quarkus"},{"vendor":"red hat","product":"red hat decision manager 7"},{"vendor":"red hat","product":"red hat integration camel k"},{"vendor":"red hat","product":"red hat integration camel quarkus"},{"vendor":"red hat","product":"red hat jboss data grid 7"},{"vendor":"red hat","product":"red hat jboss data virtualization 6"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 6"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat jboss fuse 6"},{"vendor":"red hat","product":"red hat jboss fuse 7"},{"vendor":"red hat","product":"red hat jboss fuse service works 6"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"rhpam 7.13.1 async"},{"vendor":"redhat","product":"decision_manager"},{"vendor":"redhat","product":"drools"},{"vendor":"redhat","product":"jboss_middleware_text-only_advisories"},{"vendor":"redhat","product":"process_automation"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2022:6813","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1415","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065505","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1415","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m5q8-58wh-xxq4"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1415.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230345-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172110","tags":["report"]},{"url":"https://bugzilla.suse.com/1195979","tags":["report"]},{"url":"https://bugzilla.suse.com/1200801","tags":["report"]},{"url":"https://bugzilla.suse.com/1202150","tags":["report"]},{"url":"https://bugzilla.suse.com/1203478","tags":["report"]},{"url":"https://bugzilla.suse.com/1203532","tags":["report"]},{"url":"https://bugzilla.suse.com/1203826","tags":["report"]},{"url":"https://bugzilla.suse.com/1204032","tags":["report"]},{"url":"https://bugzilla.suse.com/1204126","tags":["report"]},{"url":"https://bugzilla.suse.com/1204186","tags":["report"]},{"url":"https://bugzilla.suse.com/1204235","tags":["report"]},{"url":"https://bugzilla.suse.com/1204270","tags":["report"]},{"url":"https://bugzilla.suse.com/1204330","tags":["report"]},{"url":"https://bugzilla.suse.com/1204712","tags":["report"]},{"url":"https://bugzilla.suse.com/1204715","tags":["report"]},{"url":"https://bugzilla.suse.com/1204879","tags":["report"]},{"url":"https://bugzilla.suse.com/1204932","tags":["report"]},{"url":"https://bugzilla.suse.com/1205012","tags":["report"]},{"url":"https://bugzilla.suse.com/1205040","tags":["report"]},{"url":"https://bugzilla.suse.com/1205207","tags":["report"]},{"url":"https://bugzilla.suse.com/1205255","tags":["report"]},{"url":"https://bugzilla.suse.com/1205350","tags":["report"]},{"url":"https://bugzilla.suse.com/1205489","tags":["report"]},{"url":"https://bugzilla.suse.com/1205523","tags":["report"]},{"url":"https://bugzilla.suse.com/1205644","tags":["report"]},{"url":"https://bugzilla.suse.com/1205663","tags":["report"]},{"url":"https://bugzilla.suse.com/1205749","tags":["report"]},{"url":"https://bugzilla.suse.com/1205754","tags":["report"]},{"url":"https://bugzilla.suse.com/1205890","tags":["report"]},{"url":"https://bugzilla.suse.com/1205919","tags":["report"]},{"url":"https://bugzilla.suse.com/1205943","tags":["report"]},{"url":"https://bugzilla.suse.com/1206055","tags":["report"]},{"url":"https://bugzilla.suse.com/1206160","tags":["report"]},{"url":"https://bugzilla.suse.com/1206168","tags":["report"]},{"url":"https://bugzilla.suse.com/1206186","tags":["report"]},{"url":"https://bugzilla.suse.com/1206249","tags":["report"]},{"url":"https://bugzilla.suse.com/1206276","tags":["report"]},{"url":"https://bugzilla.suse.com/1206294","tags":["report"]},{"url":"https://bugzilla.suse.com/1206336","tags":["report"]},{"url":"https://bugzilla.suse.com/1206375","tags":["report"]},{"url":"https://bugzilla.suse.com/1206470","tags":["report"]},{"url":"https://bugzilla.suse.com/1206613","tags":["report"]},{"url":"https://bugzilla.suse.com/1206666","tags":["report"]},{"url":"https://bugzilla.suse.com/1206799","tags":["report"]},{"url":"https://bugzilla.suse.com/1207136","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1415","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230373-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230592-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188191","tags":["report"]},{"url":"https://bugzilla.suse.com/1197027","tags":["report"]},{"url":"https://bugzilla.suse.com/1200096","tags":["report"]},{"url":"https://bugzilla.suse.com/1200169","tags":["report"]},{"url":"https://bugzilla.suse.com/1201142","tags":["report"]},{"url":"https://bugzilla.suse.com/1201476","tags":["report"]},{"url":"https://bugzilla.suse.com/1201893","tags":["report"]},{"url":"https://bugzilla.suse.com/1202093","tags":["report"]},{"url":"https://bugzilla.suse.com/1202217","tags":["report"]},{"url":"https://bugzilla.suse.com/1203287","tags":["report"]},{"url":"https://bugzilla.suse.com/1203288","tags":["report"]},{"url":"https://bugzilla.suse.com/1203521","tags":["report"]},{"url":"https://bugzilla.suse.com/1203588","tags":["report"]},{"url":"https://bugzilla.suse.com/1203633","tags":["report"]},{"url":"https://bugzilla.suse.com/1203698","tags":["report"]},{"url":"https://bugzilla.suse.com/1203884","tags":["report"]},{"url":"https://bugzilla.suse.com/1203886","tags":["report"]},{"url":"https://bugzilla.suse.com/1204029","tags":["report"]},{"url":"https://bugzilla.suse.com/1204208","tags":["report"]},{"url":"https://bugzilla.suse.com/1204437","tags":["report"]},{"url":"https://bugzilla.suse.com/1204517","tags":["report"]},{"url":"https://bugzilla.suse.com/1204519","tags":["report"]},{"url":"https://bugzilla.suse.com/1204541","tags":["report"]},{"url":"https://bugzilla.suse.com/1204651","tags":["report"]},{"url":"https://bugzilla.suse.com/1204699","tags":["report"]},{"url":"https://bugzilla.suse.com/1205759","tags":["report"]},{"url":"https://bugzilla.suse.com/1205920","tags":["report"]},{"url":"https://bugzilla.suse.com/1206146","tags":["report"]},{"url":"https://bugzilla.suse.com/1206817","tags":["report"]},{"url":"https://bugzilla.suse.com/1206861","tags":["report"]},{"url":"https://bugzilla.suse.com/1206932","tags":["report"]},{"url":"https://bugzilla.suse.com/1206933","tags":["report"]},{"url":"https://bugzilla.suse.com/1206963","tags":["report"]},{"url":"https://bugzilla.suse.com/1206979","tags":["report"]},{"url":"https://bugzilla.suse.com/1206981","tags":["report"]},{"url":"https://bugzilla.suse.com/1207141","tags":["report"]},{"url":"https://bugzilla.suse.com/1208335","tags":["report"]},{"url":"https://bugzilla.suse.com/1208418","tags":["report"]},{"url":"https://bugzilla.suse.com/1208499","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40152","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-1415","title":"Drools: unsafe data deserialization in streamutils","description":"A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.","status":"published","published":"2023-09-11T20:20:23.745Z","modified":"2024-09-25T19:54:35.795Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:34:38.581997Z"}],"euvd":[{"id":"EUVD-2023-2544","description":"A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.","status":"published","published":"2023-09-11T20:20:23Z","modified":"2024-09-25T19:54:35Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:28:10.832665Z"}],"ghsa":[{"id":"GHSA-m5q8-58wh-xxq4","title":"Drools Core Deserialization of Untrusted Data vulnerability","description":"A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server. ","status":"published","published":"2023-09-11T21:30:17Z","modified":"2024-05-03T20:22:27Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:37:48.08826Z"}],"nvd":[{"id":"CVE-2022-1415","description":"A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.","status":"published","published":"2023-09-11T21:15:41.483Z","modified":"2026-06-17T04:22:24.69Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:39.811118Z"}],"osv":[{"id":"CVE-2022-1415","title":"Drools: unsafe data deserialization in streamutils","description":"A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.","status":"published","published":"2023-09-11T20:20:23.745Z","modified":"2026-10-28T02:30:45.541057019Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:44:23.245966Z"},{"id":"GHSA-m5q8-58wh-xxq4","title":"Drools Core Deserialization of Untrusted Data vulnerability","description":"A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server. ","status":"published","published":"2023-09-11T21:30:17Z","modified":"2024-05-03T20:35:13.995086Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"SUSE-SU-2023:0345-1","title":"Security update for SUSE Manager Server 4.3","description":"\nThis update fixes the following issues:\n\ncobbler:\n\n- Improve Cobbler performance with item cache and threadpool (bsc#1205489)\n- Skip collections that are inconsistent instead of crashing (bsc#1205749)\n- Add new 'cobbler-tests-containers' subpackage which contains setup and\n  configuration files to run Cobbler tests in containers.\n- Add missing code for previous patch file around boot_loaders migration.\n- Avoid possible override of existing values during migration\n  of collections to 3.0.0 (bsc#1206160)\n- Fix regression: allow empty string as interface_type value (bsc#1203478) \n- Fix failing Cobbler tests after upgrading to 3.3.3.\n\ndrools:\n\n- CVE-2022-1415: Deserialization of Untrusted Data: unsafe data deserialization\n  in DroolsStreamUtils.java (bsc#1204879)\n\ngrafana-formula:\n\n- Version 0.8.0\n  * Set dashboard names depending on project\n  * Update dashboards to use new JSON schema\n  * Fix PostgreSQL dashboard queries\n  * Migrate deprecated panels to their current replacements\n\nimage-sync-formula:\n\n- Update to version 0.1.1673279145.e7616bd\n  * Add form entry for use lates boot image pillar value (bsc#1206055)\n\ninter-server-sync:\n\n- Version 0.2.6\n  * Export package extra tags for complete debian repo metatdata (bsc#1206375)\n  * Replace URLs in OS Images pillars when exporting and importing images\n\nmgr-osad:\n\n- Version 4.3.7-1\n  * Updated logrotate configuration (bsc#1206470)\n\nmgr-push:\n\n- Version 4.3.5-1\n  * Update translation strings\n\nrhnlib:\n\n- Version 4.3.5-1\n  * Don't get stuck at the end of SSL transfers (bsc#1204032)\n\nsaltboot-formula:\n\n- Update to version 0.1.1673279145.e7616bd\n  * Add failsafe stop file when salt-minion does not stop (bsc#1172110)\n  * Add use case of saltboot group formula outside containerized env\n    (bsc#1206186)\n  * Add 'kernel_action' to saltboot form (bsc#1206055)\n\nspacecmd:\n\n- Version 4.3.18-1\n  * Add python-dateutil dependency, required to process date values in\n    spacecmd api calls\n- Version 4.3.17-1\n  * Remove python3-simplejson dependency\n  * Correctly understand 'ssm' keyword on scap scheduling\n  * Add vendor_advisory information to errata_details call (bsc#1205207)\n  * Added two missing options to schedule product migration: allow-vendor-change\n    and remove-products-without-successor (bsc#1204126)\n  * Changed schedule product migration to use the correct API method\n  * Change default port of 'Containerized Proxy configuration' 8022\n\nspacewalk-backend:\n\n- Version 4.3.18-1\n  * Add 'octet-stream' to accepted content-types for reposync mirrorlists\n  * Exclude invalid mirror urls for reposync (bsc#1203826)\n  * Compute headers as list of two-tuples to be used by url grabber (bsc#1205523)\n  * Updated logrotate configuration (bsc#1206470)\n  * Add rhel_9 as Salt-enabled kickstart installation\n  * do not fetch mirrorlist when a file url is given\n\nspacewalk-certs-tools:\n\n- Version 4.3.17-1\n  * Backport SLE Micro bootstrap fixes\n\nspacewalk-client-tools:\n\n- Version 4.3.14-1\n  * Update translation strings\n\nspacewalk-java:\n\n- Version 4.3.46-1\n  * action chains: recognize transactional_update.reboot as a reboot action\n- Version 4.3.45-1\n  * Improve logs when sls action chain file is missing\n- Version 4.3.44-1\n  * Add reboot needed indicator to systems list\n  * Fix transaction commit behavior for Spark routes\n  * Fix modular channel check during system update via XMLRPC (bsc#1206613)\n  * Fix CVE Audit ignoring errata in parent channels if patch in successor\n    product exists (bsc#1206168)\n  * Fix CVE Audit incorrectly displaying predecessor product (bsc#1205663)\n  * Improve automatic dependency selection for vendor clones\n  * Optimize the number of salt calls on minion startup (bsc#1203532)\n  * Fix name for autoinstall snippets after Cobbler 3.3.3\n  * prevent ISE on activation key page when selected base channel value is null\n  * Trigger a package profile update when a new live-patch is installed (bsc#1206249)\n  * Fix HTTP API login status code when using wrong credentials (bsc#1206666)\n  * Configure the reboot action for transactional systems appropriately\n  * Fix link to documentation in monitoring page\n  * Fix server error in product migration outside maintenance window (bsc#1206276)\n  * Updated logrotate configuration (bsc#1206470)\n  * Only remove product catalog if PAYG ssh credentials are defined (bsc#1205943)\n  * Source Select2 and jQuery UI from susemanager-frontend-libs\n  * Don't use hash in apidoc links\n  * Limit changelog data in generated metadata to 20 entries\n  * Fix internal server error when transferring system between organizations\n  * Fix products controller to keep loading mandatory channels even when there are\n    broken channels (bsc#1204270)\n  * Move web dependencies from susemanager-frontend-libs to\n    spacewalk-web\n  * Fix server error while bootstrapping SSH-managed Red Hat-like minion (bsc#1205890)\n  * send notifications also as email if email notifications are enabled\n  * Add subscription warning notification to overview page\n  * Fix CLM to not remove necessary packages when filtering erratas (bsc#1195979)\n  * Add vendor_advisory to errata.getDetails (bsc#1205207)\n  * Fix ClassCastException\n  * disable cloned vendor channel auto selection by default (bsc#1204186) \n  * Add SUSE Liberty Linux support for RHEL9 based clients\n  * Removed contents of certificates from the web UI logs (bsc#1204715)\n  * Fix kickstart for RHEL 9 to not add install command\n  * Remove RHEL kickstart types below 6\n  * Don't persist the YAML parser in FormulaFactory (bsc#1205754)\n  * format results for package, errata and image build actions in\n    system history similar to state apply results\n  * check for NULL in DEB package install size value\n  * adapt permissions of temporary ssh key directory\n  * Fixed traditional stack warning message to be displayed only when the system\n    has enterprise entitlement (bsc#1205350)\n  * Remove invalid errata selection after patch installation (bsc#1204235)\n  * Ignore insert conflicts during reporting database update (bsc#1202150)\n  * Allowed cancelling pending actions with a failed prerequisite (bsc#1204712)\n  * Run only minion actions that are in the pending status (bsc#1205012)\n  * Allow usage of one FQDN to deploy containerized proxy in VM (#19586)\n  * Migrate formulas with default values to database (bsc#1204932)\n\nspacewalk-search:\n\n- Version 4.3.8-1\n  * Updated logrotate configuration (bsc#1206470)\n  * fix logging configuration of the search daemon (bsc#1206336)\n\nspacewalk-utils:\n\n- Version 4.3.16-1\n  * spacewalk-hostname-rename changes also report db host(bsc#1200801)\n  * Add Uyuni SLE-Micro Client Tools repositories\n\nspacewalk-web:\n\n- Version 4.3.27-1\n  * Add reboot needed indicator to systems list\n  * Fix salt keys page keeps loading when no key exists (bsc#1206799)\n  * Fix link to documentation in monitoring page\n  * Source Select2 and jQuery UI from susemanager-frontend-libs\n  * fix frontend logging in react pages\n  * Move web dependencies from susemanager-frontend-libs to\n    spacewalk-web\n\nsupportutils-plugin-susemanager:\n\n- Version 4.3.6-1\n  * update susemanager plugin to export the number of pending salt events\n\nsusemanager:\n\n- Version 4.3.23-1\n  * fix bootstrap repo definition for SUSE Liberty Linux 9 and RHEL9\n    (bsc#1207136)\n- Version 4.3.22-1\n  * fix tools channel detection on Uyuni\n\nsusemanager-build-keys:\n\n- Version 15.4.7:\n  * add SUSE Liberty v2 key\n\nsusemanager-docs_en:\n\n- Removed SUSE Linux Enterprise MicroOS technical preview admonitions \n  from the Client Configuration Guide\n- Action chains now supported for SUSE Linux Enterprise MicroOS\n  Product Migration listed as unsupported for now for SUSE Linux\n  Enterprise MicroOS\n- Remove SUSE Linux Enterprise Micro requirement to preinstall\n  salt-transactional package\n- Organized navigation bar in the Installation and Upgrade\n  Guide\n- Fixed SUSE Linux Enterprise Micro channel names in the Client \n  Configuration Guide\n- Added SUSE Liberty Linux 9 clients as supported and now use the \n  SUSE Liberty Linux name more consistently\n- Containerized proxy now allows usage of single FQDN. Documented in\n  the Installation and Upgrade Guide\n- Added information about GPG key usuage in the Debian section of \n  the Client Configuration Guide \n- Clarified monitoring components support matrix in the \n  Client Configuration Guide\n- Added information on using Hub when managing greater than 10K \n  clients to the Hardware Requirements in the Installation and \n  Upgrade Guide\n- Improved Grafana configuration instructions in the Administration \n  Guide\n- Limit the changelog data in generated metadata in Administration \n  Guide. The default number of entries is now 20 and it is consistent \n  with the number of entries from SUSE Linux Enterprise\n- Warning to emphasize about storage requirements before migration \n  in the Installation and Upgrade Guide\n\nsusemanager-schema:\n\n- Version 4.3.16-1\n  * Remove legacy cluster_admin user group\n  * add subscription warning info pane\n  * Remove data related to RHEL below 6\n  * Increase cron_expr varchar length to 120 in suseRecurringAction\n    table (bsc#1205040)\n\nsusemanager-sls:\n    \n- Version 4.3.29-1\n  * Improve _mgractionchains.conf logs\n  * Prevent possible errors from 'mgractionschains' module when there is no action chain to resume\n- Version 4.3.28-1\n  * Move transactional_update.conf to correct location\n- Version 4.3.27-1\n  * Do not include pillar_only formulas in highstate\n  * Optimize the number of salt calls on minion startup (bsc#1203532)\n  * install SUSE Liberty v2 GPG key\n  * Bootstrap state now writes salt config in correct overlay on SLE Micro (bsc#1206294)\n  * Fix reboot info beacon installation\n  * Add state to properly configure the reboot action for transactional systems\n  * Updated logrotate configuration (bsc#1206470)\n  * Fix server error while bootstrapping SSH-managed Red Hat-like minion (bsc#1205890)\n  * Avoid installing recommended packages from assigned products (bsc#1204330)\n    with suma_minion salt pillar extension module (bsc#1205255)\n\nsusemanager-sync-data:\n\n- Version 4.3.12-1\n  * change OES 2023 URL to https and make the tools channels mandatory\n    (bsc#1205644)\n  * remove version from product names as they are held separate\n\nsusemanager-tftpsync:\n\n- Version 4.3.3-1\n  * Introduce threadpool for tftpsync to increase performance\n    while syncing files to proxies (bsc#1205489)\n\nuyuni-common-libs:\n\n- Version 4.3.7-1\n  * unify user notification code on java side\n\nuyuni-setup-reportdb:\n\n- Version 4.3.6-1\n  * Fix password generation in uyuni-setup-reportdb (bsc#1205919)\n\nvirtual-host-gatherer:\n\n- Version 1.0.24-1\n  * Report total memory of a libvirt hypervisor\n  * Improve interoperability with other Python projects\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager Server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2023-02-10T14:06:32Z","modified":"2026-02-04T03:28:57.048981Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0373-1","title":"Security update for SUSE Manager Server 4.3","description":"\nThis update fixes the following issues:\n\nrelease-notes-susemanager:\n\n- Update to SUSE Manager 4.3.4\n  * SUSE Liberty Linux 9 support as client\n  * SUSE Linux Enterprise Micro support as client\n  * Indications for systems requiring reboot or with a scheduled reboot\n  * Notification messages via email\n  * Grafana update to 8.5.15\n  * Subscription warning notification\n  * Changelogs at repositories metadata has been limited the last 20 entries\n  * Drop legacy way to prevent disabling local repositories\n  * CVEs fixed\n    CVE-2022-1415\n  * Bugs mentioned\n    bsc#1172110, bsc#1195979, bsc#1200801, bsc#1202150, bsc#1203478 \n    bsc#1203532, bsc#1203826, bsc#1204032, bsc#1204126, bsc#1204186\n    bsc#1204235, bsc#1204270, bsc#1204330, bsc#1204712, bsc#1204715\n    bsc#1204879, bsc#1204932, bsc#1205012, bsc#1205040, bsc#1205207\n    bsc#1205255, bsc#1205350, bsc#1205489, bsc#1205523, bsc#1205644\n    bsc#1205663, bsc#1205749, bsc#1205754, bsc#1205890, bsc#1205919\n    bsc#1205943, bsc#1206055, bsc#1206160, bsc#1206168, bsc#1206186\n    bsc#1206249, bsc#1206276, bsc#1206294, bsc#1206336, bsc#1206375\n    bsc#1206470, bsc#1206613, bsc#1206666, bsc#1206799, bsc#1207136\n\n","status":"published","published":"2023-02-10T14:19:35Z","modified":"2026-02-04T03:31:59.045996Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0592-1","title":"Security update for SUSE Manager Server 4.2","description":"This update fixes the following issues:\n\ncobbler:\n\n- Fix improper authorization (bsc#1197027, CVE-2022-0860)\n- Prevent error when starting up logrotate.service (bsc#1188191)\n\ndrools:\n\n- Deserialization of Untrusted Data: unsafe data deserialization\n  in DroolsStreamUtils.java (bsc#1204879, CVE-2022-1415)\n\ngrafana-formula:\n\n- Version 0.8.1\n  * Fix Uyuni/SUMA dashboard names\n- Version 0.8.0\n  * Set dashboard names depending on project\n  * Update dashboards to use new JSON schema\n  * Fix PostgreSQL dashboard queries\n  * Migrate deprecated panels to their current replacements\n- Version 0.7.1\n  * Fix default password field description (bsc#1203698)\n  * Do not require default admin and password fields\n\ninter-server-sync:\n\n- Version 0.2.7\n  * Do not update pillars table if it does not exists like in 4.2\n- Version 0.2.6\n  * Export package extra tags for complete debian repo metatdata (bsc#1206375)\n  * Replace URLs in OS Images pillars when exporting and importing images\n- Version 0.2.5 \n  * Correct error when importing without debug log level (bsc#1204699)\n\nmgr-osad:\n\n- Version 4.2.9-1\n  * Updated logrotate configuration (bsc#1206470)\n\nprometheus-formula:\n\n- Version 0.7.0\n  * Switch from basic authentication to TLS certificate client\n    authentication for Blackbox exporter\n  * Fix scheme label in clients targets configration\n  * Add README.md\n\npy27-compat-salt:\n\n- Ignore extend declarations from excluded SLS files (bsc#1203886)\n- Enhance capture of error messages for Zypper calls in zypperpkg module\n\nrhnlib:\n\n- Version 4.2.7-1\n  * Don't get stuck at the end of SSL transfers (bsc#1204032)\n\nsaltboot-formula:\n\n- Update to version 0.1.1676908681.e90e0b1\n  * Add failsafe stop file when salt-minion does not stop (bsc#1208418)\n  * Support salt bundle (bsc#1208499)\n\nsalt-netapi-client:\n\n- Version 0.21.0\n  * See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.21.0\n- Add transactional_update module\n- Improve logging when creating salt exception\n\nsmdba:\n\n- Version 1.7.11\n  * fix config update from wal_keep_segments to wal_keep_size for\n    newer postgresql versions (bsc#1204519)\n\nspacecmd:\n\n- Version 4.2.21-1\n  * Prevent string api parameters to be parsed as dates if not in\n    ISO-8601 format (bsc#1205759)\n  * Add python-dateutil dependency, required to process date values in\n    spacecmd api calls\n  * Correctly understand 'ssm' keyword on scap scheduling\n  * Fix dict_keys not supporting indexing in systems_setconfigchannelorger\n\nspacewalk-admin:\n\n- Version 4.2.13-1\n  * Generate uyuni_roster.conf with salt-secrets-config (bsc#1200096)\n\nspacewalk-backend:\n\n- Version 4.2.26-1\n  * Fix reposync error about missing 'content-type' key when syncing certain channels\n  * Compute headers as list of two-tuples to be used by url grabber (bsc#1205523)\n  * Updated logrotate configuration (bsc#1206470)\n  * Add 'octet-stream' to accepted content-types for reposync mirrorlists\n  * Exclude invalid mirror urls for reposync (bsc#1203826)\n  * do not fetch mirrorlist when a file url is given\n  * Keep older module metadata files in database (bsc#1201893)\n  * Removed the activation keys report from the debug information\n\nspacewalk-certs-tools:\n\n- Version 4.2.19-1\n  * some i18n functions moved to new module which needs to be loaded\n    (bsc#1201142)\n  * Generated bootstrap scripts installs all needed Salt 3004 dependencies\n    for Ubuntu 18.04 (bsc#1204517)\n\nspacewalk-client-tools:\n\n- Version 4.2.22-1\n  * Update translation strings\n\nspacewalk-java:\n\n- Version 4.2.47-1\n  * Use uyuni roster salt module instead of flat roster files (bsc#1200096)\n- Version 4.2.46-1\n  * Fix registration with proxy and tunnel SSH (bsc#1200096)\n- Version 4.2.45-1\n  * Add 'none' matcher to CLM AppStream filters (bsc#1206817)\n  * Improve logs when sls action chain file is missing\n  * Do not forward ssh command if proxy and tunnel are present (bsc#1200096)\n  * Fix not being able to delete CLM environment if there are custom child\n    channels that where not built by the environment (bsc#1206932)\n  * Include missing 'gpg' states to avoid issues on SSH minions.\n  * Optimize the number of salt calls on minion startup (bsc#1203532)\n  * Fix CVE Audit ignoring errata in parent channels if patch in successor\n    product exists (bsc#1206168)\n  * Fix CVE Audit incorrectly displaying predecessor product (bsc#1205663)\n  * Fix modular channel check during system update via XMLRPC (bsc#1206613)\n  * Trigger a package profile update when a new live-patch is installed (bsc#1206249)\n  * prevent ISE on activation key page when selected base channel value is null\n  * Only remove product catalog if PAYG ssh credentials are defined (bsc#1205943)\n  * Updated logrotate configuration (bsc#1206470)\n  * Limit changelog data in generated metadata to 20 entries\n  * Fix CLM to not remove necessary packages when filtering erratas (bsc#1195979)\n  * check for NULL in DEB package install size value\n  * Allowed cancelling pending actions with a failed prerequisite (bsc#1204712)\n  * disable cloned vendor channel auto selection by default (bsc#1204186)\n  * adapt permissions of temporary ssh key directory\n  * format results for package, errata and image build actions in\n    system history similar to state apply results\n  * Fix ClassCastException\n  * Run only minion actions that are in the pending status (bsc#1205012)\n  * Manager reboot in transactional update action chain (bsc#1201476\n  * Optimize performance of config channels operations for UI and API (bsc#1204029)\n  * Don't add the same channel twice in the System config addChannel API (bsc#1204029)\n  * fix xmlrpc call randomly failing with translation error (bsc#1203633)\n  * Optimize action chain processing on job return event (bsc#1203532)\n  * Re-calculate salt event queue numbers on restart\n  * Fix out of memory error when building a CLM project (bsc#1202217)\n  * Process salt events in FIFO order (bsc#1203532)\n  * Remove 'SSM' column text where not applicable (bsc#1203588)\n  * Fix rendering of ssm/MigrateSystems page (bsc#1204651)\n  * Pass mgr_sudo_user pillar on salt ssh client cleanup (bsc#1202093)\n  * Deny packages from older module metadata when building CLM projects (bsc#1201893)\n  * Refresh pillar data for the assigned systems when a CLM channel is built (bsc#1200169)\n  * delay hardware refresh action to avoid missing channels (bsc#1204208)\n  * During re-activation, recalculate grains if\n  * Remove unused gson-extras.jar during build\n\nspacewalk-search:\n\n- Version 4.2.9-1\n  * Updated logrotate configuration (bsc#1206470)\n\nspacewalk-web:\n\n- Version 4.2.32-1\n  * Add 'none' matcher to CLM AppStream filters (bsc#1206817)\n  * fix frontend logging in react pages\n  * Add bugzilla references to past security fixes\n    * shell-quote fix CVE-2021-42740 (bsc#1203287)\n    * moment fix CVE-2022-31129 (bsc#1203288)\n\nsupportutils-plugin-susemanager:\n\n- Version 4.2.5-1\n  * Added dependency for XML Simple\n  * update susemanager plugin to export the number of pending salt events\n\nsusemanager:\n\n- Version 4.2.40-1\n  * Add mgr-salt-ssh wrapper to use with uyuni roster Salt module (bsc#1200096)\n- Version 4.2.39-1\n  * fix bootstrap repo path for SLES for SAP 12 (bsc#1207141)\n  * make venv-salt-minion optional for SUSE Manager Proxy 4.2\n    bootstrap repository (bsc#1206933)\n  * show RHEL target for bootstrap repo creation only if it is\n    really connected to the CDN (bsc#1206861)\n  * add python3-extras to bootstrap repo as dependency of\n    python3-libxml2, optional SLES 15 does not have it and it\n    is only required on SP4 or greater (bsc#1204437) \n\nsusemanager-build-keys:\n\n- Version 15.3.6\n  * Add rpmlintrc configuration, so 'W: backup-file-in-package' for\n    the keyring is ignored. We do not ship backup files, but we own them\n    because they are created each time gpg is called, and we want them\n    removed if the package is removed\n  - uyuni-build-keys.rpmlintrc\n\nsusemanager-doc-indexes:\n\n- Include RHEL7 in Salt 3000 to Salt Bundle migration section of the\n  Client Configuration Guide\n- Update Salt Bundle guide as Salt Bundle is now the default\n  registration method\n- Re-added statement about Cobbler support in Reference Guide and Client\n  Configuration Guide (bsc#1206963)\n- Added information about java.salt_event_thread_pool_size in Large\n  Deployments Guide\n- Added information about GPG key usage in the Debian section of the\n- Updated default number of changelog entries in Administration Guide\n- Include migration guide from Salt 3000 to Bundle for SUSE Linux \n  Enterprise 12 and CentOS7 in Troubleshooting Clients\n- Removed mentions to ABRT in Reference Guide\n- Extended note about using Salt SSH with Salt Bundle in 4.2\n- Fixed Liberty Linux client tools label in Client Configuration\n  Guide\n\nsusemanager-docs_en:\n\n- Include RHEL7 in Salt 3000 to Salt Bundle migration section of the \n  Client Configuration Guide\n- Update Salt Bundle guide as Salt Bundle is now the default \n  registration method\n- Re-added statement about Cobbler support in Reference Guide and Client\n  Configuration Guide (bsc#1206963)\n- Added information about java.salt_event_thread_pool_size in Large\n  Deployments Guide\n- Added information about GPG key usage in the Debian section of the \n- Updated default number of changelog entries in Administration Guide\n- Include migration guide from Salt 3000 to Bundle for SUSE Linux \n  Enterprise 12 and CentOS7 in Troubleshooting Clients.\n- Removed mentions to ABRT in Reference Guide\n- Extended note about using Salt SSH with Salt Bundle in 4.2\n- Fixed Liberty Linux client tools label in Client Configuration \n  Guide\n\nsusemanager-schema:\n\n- Version 4.2.27-1\n  * Add created and modified fields to suseMinionInfo to make uyuni roster module cache validation more \n    accurate (bsc#1200096)\n- Version 4.2.26-1\n  * Add 'none' matcher to CLM AppStream filters (bsc#1206817)\n  * Increase cron_expr varchar length to 120 in suseRecurringAction\n    table (bsc#1205040)\n  * Keep older module metadata files in database (bsc#1201893)\n  * Fix setting of last modified date in channel clone procedure\n\nsusemanager-sls:\n\n- Version 4.2.30-1\n  * Flush uyuni roster cache if the config has changed\n  * Implement uyuni roster module for Salt (bsc#1200096)\n- Version 4.2.30-1\n  * Fix dnf plugin path calculation when using Salt Bundle (bsc#1208335)\n- Version 4.2.29-1\n  * Improve _mgractionchains.conf logs\n  * Prevent possible errors from 'mgractionschains' module when there is no action chain to resume.\n  * Fix mgrnet custom module to be compatible with old Python 2.6 (bsc#1206979) (bsc#1206981)\n  * Fix custom 'mgrcompat.module_run' state module to work with Salt 3005.1\n  * filter out libvirt engine events (bsc#1206146)\n  * Optimize the number of salt calls on minion startup (bsc#1203532)\n  * Updated logrotate configuration (bsc#1206470)\n  * Make libvirt-events.conf path depend on what minion is used (bsc#1205920)\n  * Fix kiwi inspect regexp to allow image names with '-' (bsc#1204541)\n  * Avoid installing recommended packages from assigned products (bsc#1204330)\n  * Manager reboot in transactional update action chain (bsc#1201476)\n  * Use the actual sudo user home directory for salt ssh\n    clients on bootstrap and clean up (bsc#1202093)\n  * Perform refresh with packages.pkgupdate state (bsc#1203884)\n\nuyuni-common-libs:\n\n- Version 4.2.9-1\n  * Fix crash due missing 'context_manager' when running salt-secrets-config service (bsc#1200096)\n- Version 4.2.8-1\n  * some i18n functions moved to new module which needs to be loaded\n    (bsc#1201142)\n\nvirtual-host-gatherer:\n\n- Version 1.0.24-1\n  * Report total memory of a libvirt hypervisor\n  * Improve interoperability with other Python projects\n\nwoodstox:\n\n- CVE-2022-40152: Fixed stack overflow in XML serialization. (bsc#1203521)\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager Server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2023-03-02T08:32:44Z","modified":"2026-02-04T03:49:58.422418Z","updated_at":"2026-11-02T15:53:51.853735Z"}]}}