A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

Affected: Maven: org.drools:drools-core

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

chart.js: prototype pollution jackson-databind: denial of service via a large depth of nested objects immer: type confusion vulnerability can lead to a bypass of CVE-2020-28477 minimist: prototype pollution node-fetch: exposure of sensitive information to an unauthorized actor parse-url: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor drools: unsafe data deserialization in StreamUtils eventsource: Exposure of Sensitive Information Business-central: Possible XML External Entity Injection attack mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors jdbc-postgresql: Unchecked Class Instantiation when providing Plugin Classes xerces-j2: infinite loop when handling specially crafted XML document payloads artemis-commons: Apache ActiveMQ Artemis DoS node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery Moment.js: Path traversal in moment.locale postgresql-jdbc: Arbitrary File Write Vulnerability moment: inefficient parsing algorithm resulting in DoS

Security update for SUSE Manager Server 4.3