GHSA-6qx9-rf9g-7jmr

Improper Input Validation in Drools and jBPM

Source: GitHub Advisory Database (reviewed) High CVE-2014-8125

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.drools:drools-core	< 6.2.0.Final	6.2.0.Final
Maven	org.jbpm:jbpm-bpmn2	< 6.2.0.Final	6.2.0.Final

Details

As written in the advisory (Markdown source, shown as plain text).

XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-8125 advisory
https://github.com/droolsjbpm/drools/commit/c48464c3b246e6ef0d4cd0dbf67e83ccd532c6d3 web
https://github.com/droolsjbpm/jbpm/commit/713e8073ecf45623cfc5c918c5cbf700203f46e5 web
https://bugzilla.redhat.com/show_bug.cgi?id=1169553 web
http://rhn.redhat.com/errata/RHSA-2015-0850.html web
http://rhn.redhat.com/errata/RHSA-2015-0851.html web