Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kiegroup/drools

              main @ 57321fa
            

Fixes

CVEs

CRITICAL

Peak severity

52.6%

Coverage

Highlights

XXE: 4 prior fixes. Scrutinize any change in this area.

build-parent/pom.xml: most-fixed (2 issues). Treat as high-risk during review.

17 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Deserialization: Two critical fixes show deserialization of untrusted data without class filtering, enabling RCE. XStream had permissive wildcard permissions; protobuf session used raw ObjectInputStream.

Code Injection / Code Execution: Multiple MVEL eval sinks across rule expressions, accumulate functions, and test scenarios were patched with MVELSafeHelper wrappers or safe expression variants. Asymmetry in enforcement across these paths is a likely source of future bugs.

XXE: Four fixes across distinct XML parsers/validators disabled external DTD/schema/entity access. Each parser was independently vulnerable, suggesting inconsistent hardening across XML processing entry points.