GitHub Advisoryadvisory · Maven

GHSA-6cr6-ph3p-f5rf XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`

HIGH Published 2024-09-06 Modified 2024-09-06 Official page ↗
Aliases
CVE-2024-45294
Ecosystem
Maven
Packages
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may, ca.uhn.hapi.fhir:org.hl7.fhir.dstu3, ca.uhn.hapi.fhir:org.hl7.fhir.r4, ca.uhn.hapi.fhir:org.hl7.fhir.r4b, ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.utilities
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2024-09-06

Affected packages

• Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may: < 6.3.23 → fixed in 6.3.23 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu3: < 6.3.23 → fixed in 6.3.23 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.r4: < 6.3.23 → fixed in 6.3.23 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.r4b: < 6.3.23 → fixed in 6.3.23 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.r5: < 6.3.23 → fixed in 6.3.23 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities: < 6.3.23 → fixed in 6.3.23

Description

Impact XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( ` ]>` could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. Patches This issue has been patched in release 6.3.23 Workarounds None. References MITRE CWE OWASP XML External Entity Prevention Cheat Sheet

Related

Alias · CVE (1)

  • CVE-2024-45294 The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References