GHSA-c82x-f4xr-qv33 epa4all-client: Unauthenticated REST API for Patient Record Writes

• Maven com.oviva.telematik:epa4all-rest-service: <= 1.2.4 (no fix yet)

Impact Any network-reachable caller can write arbitrary documents to any patient's electronic health record accessible by the institution's SMC-B card. In a misconfigured deployment (e.g., following the production Docker example in the README), this is exploitable from the local network without credentials. Patches • #43 Workarounds Use network policies or proxies to enforce service-to-service authentication via e.g. mTLS. • run the service in an isolated network namespace e.g. as Kubernetes sidecar • service-mesh with corresponding policies References • MS-OVIVA-EPA4ALL-8b2af7 Credits Machine Spirits ([email protected]) • Dr. rer. nat. Simon Weber • Dipl.-Inf. Volker Schönefeld • Chiara Fliegner