GitHub Advisoryadvisory · Maven

GHSA-w9j7-phm3-f97j Ucum-java has an XXE vulnerability in XML parsing

HIGH Published 2024-12-13 Modified 2024-12-13 Official page ↗

Aliases: CVE-2024-55887
Ecosystem: Maven
Packages: org.fhir:ucum
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses: CWE-611
Reviewed: 2024-12-13

Affected packages

• Maven org.fhir:ucum: < 1.0.9 → fixed in 1.0.9

Description

Impact XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML. Patches Release 1.0.9 of ucum fixes this vulnerability Workarounds Ensure that the source xml for instantiating UcumEssenceService is trusted. References • https://cwe.mitre.org/data/definitions/611.html • https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j

Related

Alias · CVE (1)

CVE-2024-55887 Ucum-java is a FHIR Java library providing UCUM Services. vulnerability

Weakness · CWE (1)

CWE-611 Improper Restriction of XML External Entity Reference weakness

References