Vulnerability · Published Sep 6, 2024 · Assigned by GitHub_M
CVE-2024-45294`org.hl7.fhir.core` XXE vulnerability in XSLT transforms
High 8.6
In plain English
A high-severity XML external entity in org.hl7.fhir.core from hapifhir. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may | 6.3.23 | GHSA-6cr6-ph3p-f5rf |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 | 6.3.23 | GHSA-6cr6-ph3p-f5rf |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4 | 6.3.23 | GHSA-6cr6-ph3p-f5rf |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4b | 6.3.23 | GHSA-6cr6-ph3p-f5rf |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r5 | 6.3.23 | GHSA-6cr6-ph3p-f5rf |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.utilities | 6.3.23 | GHSA-6cr6-ph3p-f5rf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hapifhir | org.hl7.fhir.core | < 6.3.23 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf x_refsource_CONFIRM
- https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5 x_refsource_MISC
- https://github.com/HL7/fhir-ig-publisher/releases/tag/1.6.22 x_refsource_MISC
- https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23 x_refsource_MISC