What is GHSA-67f6-c8mx-4q2m?

GHSA-67f6-c8mx-4q2m is a security advisory published by GitHub Security Advisories with Medium severity. Uncontrolled Resource Consumption in JPA Server in HAPI FHIR

Which CVE IDs does GHSA-67f6-c8mx-4q2m cover?

GHSA-67f6-c8mx-4q2m covers the following CVE IDs: CVE-2021-32053. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-67f6-c8mx-4q2m?

GHSA-67f6-c8mx-4q2m has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-67f6-c8mx-4q2m?

GHSA-67f6-c8mx-4q2m affects 1 product, including: maven/ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base:\u003c 5.4.0.

GHSA-67f6-c8mx-4q2mMediumCVSS 5.3

Uncontrolled Resource Consumption in JPA Server in HAPI FHIR

Vendor

GitHub Security Advisories

Published

June 16, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-32053 →

📋 Description

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.

🎯 Affected products1

maven/ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base:< 5.4.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-32053
https://github.com/hapifhir/hapi-fhir/issues/2641
https://github.com/hapifhir/hapi-fhir/pull/2642
https://hapifhir.io
https://github.com/advisories/GHSA-67f6-c8mx-4q2m