GHSA-6cr6-ph3p-f5rfHighCVSS 8.6

XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`

Published
September 6, 2024
Last Modified
September 7, 2024

🔗 CVE IDs covered (1)

CVE-2024-45294 →

📋 Description

Impact

XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML.

Patches

This issue has been patched in release 6.3.23

Workarounds

None.

References

MITRE CWE OWASP XML External Entity Prevention Cheat Sheet

🎯 Affected products6

  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may:< 6.3.23
  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu3:< 6.3.23
  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.r4:< 6.3.23
  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.r4b:< 6.3.23
  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.r5:< 6.3.23
  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.utilities:< 6.3.23

🔗 References (6)