Improper Handling of Highly Compressed Data (Data Amplification)Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the inflate() payload processing path. An attacker can exhaust memory or trigger severe garbage-collection pressure by supplying a Smart Health Card JWT with a zip":"DEF" header and a small compressed payload that expands to a very large byte array. The vulnerable code inflates attacker-controlled payload data into memory before JSON parsing, with no decompressed-size limit. In validator services or applications that accept untrusted SHC content, this can lead to request failure, process instability, or OutOfMemoryError and denial of service.
How to fix Improper Handling of Highly Compressed Data (Data Amplification)? Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.9.11 or higher.
| |
Infinite loopAffected versions of this package are vulnerable to Infinite loop via the inflate process in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java. An attacker can pin a JVM worker thread indefinitely by supplying a malformed Smart Health Card JWT with zip:"DEF" and an empty or truncated DEFLATE payload. When SHCParser.inflate() processes that input, it loops on Inflater.finished() without making progress, so validation never returns. Services that accept SHC content for validation or SHC-looking input for file detection can be tied up by a small number of crafted requests.
How to fix Infinite loop? Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.9.11 or higher.
| |
Regular Expression Denial of Service (ReDoS)Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions that trigger excessive backtracking during regex processing.
How to fix Regular Expression Denial of Service (ReDoS)? Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.9.4.2, 6.9.9 or higher.
| |
Regular Expression Denial of Service (ReDoS)Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the matches(), matchesFull(), and replaceMatches() functions in the FHIRPathEngine. An attacker can exhaust system resources and cause service disruption by submitting specially crafted regular expressions that trigger excessive backtracking during evaluation.
How to fix Regular Expression Denial of Service (ReDoS)? Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.9.7 or higher.
| |
XML External Entity (XXE) InjectionAffected versions of this package are vulnerable to XML External Entity (XXE) Injection via XSLT transforms. An attacker can access sensitive information from the host system by processing an XML file with a malicious DTD tag ( ]>. All cases where org.hl7.fhir.core is being used on a host where external clients can submit XML are impacted.
Note: This is due to an incomplete fix of CVE-2024-45294.
How to fix XML External Entity (XXE) Injection? Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.4.0 or higher.
| |
XML External Entity (XXE) InjectionAffected versions of this package are vulnerable to XML External Entity (XXE) Injection due to allowing external DOCTYPE elements in the DocumentBuilderFactory class.
How to fix XML External Entity (XXE) Injection? Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.4.0 or higher.
| |
XML External Entity (XXE) InjectionAffected versions of this package are vulnerable to XML External Entity (XXE) Injection via XSLT transforms. An attacker can access sensitive information from the host system by processing an XML file with a malicious DTD tag. All cases where org.hl7.fhir.core is being used on a host where external clients can submit XML are impacted.
How to fix XML External Entity (XXE) Injection? Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.3.21 or higher.
| |
Arbitrary File Write via Archive Extraction (Zip Slip)Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) this is due to a bypass of CVE-2023-24057.
This issue allows a malicious actor to potentially break out of the TerminologyCacheManager cache directory. The impact is limited to sibling directories.
For example, consider "/usr/outnot".startsWith("/usr/out"). The check is bypassed although /outnot is not under the /out directory.
How to fix Arbitrary File Write via Archive Extraction (Zip Slip)? Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 5.6.106 or higher.
| |
