com.oviva.telematik:epa4all-client 1.2.0

Direct Vulnerabilities

Known vulnerabilities in the com.oviva.telematik:epa4all-client package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improper Certificate Validation Affected versions of this package are vulnerable to Improper Certificate Validation due to disabled TLS certificate validation in production environments. An attacker can intercept sensitive SOAP traffic, including patient identifiers, authentication operations, document content, and credential exchanges by presenting an arbitrary TLS certificate on the network path between the service and its backend. How to fix Improper Certificate Validation? Upgrade `com.oviva.telematik:epa4all-client` to version 1.2.2 or higher.	[,1.2.2)
C Improper Verification of Cryptographic Signature Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the discovery document retrieval process via `uri_puk_idp_enc` and `uri_puk_idp_sig` properties. An attacker can intercept and modify the TLS connection to substitute a forged discovery document, redirecting public key URLs to attacker-controlled endpoints. This allows the attacker to capture signed authentication material by tricking the client into encrypting sensitive data with the attacker's key and sending it to the attacker's endpoint. How to fix Improper Verification of Cryptographic Signature? Upgrade `com.oviva.telematik:epa4all-client` to version 1.2.2 or higher.	[,1.2.2)

Vulnerability

Vulnerable Version

Improper Certificate Validation

Affected versions of this package are vulnerable to Improper Certificate Validation due to disabled TLS certificate validation in production environments. An attacker can intercept sensitive SOAP traffic, including patient identifiers, authentication operations, document content, and credential exchanges by presenting an arbitrary TLS certificate on the network path between the service and its backend.

How to fix Improper Certificate Validation?

Upgrade com.oviva.telematik:epa4all-client to version 1.2.2 or higher.

[,1.2.2)

Improper Verification of Cryptographic Signature

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the discovery document retrieval process via uri_puk_idp_enc and uri_puk_idp_sig properties. An attacker can intercept and modify the TLS connection to substitute a forged discovery document, redirecting public key URLs to attacker-controlled endpoints. This allows the attacker to capture signed authentication material by tricking the client into encrypting sensitive data with the attacker's key and sending it to the attacker's endpoint.

How to fix Improper Verification of Cryptographic Signature?

Upgrade com.oviva.telematik:epa4all-client to version 1.2.2 or higher.

[,1.2.2)

com.oviva.telematik:epa4all-client@1.2.0

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically