crítica
CVE-2024-51132
org.hl7.fhir.convertors: org.hl7.fhir.dstu2: org.hl7.fhir.dstu2016may: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r5: org.hl7.fhir.utilities: org.hl7.fhir.validation: org.hl7.fhir.core: FHIR arbitrary code execution via specially-crafted request
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
GHSA8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Red Hat9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según Red Hat. Más baja según GHSA (alta).
Descripción
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may y 6 más | 6.4.0 |
Mostrar las 9 entradas de 1 fuente
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.convertors | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4 | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4b | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r5 | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.utilities | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.validation | 6.4.0 |
Referencias
- https://access.redhat.com/security/cve/CVE-2024-51132
- https://docs.redhat.com/en/documentation/red_hat_build_of_apache_camel_k/1.10.8/html/release_notes_for_red_hat_build_of_apache_camel_k/camel-k-relnotes_camelk#supported_camel_quarkus_connector_extensions
- https://github.com/JAckLosingHeart/CVE-2024-51132-POC
- https://github.com/advisories/GHSA-4cf2-cxp3-rjr7
- https://github.com/hapifhir/org.hl7.fhir.core
- https://github.com/hapifhir/org.hl7.fhir.core/commit/7ede053a5fca50cc2802884c661a241d51703a67
- https://nvd.nist.gov/vuln/detail/CVE-2024-51132
- https://www.cve.org/CVERecord?id=CVE-2024-51132