critique
CVE-2024-51132
org.hl7.fhir.convertors: org.hl7.fhir.dstu2: org.hl7.fhir.dstu2016may: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r5: org.hl7.fhir.utilities: org.hl7.fhir.validation: org.hl7.fhir.core: FHIR arbitrary code execution via specially-crafted request
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
GHSA8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Red Hat9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Le label propre à Trivy est CRITICAL. Critique selon Red Hat. Plus basse selon GHSA (élevée).
Description
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may et 6 autres | 6.4.0 |
Afficher les 9 entrées d'une source
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.convertors | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4 | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4b | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r5 | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.utilities | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.validation | 6.4.0 |
Références
- https://access.redhat.com/security/cve/CVE-2024-51132
- https://docs.redhat.com/en/documentation/red_hat_build_of_apache_camel_k/1.10.8/html/release_notes_for_red_hat_build_of_apache_camel_k/camel-k-relnotes_camelk#supported_camel_quarkus_connector_extensions
- https://github.com/JAckLosingHeart/CVE-2024-51132-POC
- https://github.com/advisories/GHSA-4cf2-cxp3-rjr7
- https://github.com/hapifhir/org.hl7.fhir.core
- https://github.com/hapifhir/org.hl7.fhir.core/commit/7ede053a5fca50cc2802884c661a241d51703a67
- https://nvd.nist.gov/vuln/detail/CVE-2024-51132
- https://www.cve.org/CVERecord?id=CVE-2024-51132