Apache Camel for Spring Boot: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Critical 9.8
  CVE-2024-51132 Public exploit

  HAPI FHIR XML External Entity (XXE) vulnerability

  An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.

  ca.uhn.hapi.fhir:org.hl7.fhir.r5 ca.uhn.hapi.fhir:org.hl7.fhir.validation ca.uhn.hapi.fhir:org.hl7.fhir.r4b ca.uhn.hapi.fhir:org.hl7.fhir.utilities Maven
  Nov 5, 2024
• High 8.6
  CVE-2024-52007

  XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

  HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE f…

  hapifhir org.hl7.fhir.core ca.uhn.hapi.fhir:org.hl7.fhir.r5 ca.uhn.hapi.fhir:org.hl7.fhir.utilities Maven
  Nov 8, 2024

Revision history

1. 2024-11-19 #2

   Neue Updates von Red Hat aufgenommen

2. 2024-11-17 #1

   Initiale Fassung

References

• Red Hat Security Advisory vom 2024-11-17
  https://access.redhat.com/errata/RHSA-2024:9806
• Proof of Concept (PoC) CVE-2024-51132
  https://github.com/JAckLosingHeart/CVE-2024-51132-POC
• Red Hat Security Advisory RHSA-2024:10035 vom 2024-11-19
  https://access.redhat.com/errata/RHSA-2024:10035