Description
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.convertors | < 5.6.92 | 5.6.92 | GHSA-jqh6-9574-5x22 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.core | < 5.6.92 | 5.6.92 | GHSA-jqh6-9574-5x22 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4b | < 5.6.92 | 5.6.92 | GHSA-jqh6-9574-5x22 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r5 | < 5.6.92 | 5.6.92 | GHSA-jqh6-9574-5x22 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.utilities | < 5.6.92 | 5.6.92 | GHSA-jqh6-9574-5x22 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.validation | < 5.6.92 | 5.6.92 | GHSA-jqh6-9574-5x22 |
| Maven | org.hl7.fhir.publisher:org.hl7.fhir.publisher | < 1.2.30 | 1.2.30 | GHSA-xr8x-pxm6-prjg |