Description
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CompuGroup Medical | Infantia | ≤ 1.3.0, ≤ 2.12.0 | — |
| CompuGroup Medical | Profim | ≤ 1.3.0, ≤ 2.12.0 | — |
| CompuGroup Medical | Venere | ≤ 1.3.0, ≤ 2.12.0 | — |
| CompuGroup Medical | Phronesis | ≤ 1.3.0, ≤ 2.12.0 | — |