Description
The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. This vulnerability is fixed in 2.1.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| datasharingframework | dsf | < 2.1.0 | — |
| dev.dsf | dsf-bpe-server | < 2.1.0 | — |
| dev.dsf | dsf-common-jetty | < 2.1.0 | — |
| dev.dsf | dsf-fhir-server | < 2.1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | dev.dsf:dsf-bpe-server | all versions | — | GHSA-gj7p-595x-qwf5 |
| Maven | dev.dsf:dsf-common-jetty | all versions | — | GHSA-gj7p-595x-qwf5 |
| Maven | dev.dsf:dsf-fhir-server | all versions | — | GHSA-gj7p-595x-qwf5 |