CVE-2021-32053: Medium severity hapi fhir vulnerability
JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32053?
CVE-2021-32053 is considered a medium severity vulnerability due to its potential for denial of service.
How do I fix CVE-2021-32053?
To fix CVE-2021-32053, upgrade to HAPI FHIR version 5.4.0 or later.
What kind of attacks can be performed exploiting CVE-2021-32053?
Exploiting CVE-2021-32053 allows an attacker to execute history requests that may result in a denial of service condition.
What versions of HAPI FHIR are affected by CVE-2021-32053?
HAPI FHIR versions prior to 5.4.0 are affected by CVE-2021-32053.
Is CVE-2021-32053 an issue related to database access?
Yes, CVE-2021-32053 can disable access to the database as part of the denial of service impact.