REDHAT-BUG-2324794: High severity Hapi HAPI FHIR vulnerability
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 & #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HAPI FHIR (org.hl7.fhir.core)to a version that resolves this vulnerability.Fixed in 6.4.0 - Compensating control
Since there are no known workarounds and external clients can submit XML, restrict access so untrusted external clients cannot submit XML that will be processed by XSLT/XML parsers used by the components performing XSLT parsing (including cases where org.hl7.fhir.core is used).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2324794?
The severity of REDHAT-BUG-2324794 is high, rated at 7.
What is the vulnerability described in REDHAT-BUG-2324794?
REDHAT-BUG-2324794 identifies an XML external entity injection vulnerability in HAPI FHIR due to insecure XSLT parsing.
How can I fix REDHAT-BUG-2324794?
To fix REDHAT-BUG-2324794, update HAPI FHIR to the latest version that addresses this XML external entity injection vulnerability.
Who is affected by REDHAT-BUG-2324794?
Users of HAPI FHIR, particularly those implementing HL7 FHIR standards, are affected by REDHAT-BUG-2324794.
When was REDHAT-BUG-2324794 published?
REDHAT-BUG-2324794 was published on November 8, 2024.