HL7/fhir-ig-publisher

HL7/fhir-ig-publisher

Releases346

Frequency6 days 5 hours

Last Release about 1 month ago

Stars100

Source code for the IG publisher

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2024-45294 ↗	Sep 6, 2024Friday, 6 September 2024, 16:15	8.6 HIGH	—
The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available.
CVE-2023-24057 ↗	Jan 26, 2023Thursday, 26 January 2023, 21:18	8.1 HIGH	—
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).