Directory traversal

The package-decompression feature in HL7 Health Level 7 FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. NOTE: this issue exists...

Path Traversal

org.hl7.fhir.r4b is vulnerable to Path Traversal. The vulnerability exists in the unzip function of TerminologyCacheManager.java, which allows an attacker to access files outside the expected directory bypassing the zip slip protection implemented in the CVE-2023-24057...

HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057

Impact Zip Slip protections implemented in CVE-2023-24057 GHSA-jqh6-9574-5x22 can be bypassed due a partial path traversal vulnerability. This issue allows a malicious actor to potentially break out of the TerminologyCacheManager cache directory. The impact is limited to sibling directories. To...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.0.0, <=6.4.1), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.6.5, <=6.4.1) +131 more potentially affected by CVE-2023-24057 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (>=5.0.0, <=5.6.105)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version =5.0.0, =5.0.0, =5.6.5, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.3.0, =6.2.0, =5.1.0, =5.3.0, =5.0.0, =5.0.0, =6.4.1 and more Source cves: CVE-2023-24057, CVE-2023-28465 Source advisory: GHSA-9654-PR4F-GH6M...

io.connectedhealth-idaas:idaas-eventbuilder (2.3.0) potentially affected by CVE-2023-24057 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.core (5.1.7)

ca.uhn.hapi.fhir:org.hl7.fhir.core MAVEN version 5.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.core and may be impacted: - io.connectedhealth-idaas:idaas-eventbuilder 2.3.0 Source cves: CVE-2023-24057, CVE-2023-284...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.0.0, <=6.4.1), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.6.5, <=6.4.1) +154 more potentially affected by CVE-2023-24057 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (>=5.0.0, <=5.6.105)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version =5.0.0, =5.0.0, =5.6.5, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.3.0, =6.2.0, =5.1.0, =5.3.0, =5.0.0, =5.0.0, =6.4.1 and more Source cves: CVE-2023-24057, CVE-2023-28465 Source advisory: GHSA-9654-PR4F-GH6M...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.7.0, <=6.2.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.7.7, <=6.2.5) +110 more potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (>=5.6.22, <=5.6.91)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version =5.6.22, =5.7.0, =5.7.7, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =6.2.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.7, =5.7.0, =5.7.0, =6.2.5 and more Source cves: CVE-2023-24057 Source advisory: MEND:CVE-2023-24057...

CVE-2023-24057

HL7 Health Level 7 FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive for a prepackaged terminology cache, NPM package, or comparison archive...

CVE-2023-24057

HL7 FHIR Core Libraries are affected by a directory-traversal issue in package-decompression. Affected: versions prior to 5.6.106 (per PT-2023-21736); earlier notes reference 5.6.92. Root cause: extraction of archives (ZIP/TGZ) can write files to arbitrary directories. Mitigation: upgrade to 5.6....

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (4.0.1), ca.uhn.hapi.fhir:org.hl7.fhir.validation (4.0.1) +1 more potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (4.0.1)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 4.0.1 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 4.0.1...

ca.uhn.hapi.fhir:org.hl7.fhir.report (1.0.0) potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (1.0.0)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.report 1.0.0 Source cves: CVE-2023-24057 Source...

ca.uhn.hapi.fhir:org.hl7.fhir.validation (0.1.18) potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (0.1.18)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version 0.1.18 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.convertors and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.validation 0.1.18 Source cves: CVE-2023-24057...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (0.1.18), ca.uhn.hapi.fhir:org.hl7.fhir.validation (0.1.18) potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (0.1.18)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 0.1.18 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 0.1.18 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (1.1.67), ca.uhn.hapi.fhir:org.hl7.fhir.validation (1.1.67) potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (1.1.67)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 1.1.67 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 1.1.67 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (1.1.67), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (1.1.67) +5 more potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (1.1.67)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 1.1.67 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 1.1.67 -...

ca.uhn.hapi.fhir:org.hl7.fhir.validation (0.0.1) potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (0.0.1)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.convertors and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.validation 0.0.1 Source cves: CVE-2023-24057 Sour...

ca.uhn.hapi.fhir:org.hl7.fhir.validation (0.0.14) potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (0.0.14)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version 0.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.convertors and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.validation 0.0.14 Source cves: CVE-2023-24057...