CVE-2024-55887
Ucum-java has an XXE vulnerability in XML parsing
Impact
### Impact XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML. ### Patches Release 1.0.9 of ucum fixes this vulnerability ### Workarounds Ensure that the source xml for instantiating UcumEssenceService is trusted. ### References * https://cwe.mitre.org/data/definitions/611.html * https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.fhir:ucum | < 1.0.9 | 1.0.9 |
Affected products
| Product | Affected versions |
|---|---|
| Versions | before 1.0.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.