PT-2021-19643 · Hapi Fhir · Hapi Fhir

Zachary Minneker · Published 2021-05-10 · Updated 2021-06-16 · CVE-2021-32053

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: HAPI FHIR versions prior to 5.4.0

Description: The issue allows a user to deny service, for example, disable access to the database after the attack stops, via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.

Recommendations: For versions prior to 5.4.0, update to version 5.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to history requests to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-32053

GHSA-67F6-C8MX-4Q2M

Affected Products

Hapi Fhir

References · 7

• https://github.com/hapifhir/hapi-fhir/pull/2642 · Patch
• https://osv.dev/vulnerability/GHSA-67f6-c8mx-4q2m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32053 · Security Note
• https://hapifhir.io · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32053 · Vendor Advisory
• https://github.com/hapifhir/hapi-fhir/issues/2641 · Note
• https://t.me/cvenotify/14683 · Telegram Post