-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Backend: Version Bumping #43
Comments
12 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Issue Report
Backend: Dependency Version Bumping
Expected behavior
Versions are updated to mitigate known vulnerabilities. Let's enable dependabot after this to stay ahead of future dep issues.
Actual behavior
Dependencies
The following packages are out of date and have reported vulnerabilities:
maven:ca.uhn.hapi.fhir:org.hl7.fhir.validation:5.6.68,
maven:ca.uhn.hapi.fhir:org.hl7.fhir.utilities:5.6.76,
maven:ca.uhn.hapi.fhir:org.hl7.fhir.r5:5.6.68,
maven:ca.uhn.hapi.fhir:org.hl7.fhir.r4b:5.6.68
○ CVE-2023-24057
○ HL7 (Health Level 7) FHIR Core Libraries prior to 5.6.92 allow attackers to
extract files into arbitrary directories via directory traversal from a crafted ZIP or
TGZ archive (for a prepackaged terminology cache, NPM package, or
comparison archive).
○ CVE-2023-20883
○ In org.springframework.boot:spring-boot-autoconfigure versions through 2.5.14,
2.6.0 through 2.6.14, 2.7.0 through 2.7.11, and 3.0.0 through 3.0.6 and older
unsupported versions, there is potential for a denial-of-service (DoS) attack if
Spring MVC is used together with a reverse proxy cache.
○ Several CVE alerts; Please consider upgrading to version 2.0.
maven:org.springframework:spring-web:5.3.23,
maven:org.springframework:spring-expression:5.3.23
○ There are several CVE alerts for spring framework; Please consider updating to
version 6.0.9
○ There are several CVE alerts for woodstox; Please consider updating to 6.4.0.
○ CVE-2023-1370
○ Json-smart is a performance-focused, JSON processor lib. When reaching a ‘[‘ or
‘{‘ character in the JSON input, the code parses an array or an object
respectively. It was discovered that the code does not have any limit to the
nesting of such arrays or objects in versions prior to 2.4.9. Since the parsing of
Java
nested arrays and objects is done recursively, nesting too many of them can
cause a stack exhaustion (stack overflow) and crash the software
The text was updated successfully, but these errors were encountered: