CVE-2024-52807: XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`
XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML.
A previous release provided an incomplete solution revealed by new testing.
References
Detect and mitigate CVE-2024-52807 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →