Maven/ca.uhn.hapi.fhir:org.hl7.fhir.r4b CVE-2023-28465: high 7.5, EPSS 1.30%

HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057

Action: Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 5.6.106 or later.

Affected

Fixed versions

Sources

• osv: GHSA-9654-pr4f-gh6m#Maven/ca.uhn.hapi.fhir:org.hl7.fhir.r4b
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-9654-pr4f-gh6m
• https://nvd.nist.gov/vuln/detail/CVE-2023-28465
• https://github.com/hapifhir/org.hl7.fhir.core/pull/1162
• https://github.com/advisories/GHSA-9654-pr4f-gh6m
• https://github.com/hapifhir/org.hl7.fhir.core
• https://github.com/hapifhir/org.hl7.fhir.core/blob/b0daf666725fa14476d147522155af1e81922aac/org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/terminologies/TerminologyCacheManager.java#L99-L105
• https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/5.6.106
• https://www.smilecdr.com/our-blog
• https://www.smilecdr.com/our-blog/statement-on-cve-2023-24057-smile-digital-health

CVE-2023-28465 · published 2023-03-10T22:15:55Z · modified 2026-07-08T06:29:15.854257898Z · JSON