CVE-2024-55887 Ucum-java has an XXE vulnerability in XML parsing
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-55887?
CVE-2024-55887 is a high-severity vulnerability in FHIR Ucum-java, published on 13 Dec 2024.
Official description
Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML. Release 1.0.9 of Ucum-java fixes this vulnerability. As a workaround, ensure that the source xml for instantiating UcumEssenceService is trusted.
Weakness: CWE-611
Which versions are affected by CVE-2024-55887?
2 open source packages ship an affected version, including org.fhir:ucum.
| Package | Affected | Fixed in |
|---|---|---|
org.fhir:ucum Maven | All versions | 1.0.9 |
org.fhir:ucum Maven | All versions | 1.0.9 |
How do I fix CVE-2024-55887?
Upgrade org.fhir:ucum to 1.0.9 or later.
Is CVE-2024-55887 being exploited?
There is no known exploitation of CVE-2024-55887 in the wild and no public exploit code.
Sources
Also known as GHSA-w9j7-phm3-f97j, ROOT-APP-MAVEN-CVE-2024-55887.