CVE-2024-55887: Ucum-java has an XXE vulnerability in XML parsing

December 13, 2024

XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML.

References

github.com/FHIR/Ucum-java
github.com/FHIR/Ucum-java/security/advisories/GHSA-w9j7-phm3-f97j
github.com/advisories/GHSA-w9j7-phm3-f97j
nvd.nist.gov/vuln/detail/CVE-2024-55887

Code Behaviors & Features

Detect and mitigate CVE-2024-55887 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →