GHSA-67f6-c8mx-4q2m
Uncontrolled Resource Consumption in JPA Server in HAPI FHIR
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base | < 5.4.0 | 5.4.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.
References
External links from the advisory. They lead to third-party sites.