CVE-2021-32053: Uncontrolled Resource Consumption in JPA Server in HAPI FHIR
Summary
CVE-2021-32053: Uncontrolled Resource Consumption in JPA Server in HAPI FHIR. Affects ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base versions < 5.4.0. Fixed in 5.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The HAPI FHIR package is a Java library that provides support for the HL7 FHIR (Fast Healthcare Interoperability Resources) standard. It includes a JPA (Java Persistence API) server module that allows users to store and retrieve FHIR resources in a database. The JPA server is a key component of the HAPI FHIR package, enabling developers to build FHIR-compliant applications with database persistence. However, a vulnerability has been identified in the JPA Server module of HAPI FHIR versions prior to 5.4.0.
Vulnerability Detail
The vulnerability, identified as CVE-2021-32053, allows an attacker to perform a denial-of-service attack on the JPA Server by sending multiple history requests. The issue arises due to a SELECT COUNT statement that requires a full index scan, resulting in a significant consumption of server resources when handling numerous simultaneous history requests. This can lead to a degradation of service or even a complete denial of access to the database until the attack ceases. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.3.
How To Fix
Minimum fixed version
5.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is advised to apply the fix by upgrading to the patched version of HAPI FHIR.
Conclusion
The vulnerability in the JPA Server module of HAPI FHIR versions prior to 5.4.0 can lead to a denial-of-service condition. It is crucial to upgrade to the patched version (5.4.0 or later) to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base →
FAQ
HAPI FHIR is a Java library that supports the HL7 FHIR standard, allowing developers to build FHIR-compliant applications with database persistence.
This vulnerability can result in a denial-of-service condition, where the JPA Server becomes unresponsive or inaccessible due to excessive resource consumption.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.3.
To fix this vulnerability, upgrade to HAPI FHIR version 5.4.0 or later, which includes a patch for the issue.
No specific workaround is provided. It is recommended to apply the fix by upgrading to the patched version of HAPI FHIR.
