CVE:CVE-2023-24057
CNNVD:CNNVD-202301-1993
HL7 fhir-ig-publisher是HL7公司的IG publisher 的源码。
fhir-ig-publisher 1.2.30之前版本存在安全漏洞，该漏洞源于允许攻击者通过目录遍历从 ZIP 或 TGZ 包中将文件提取到任意目录中。
solution:Upgrade hapifhir hl7_fhir_core to a higher version than 5.6.92,and avoid the version (,5.6.92); Upgrade hl7 fhir_ig_publisher to a higher version than 1.2.30,and avoid the version (,1.2.30)