ePA3-Service-OpenSource vulnerabilities
3 known vulnerabilities in ePA3-Service-OpenSource from fbeta-GmbH. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
ePA3-Service-OpenSource: Improper Certificate Validation
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring
- 7.5 High severity
ePA3-Service-OpenSource: Improper Certificate Validation
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.
- 7.4 High severity
ePA3-Service-OpenSource: Reusing a Nonce, Key Pair in Encryption
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves request_counter unchanged in app/vau/VAUProtokoll.py while constructing VAU mess