OpenEMR Has Disabled SSL Certificate Verification in HTTP Client
Résumé
OpenEMR Has Disabled SSL Certificate Verification in HTTP Client
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper (oeHttp/oeHttpRequest) disables SSL/TLS certificate verification by default (verify: false), making all external HTTPS connections vulnerable to man-in-the-middle (MITM) attacks. This affects communication with government healthcare APIs and user-configurable external services, potentially exposing Protected Health Information (PHI). Version 7.0.4 fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com