The ePA 3.x Integration component of the ePA3-Service-OpenSource product disables TLS certificate verification for ePA and Konnektor connections in versions before 1.3.0. Specifically, the TLS client sessions have verification disabled (self.session.verify set to False), allowing an attacker positioned on the network to terminate TLS connections with arbitrary certificates and intercept sensitive medical information and authentication exchanges. The VAU protocol's application-layer certificate validation is also broken in these versions, providing no effective fallback. This flaw enables an attacker to impersonate the Konnektor, observe mutual TLS certificate exchanges, and monitor smartcard operations. The vulnerability is addressed by restoring proper certificate validation in version 1.3.0.

An attacker capable of intercepting network traffic can exploit this vulnerability to impersonate legitimate services by presenting arbitrary TLS certificates. This leads to interception and potential exposure of sensitive medical information and authentication credentials, including smartcard operations. The confidentiality of electronic patient records is compromised, but there is no indication of impact on integrity or availability.

Upgrade to version 1.3.0 or later, where proper TLS certificate validation is enforced. No other mitigation or temporary fix is indicated. Patch status is confirmed fixed in version 1.3.0.