CVE-2022-2119
OFFIS DCMTK Path Traversal
Summary
OFFIS DCMTK Path Traversal
Original description
The description as published by the source.
OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-2119 dcmtk Fixed in: 3.6.5-1+deb11u4
- Ubuntu UBUNTU-CVE-2022-2119 dcmtk Fixed in: 3.6.1~20150924-5ubuntu0.1~esm1
References
- advisory github.com
- advisory nvd.nist.gov
- advisory cisa.gov
- web lists.debian.org