CVE-2022-2120
OFFIS DCMTK Path Traversal
Summary
OFFIS DCMTK Path Traversal
Original description
The description as published by the source.
OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-2120 dcmtk Fixed in: 3.6.5-1+deb11u4
- Ubuntu UBUNTU-CVE-2022-2120 dcmtk Fixed in: 3.6.1~20150924-5ubuntu0.1~esm1
References
- advisory github.com
- advisory nvd.nist.gov
- advisory cisa.gov
- web lists.debian.org