CVE-2022-2119: OFFIS DCMTK Path Traversal
Last updated 24 July 2024
Other sources
OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-9~deb12u4Fixed in 3.6.9-5+deb13u3Fixed in 3.7.0+really3.7.0-7 - Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-6 - Upgrade
Upgrade
OFFIS DCMTKto a version that resolves this vulnerability.Fixed in 3.6.7
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2119?
CVE-2022-2119 is considered a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2022-2119?
To fix CVE-2022-2119, upgrade OFFIS DCMTK to version 3.6.7 or later.
What impact does CVE-2022-2119 have on affected systems?
CVE-2022-2119 allows attackers to perform path traversal, enabling the writing of DICOM files to arbitrary directories.
Which versions of OFFIS DCMTK are affected by CVE-2022-2119?
All versions of OFFIS DCMTK prior to 3.6.7 are affected by CVE-2022-2119.
Is CVE-2022-2119 exploitable remotely?
Yes, CVE-2022-2119 is exploitable remotely, allowing attackers to target vulnerable systems over a network.