CVE-2022-2119: OFFIS DCMTK Path Traversal
Published Jun 24, 2022
·Updated
Last updated 24 July 2024
Other sources
OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
Affected Software
2 affected componentsFixes available
debian/dcmtk<=3.6.5-1
3.6.7-9~deb12u13.6.8-6
OFFIS DCMTK<3.6.7
Event History
Jun 24, 2022
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Sep 21, 2024
Data Sourced
via Ubuntu·10:11 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·10:12 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2022-2119?
CVE-2022-2119 is considered a high-severity vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2022-2119?
To fix CVE-2022-2119, upgrade OFFIS DCMTK to version 3.6.7 or later.
3
What impact does CVE-2022-2119 have on affected systems?
CVE-2022-2119 allows attackers to perform path traversal, enabling the writing of DICOM files to arbitrary directories.
4
Which versions of OFFIS DCMTK are affected by CVE-2022-2119?
All versions of OFFIS DCMTK prior to 3.6.7 are affected by CVE-2022-2119.
5
Is CVE-2022-2119 exploitable remotely?
Yes, CVE-2022-2119 is exploitable remotely, allowing attackers to target vulnerable systems over a network.