CVE-2022-2120: OFFIS DCMTK Path Traversal
Last updated 24 July 2024
Other sources
OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-9~deb12u4Fixed in 3.6.9-5+deb13u3Fixed in 3.7.0+really3.7.0-7 - Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-6 - Upgrade
Upgrade
OFFIS DCMTKto a version that resolves this vulnerability.Fixed in 3.6.7
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2120?
CVE-2022-2120 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2022-2120?
To fix CVE-2022-2120, upgrade to OFFIS DCMTK version 3.6.7 or later.
What type of vulnerability is CVE-2022-2120?
CVE-2022-2120 is a relative path traversal vulnerability that allows unauthorized file writing.
Which versions of OFFIS DCMTK are affected by CVE-2022-2120?
All versions of OFFIS DCMTK prior to 3.6.7 are affected by CVE-2022-2120.
Can CVE-2022-2120 lead to data compromise?
Yes, CVE-2022-2120 can potentially lead to data compromise through unauthorized writing of DICOM files.