PT-2021-23377 · Dcmtk+5 · Dcmtk+5

Jinsheng Ba · Published 2021-07-16 · Updated 2025-04-03 · CVE-2021-41690

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions DCMTK versions 3.6.6 and earlier

Description The issue is related to improper memory handling in the DCMTK library, specifically with the global variable LST, which records allocated memory for storing file information but does not free it properly. This can lead to a memory leak when specific requests are sent to the dcmqrdb program, allowing an attacker to launch a denial-of-service (DoS) attack.

Recommendations For DCMTK versions 3.6.6 and earlier, as a temporary workaround, consider restricting access to the dcmqrdb program to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALT-PU-2024-15767

ALT-PU-2024-5081

ALT-PU-2025-4731

BDU:2025-03972

CVE-2021-41690

DLA-3847-1

DLA-4038-1

DLA-4038-2

MGASA-2023-0083

ROSA-SA-2025-2643

USN-5882-1

USN-7010-1

Affected Products

Alt Linux

Astra Linux

Dcmtk

Linuxmint

Red Os

Ubuntu

References · 42

• https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb · Patch
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03972 · Security Note
• https://ubuntu.com/security/CVE-2022-2121 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41690 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-41690 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2119 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3847-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0083 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4038-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1010228 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41690 · Security Note
• https://ubuntu.com/security/CVE-2015-8979 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE99 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41687 · Vendor Advisory