PT-2022-6736 · Offis+5 · Offis Dcmtk+5

Published 2022-05-06 · Updated 2025-06-24 · CVE-2022-2119

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OFFIS DCMTK versions prior to 3.6.7

Description The issue is related to a path traversal vulnerability in the service class provider (SCP) of OFFIS DCMTK, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could potentially lead to remote code execution. The vulnerability also allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For versions prior to 3.6.7, update to version 3.6.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the SCP service to minimize the risk of exploitation. Avoid using the vulnerable SCP service until the issue is resolved.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2024-15767

ALT-PU-2024-5081

ALT-PU-2025-4731

BDU:2023-03840

CVE-2022-2119

DLA-4227-1

MGASA-2023-0083

OPENSUSE-SU-2022:10144-1

OPENSUSE-SU-2022:10145-1

OPENSUSE-SU-2023:0108-1

OPENSUSE-SU-2024:12383-1

ROSA-SA-2025-2643

USN-5882-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Offis Dcmtk

Ubuntu

References · 51

• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8979 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43272 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0630SE17MD · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2121 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0083.html · Security Note
• https://osv.dev/vulnerability/DLA-4227-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-2119 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/2Z7WVDK43MKWOS23BIN4VCQRQRXHGSDB · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-2119 · Security Note
• https://ubuntu.com/security/CVE-2022-2119 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41689 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2119 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5882-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0083 · Vendor Advisory