Description (CNA)
A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OFFIS / DCMTK | affected 3.0; affected 3.1; affected 3.2; affected 3.3; affected 3.4; affected 3.5; affected 3.6; affected 3.7.0 |
CWE
CWE-78, CWE-77
References
- https://vuldb.com/vuln/355486
- https://vuldb.com/vuln/355486/cti
- https://vuldb.com/submit/786061
- https://machinespirits.com/advisory/2e1627/
- https://support.dcmtk.org/redmine/issues/1194
- https://github.com/DCMTK/dcmtk/commit/edbb085e45788dccaf0e64d71534cfca925784b8
ADP enrichment
No English description supplied.
No references supplied.