wldsfs.cc cast findAndGetElement() results to DcmSequenceOfItems*
without checking the VR. A C-FIND with a dictionary-SQ tag declared
under a non-SQ wire VR (Explicit VR) thus dispatched through the wrong
vtable and crashes the SCP (see also CVE-2024-28130 in dcmpstat).
Use findAndGetSequence(), which validates the VR. Also guard getItem(0)
against an empty ScheduledProcedureStepSequence and drop a bogus cast.
Thanks for the report and analysis to Abhinav Agarwal.
Fix path traversal in wlmscpfs through Called AET.
The wlmscpfs SCP appended the Called Application Entity Title received
in the A-ASSOCIATE-RQ directly onto the configured worklist data file
path and used the existence of the resulting directory as an access
control decision. Because DICOM VR AE permits the characters "/", "\"
and ".", a peer could send a 16-byte AE title such as "../secret/VICTIM"
and have wlmscpfs serve worklist records from a sibling directory of
the configured root. With option --request-file-path enabled, the same
AE title (and the Patient ID) was substituted into the output filename
template without sanitization, producing an arbitrary-location write
primitive outside the configured request file directory.
This commit closes both holes:
- wlmscpfs now rejects any A-ASSOCIATE-RQ whose Called AE title is not
safe to use as a single filesystem path component, refusing the
association with WLM_BAD_AE_SERVICE. The validation is implemented in
the new static method WlmFileSystemInteractionManager::IsValidAETitle\
ForFilesystem, which rejects empty or over-long titles, any title
containing a dot, and delegates the remaining character check to
OFStandard::sanitizeAETitle (sanitize-and-compare).
- The placeholder substitution in storeRequestToFile now passes each
substituted value (#a, #c, #p) through OFStandard::sanitizeAETitle
before insertion, and additionally sanitizes the final filename, so
that any path separator surviving the substitution is defanged.
Supporting changes:
- Promote storescp's private sanitizeAETitle helper into the public
OFStandard::sanitizeAETitle, with documentation noting that the
function is also used by wlmscpfs to validate filesystem path
components (so widening the allow list has downstream effects).
- Replace storescp's local copy of the helper with the new public one.
- Add a forward declaration of DcmSequenceOfItems in wlfsim.h that
was previously missing (existing callers happened to include dctk.h
first).
- Document the new behaviour in the wlmscpfs man page.
Tests:
- New ofstd_OFStandard_sanitizeAETitle test covers the lifted helper
(path separators, NUL, control bytes, high-range bytes, shell
metacharacters, the quotation-mark preservation behaviour, and
empty/length-1 edge cases).
- New dcmwlm_aetitle_validation test covers the validator directly
with every path-traversal payload from the bug report ("../secret/\
VICTIM", "../CARDIOLOGY", "..", ".", "..\secret"), dotted variants
("MY.AE", "foo..bar", ".foo", "foo."), structural rejections (empty,
17 bytes, embedded NUL, tab, 0xFF), shell metacharacters, and a row
of legitimate AE titles that must still be accepted.
- dcmwlm previously had no OFTEST scaffolding; tests.cc has been added
along with the corresponding CMakeLists.txt and Makefile.in entries.
AE_3_AssociateConfirmationAccept and AE_6_ExamineAssociateRequest leaked
the whole parsed PDU graph (presentation contexts, transfer syntax
sub-chains, role list, user info) on error returns taken after
parseAssociate() succeeded, since only the success path freed it. For an
SCP this is remotely triggerable and accumulates per connection.
Free the parsed PDU before each such return;
translatePresentationContextList() also frees the proposed transfer
syntax list of a rejected context. Add a dcmnet regression test
(tassocleak.cc) driving the AE_6 zero-transfer-syntax path against an
in-process DcmSCP; leak-clean with the fix under DCMTK_WITH_SANITIZERS.
Thanks for the report and analysis to Abhinav Agarwal.
In DCMSCU_STORAGE_BIT_PRESERVING mode, the C-STORE sub-operation
handler in handleCGETSession() built the on-disk filename from the
peer-supplied AffectedSOPInstanceUID without sanitization, allowing
a malicious C-STORE SCP to write files outside the configured
storage directory via path-separator or "../" sequences in the UID.
The DISK mode path was already sanitized (via createStorageFilename(),
fixed in commit f06a86751 for CVE-2022-2120); this branch was missed.
The fix mirrors the same pattern (sanitize a local OFString copy) so
the request struct stays intact and the C-STORE response still echoes
the peer's original UID per protocol.
Affects all consumers of DcmSCU using DCMSCU_STORAGE_BIT_PRESERVING,
including getscu --bit-preserving.
This fixes DCMTK issue #1207.
Thanks to Abhinav Agarwal for the report and analysis.
Applied-Upstream: edbb085e45788dccaf0e64d71534cfca925784b8
Last-Update: 2026-03-21
Bug: https://support.dcmtk.org/redmine/issues/1194
Bug-Debian: https://bugs.debian.org/1133001 Reviewed-By: Étienne Mollier <emollier@debian.org>
Sanitize the text fields from incoming DICOM associations and DICOM objects
(such as Study Instance UID, SOP Instance UID, Patient's Name) and the
calling SCU's network presentation address by removing special characters
that may be interpreted as shell escape characters when one of the
execution options (e.g. --exec-on-reception) is in use.
Thanks to Machine Spirits UG (haftungsbeschränkt) for the bug report,
detailed analysis and proof of concept.
The issue is known upstream and supposed to be fixed in an upcoming
version.
Last-Update: 2026-02-17
Gbp-Pq: Name skip-bigendian-roundtrip-failure.patch
CMake exports are used by other packages that compile
and link against dcmtk. Because Debian moves some of
these executables and also dosn't install the test
executables, this import may fail leading to failure
to configure the according package.
This change includes a patch queue addressing CVE-2026-50003,
CVE-2026-50254, CVE-2026-35505, CVE-2026-52868 and CVE-2026-44628.
The latter CVE-2026-44628 is divided into two patches to match
upstream's commits. These changes fix a range of issues, including
risks of path traversals, denial of services and information leaks.
Marco Eichelberg [Mon, 22 Jun 2026 20:22:11 +0000 (22:22 +0200)]
Sanitize all strings passed to the exec options.
Applied-Upstream: edbb085e45788dccaf0e64d71534cfca925784b8
Last-Update: 2026-03-21
Bug: https://support.dcmtk.org/redmine/issues/1194
Bug-Debian: https://bugs.debian.org/1133001 Reviewed-By: Étienne Mollier <emollier@debian.org>
Sanitize the text fields from incoming DICOM associations and DICOM objects
(such as Study Instance UID, SOP Instance UID, Patient's Name) and the
calling SCU's network presentation address by removing special characters
that may be interpreted as shell escape characters when one of the
execution options (e.g. --exec-on-reception) is in use.
Thanks to Machine Spirits UG (haftungsbeschränkt) for the bug report,
detailed analysis and proof of concept.
The issue is known upstream and supposed to be fixed in an upcoming
version.
Last-Update: 2026-02-17
Gbp-Pq: Name skip-bigendian-roundtrip-failure.patch
CMake exports are used by other packages that compile
and link against dcmtk. Because Debian moves some of
these executables and also dosn't install the test
executables, this import may fail leading to failure
to configure the according package.
Applied-Upstream: edbb085e45788dccaf0e64d71534cfca925784b8
Last-Update: 2026-03-21
Bug: https://support.dcmtk.org/redmine/issues/1194
Bug-Debian: https://bugs.debian.org/1133001 Reviewed-By: Étienne Mollier <emollier@debian.org>
Sanitize the text fields from incoming DICOM associations and DICOM objects
(such as Study Instance UID, SOP Instance UID, Patient's Name) and the
calling SCU's network presentation address by removing special characters
that may be interpreted as shell escape characters when one of the
execution options (e.g. --exec-on-reception) is in use.
Thanks to Machine Spirits UG (haftungsbeschränkt) for the bug report,
detailed analysis and proof of concept.
The issue is known upstream and supposed to be fixed in an upcoming
version.
Last-Update: 2026-02-17
Gbp-Pq: Name skip-bigendian-roundtrip-failure.patch
CMake exports are used by other packages that compile
and link against dcmtk. Because Debian moves some of
these executables and also dosn't install the test
executables, this import may fail leading to failure
to configure the according package.
Applied-Upstream: edbb085e45788dccaf0e64d71534cfca925784b8
Last-Update: 2026-03-21
Bug: https://support.dcmtk.org/redmine/issues/1194
Bug-Debian: https://bugs.debian.org/1133001 Reviewed-By: Étienne Mollier <emollier@debian.org>
Sanitize the text fields from incoming DICOM associations and DICOM objects
(such as Study Instance UID, SOP Instance UID, Patient's Name) and the
calling SCU's network presentation address by removing special characters
that may be interpreted as shell escape characters when one of the
execution options (e.g. --exec-on-reception) is in use.
Thanks to Machine Spirits UG (haftungsbeschränkt) for the bug report,
detailed analysis and proof of concept.
The issue is known upstream and supposed to be fixed in an upcoming
version.
Last-Update: 2026-02-17
Gbp-Pq: Name skip-bigendian-roundtrip-failure.patch
CMake exports are used by other packages that compile
and link against dcmtk. Because Debian moves some of
these executables and also dosn't install the test
executables, this import may fail leading to failure
to configure the according package.
Étienne Mollier [Thu, 4 Jun 2026 20:10:06 +0000 (22:10 +0200)]
Revert "CVE-2026-10528-partial.patch: new: fix needed by orthanc."
The change is causing an ABI breakage that is going to require a
transition. It is more appropriate to wait for the 3.7.1 release and
coordinate the transition on a sane basis. In the meantime the change
is undone.
Michael Onken [Wed, 3 Jun 2026 19:54:21 +0000 (21:54 +0200)]
Add sequence nesting depth limit for parsing
Applied-Upstream: 885ff0f10372bd589b5f44cea974f28a3964cb0f
Last-Update: 2026-04-11
Bug: https://support.dcmtk.org/redmine/issues/1191
Bug-Debian: https://bugs.debian.org/1138713 Reviewed-By: Étienne Mollier <emollier@debian.org>
Track sequence nesting depth on DcmInputStream during parsing. When the
depth exceeds a configurable limit, parsing is aborted with
EC_NestingDepthLimitExceeded. This prevents stack overflow from
excessively nested DICOM sequences.
The default limit is controlled by the compile-time macro
DCMTK_MAX_SEQUENCE_NESTING (default: 64). It can be overridden per parse
operation via the runtime API:
- DcmInputStream::setMaxNestingDepth() for direct stream access
- DcmItem::setMaxNestingDepth() (inherited by DcmDataset) for loadFile()
and read()
- DcmFileFormat::setMaxNestingDepth() for loadFile() and read(),
forwarded to the contained dataset
- DcmSCP::setMaxNestingDepth() and DcmSCU::setMaxNestingDepth() for
datasets received over the network via receiveDIMSEDataset()
Note: the specific EC_NestingDepthLimitExceeded error code is not yet
surfaced through the DIMSE layer; DIMSE_receiveDataSetInMemory() maps
all parse errors to DIMSE_RECEIVEFAILED.
Thanks to the IN-CYPHER OSS Security Team for the report, detailed
analysis and proof of concept.
Applied-Upstream: edbb085e45788dccaf0e64d71534cfca925784b8
Last-Update: 2026-03-21
Bug: https://support.dcmtk.org/redmine/issues/1194
Bug-Debian: https://bugs.debian.org/1133001 Reviewed-By: Étienne Mollier <emollier@debian.org>
Sanitize the text fields from incoming DICOM associations and DICOM objects
(such as Study Instance UID, SOP Instance UID, Patient's Name) and the
calling SCU's network presentation address by removing special characters
that may be interpreted as shell escape characters when one of the
execution options (e.g. --exec-on-reception) is in use.
Thanks to Machine Spirits UG (haftungsbeschränkt) for the bug report,
detailed analysis and proof of concept.
The issue is known upstream and supposed to be fixed in an upcoming
version.
Last-Update: 2026-02-17
Gbp-Pq: Name skip-bigendian-roundtrip-failure.patch
CMake exports are used by other packages that compile
and link against dcmtk. Because Debian moves some of
these executables and also dosn't install the test
executables, this import may fail leading to failure
to configure the according package.
Étienne Mollier [Wed, 3 Jun 2026 17:24:07 +0000 (19:24 +0200)]
CVE-2026-10528-partial.patch: new: fix needed by orthanc.
This patch introduce the part of the mitigation against CVE-2026-10528
affecting orthanc that needs to be applied on the side of dcmtk. See
also Debian bug #1138713.
The issue is known upstream and supposed to be fixed in an upcoming
version.
Last-Update: 2026-02-17
Gbp-Pq: Name skip-bigendian-roundtrip-failure.patch
CMake exports are used by other packages that compile
and link against dcmtk. Because Debian moves some of
these executables and also dosn't install the test
executables, this import may fail leading to failure
to configure the according package.
Luca Boccassi [Sun, 3 May 2026 13:47:37 +0000 (14:47 +0100)]
Install and use sysusers.d/tmpfiles.d config files
sysusers.d/tmpfiles.d config files allow a package to use declarative
configuration instead of manually written maintainer scripts.
This also allows image-based systems to be created with /usr/ only, and
also allows for factory resetting a system and recreating /etc/ on boot.
Luca Boccassi [Sun, 3 May 2026 13:47:25 +0000 (14:47 +0100)]
Stop deleting system user/group on remove/purge
Removing system users/groups on purge is considered bad practice,
as the kernel recycles UIDs/GIDs. So any potential leftover
file/directory can then become owned by the next user/group that
gets added, with unpredictable consequences.
The issue is known upstream and supposed to be fixed in an upcoming
version.
Last-Update: 2026-02-17
Gbp-Pq: Name skip-bigendian-roundtrip-failure.patch
CMake exports are used by other packages that compile
and link against dcmtk. Because Debian moves some of
these executables and also dosn't install the test
executables, this import may fail leading to failure
to configure the according package.
Applied-Upstream: 3de96da6cd66b1af7224561c568bc3de50cd1398
Last-Update: 2025-08-18 Reviewed-By: Étienne Mollier <emollier@debian.org>
Fixed an issue with recently committed changes that fix a problem with
invalid YBR_FULL images
Fixed an issue when processing an invalid DICOM image with a Photometric
Interpretation of "YBR_FULL" and a Planar Configuration of "1" where
the number of pixels stored does not match the expected number of pixels
(much too less). Now, the pixel data of such an image is not processed
at all, but an empty image (black pixels) is created instead. The user
is warned about this by an appropriate log message.
Thanks to Ding zhengzheng <xiaozheng.ding399@gmail.com> for the report
and the sample file (PoC).
Fixed issue when rendering an invalid monochrome DICOM image where the
number of pixels stored does not match the expected number of pixels.
In this case, only a single pixel is processed, but the pixel matrix is
much larger. Filling the rest of the pixel matrix with the smallest
possible value for the image is not working because of an optimized
memory usage (value would be out of range). Now, the pixel value to be
used is double-checked before it is actually filled into the "background"
of the image.
Thanks to Ding zhengzheng <xiaozheng.ding399@gmail.com> for the report
and the sample file (PoC).
Fixed issue when processing an invalid DICOM image where the number of
pixels stored does not match the expected number of pixels (too less)
and the combination of BitsAllocated and BitsStored is really unusual
(e.g. 1 bit stored, but 52 bits allocated). In cases where the last
pixel (e.g. a single bit) does not fit into the buffer of the input
pixel data, a buffer overflow occurred on the heap. Now, the last entry
of the buffer is filled with the smallest possible value (e.g. 0 in case
of unsigned data).
Thanks to Ding zhengzheng <xiaozheng.ding399@gmail.com> for the report
and the sample file (PoC).
projects / dcmtk.git / log