Security Update for dcmtk Package
Summary
DLA-3847-1: dcmtk - security update. Affects dcmtk versions < 3.6.4-2.1+deb10u1. Fixed in 3.6.4-2.1+deb10u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dcmtk package is a set of libraries and applications for implementing DICOM (Digital Imaging and Communications in Medicine) functionality in medical imaging applications. It provides support for the creation, reading, and manipulation of DICOM files. The package is widely used in the healthcare industry for managing medical images and related data.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the dcmtk package. The vulnerabilities include CVE-2021-41687, CVE-2021-41688, CVE-2021-41689, CVE-2021-41690, CVE-2022-2121, CVE-2022-43272, CVE-2024-28130, CVE-2024-34508, and CVE-2024-34509. These vulnerabilities could potentially allow remote attackers to execute arbitrary code, cause denial of service, or disclose sensitive information. The specific technical details of each vulnerability can be found in the provided source link.
How To Fix
Minimum fixed version
3.6.4-2.1+deb10u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade dcmtkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Updating the dcmtk package to version 3.6.4-2.1+deb10u1 or later is crucial to mitigate the identified vulnerabilities. It is recommended to apply the security update as soon as possible to ensure the integrity and security of medical imaging applications that rely on the dcmtk package.
See every vulnerability recorded for dcmtk →
FAQ
These vulnerabilities could potentially allow remote attackers to execute arbitrary code, cause denial of service, or disclose sensitive information.
No, updating the dcmtk package to the fixed version is the recommended solution.
The vulnerabilities affect dcmtk package version 0 and versions prior to 3.6.4-2.1+deb10u1.
More information about the vulnerabilities can be found in the provided source link.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
Related vulnerabilities
Recent vulnerabilities recorded for dcmtk.
