[med-svn] [Git][med-team/dcmtk][master] 2 commits: d/patches: CVE-2022-2119 CVE-2022-2120. Closes: #1017743
Mathieu Malaterre (@malat)
gitlab at salsa.debian.org
Mon Aug 22 16:10:50 BST 2022
Mathieu Malaterre pushed to branch master at Debian Med / dcmtk
Commits:
3717e7ec by Mathieu Malaterre at 2022-08-22T17:01:46+02:00
d/patches: CVE-2022-2119 CVE-2022-2120. Closes: #1017743
- - - - -
28440ec0 by Mathieu Malaterre at 2022-08-22T17:03:28+02:00
d/changelog: Upload 3.6.7-6 to unstable
- - - - -
3 changed files:
- debian/changelog
- + debian/patches/f06a867513524664a1b03dfcf812d8b60fdd02cc.patch
- debian/patches/series
Changes:
=====================================
debian/changelog
=====================================
@@ -1,15 +1,16 @@
-dcmtk (3.6.7-6) UNRELEASED; urgency=medium
+dcmtk (3.6.7-6) unstable; urgency=medium
[ Mathieu Malaterre ]
* Team upload.
* d/control: libdcmtk4 is not present in o-o-stable
* d/postrm: Fix possible-bashism-in-maintainer-script
+ * d/patches: CVE-2022-2119 CVE-2022-2120. Closes: #1017743
[ Mohammed Bilal ]
* Add autopkgtests
* Bump Standards-Version to 4.6.1 (no changes needed)
- -- Mohammed Bilal <mdbilal at disroot.org> Fri, 19 Aug 2022 16:49:08 +0000
+ -- Mathieu Malaterre <malat at debian.org> Mon, 22 Aug 2022 17:02:26 +0200
dcmtk (3.6.7-5) unstable; urgency=medium
=====================================
debian/patches/f06a867513524664a1b03dfcf812d8b60fdd02cc.patch
=====================================
@@ -0,0 +1,252 @@
+From f06a867513524664a1b03dfcf812d8b60fdd02cc Mon Sep 17 00:00:00 2001
+From: Marco Eichelberg <dicom at offis.de>
+Date: Fri, 6 May 2022 17:30:02 +0200
+Subject: [PATCH] Fixed path traversal vulnerability.
+
+Thanks to Sharon Brizinov >sharon.b at claroty.com> and Noam Moshe from
+Claroty Research for the bug report and sample files.
+
+This closes DCMTK issue #1021.
+---
+ dcmnet/apps/movescu.cc | 3 ++-
+ dcmnet/apps/storescp.cc | 8 +++++--
+ dcmnet/libsrc/dstorscp.cc | 5 ++++-
+ dcmnet/libsrc/scu.cc | 1 +
+ ofstd/include/dcmtk/ofstd/ofstd.h | 18 +++++++++++++++-
+ ofstd/libsrc/offname.cc | 19 ++++++++++-------
+ ofstd/libsrc/ofstd.cc | 35 ++++++++++++++++++++++++++++++-
+ 7 files changed, 76 insertions(+), 13 deletions(-)
+
+diff --git a/dcmnet/apps/movescu.cc b/dcmnet/apps/movescu.cc
+index 40f41674c..7e444d46b 100644
+--- a/dcmnet/apps/movescu.cc
++++ b/dcmnet/apps/movescu.cc
+@@ -1,6 +1,6 @@
+ /*
+ *
+- * Copyright (C) 1994-2021, OFFIS e.V.
++ * Copyright (C) 1994-2022, OFFIS e.V.
+ * All rights reserved. See COPYRIGHT file for details.
+ *
+ * This software and supporting documentation were developed by
+@@ -1425,6 +1425,7 @@ static OFCondition storeSCP(
+ sprintf(imageFileName, "%s.%s",
+ dcmSOPClassUIDToModality(req->AffectedSOPClassUID),
+ req->AffectedSOPInstanceUID);
++ OFStandard::sanitizeFilename(imageFileName);
+ }
+
+ OFString temp_str;
+diff --git a/dcmnet/apps/storescp.cc b/dcmnet/apps/storescp.cc
+index ee53f2887..68b7b4e97 100644
+--- a/dcmnet/apps/storescp.cc
++++ b/dcmnet/apps/storescp.cc
+@@ -1853,12 +1853,14 @@ storeSCPCallback(
+ if (!subdirectoryName.empty())
+ subdirectoryName += '_';
+ subdirectoryName += currentStudyInstanceUID;
++ OFStandard::sanitizeFilename(subdirectoryName);
+ break;
+ case ESM_PatientName:
+ // pattern: "[Patient's Name]_[YYYYMMDD]_[HHMMSSMMM]"
+ subdirectoryName = currentPatientName;
+ subdirectoryName += '_';
+ subdirectoryName += timestamp;
++ OFStandard::sanitizeFilename(subdirectoryName);
+ break;
+ case ESM_None:
+ break;
+@@ -2065,9 +2067,11 @@ static OFCondition storeSCP(
+ }
+ else
+ {
+- // don't create new UID, use the study instance UID as found in object
++ // Use the SOP instance UID as found in the C-STORE request message as part of the filename
++ OFString uid = req->AffectedSOPInstanceUID;
++ OFStandard::sanitizeFilename(uid);
+ sprintf(imageFileName, "%s%c%s.%s%s", opt_outputDirectory.c_str(), PATH_SEPARATOR, dcmSOPClassUIDToModality(req->AffectedSOPClassUID, "UNKNOWN"),
+- req->AffectedSOPInstanceUID, opt_fileNameExtension.c_str());
++ uid.c_str(), opt_fileNameExtension.c_str());
+ }
+ }
+
+diff --git a/dcmnet/libsrc/dstorscp.cc b/dcmnet/libsrc/dstorscp.cc
+index e491ae5ea..1811846a2 100644
+--- a/dcmnet/libsrc/dstorscp.cc
++++ b/dcmnet/libsrc/dstorscp.cc
+@@ -1,6 +1,6 @@
+ /*
+ *
+- * Copyright (C) 2013-2021, OFFIS e.V.
++ * Copyright (C) 2013-2022, OFFIS e.V.
+ * All rights reserved. See COPYRIGHT file for details.
+ *
+ * This software and supporting documentation were developed by
+@@ -425,6 +425,7 @@ OFCondition DcmStorageSCP::generateDirAndFilename(OFString &filename,
+ generatedFileName = tmpString;
+ OFSTRINGSTREAM_FREESTR(tmpString);
+ // combine the generated file name with the directory name
++ OFStandard::sanitizeFilename(generatedFileName);
+ OFStandard::combineDirAndFilename(filename, directoryName, generatedFileName);
+ }
+ break;
+@@ -441,6 +442,7 @@ OFCondition DcmStorageSCP::generateDirAndFilename(OFString &filename,
+ generatedFileName = tmpString;
+ OFSTRINGSTREAM_FREESTR(tmpString);
+ // combine the generated file name with the directory name
++ OFStandard::sanitizeFilename(generatedFileName);
+ OFStandard::combineDirAndFilename(filename, directoryName, generatedFileName);
+ break;
+ }
+@@ -469,6 +471,7 @@ OFCondition DcmStorageSCP::generateDirAndFilename(OFString &filename,
+ generatedFileName = tmpString;
+ OFSTRINGSTREAM_FREESTR(tmpString);
+ // combine the generated file name
++ OFStandard::sanitizeFilename(generatedFileName);
+ OFStandard::combineDirAndFilename(filename, directoryName, generatedFileName);
+ } else
+ status = EC_CouldNotGenerateFilename;
+diff --git a/dcmnet/libsrc/scu.cc b/dcmnet/libsrc/scu.cc
+index 34b252553..1cc9c3a46 100644
+--- a/dcmnet/libsrc/scu.cc
++++ b/dcmnet/libsrc/scu.cc
+@@ -1418,6 +1418,7 @@ OFString DcmSCU::createStorageFilename(DcmDataset* dataset)
+ OFString name = dcmSOPClassUIDToModality(sopClassUID.c_str(), "UNKNOWN");
+ name += ".";
+ name += sopInstanceUID;
++ OFStandard::sanitizeFilename(name);
+ OFString returnStr;
+ OFStandard::combineDirAndFilename(returnStr, m_storageDir, name, OFTrue);
+ return returnStr;
+diff --git a/ofstd/include/dcmtk/ofstd/ofstd.h b/ofstd/include/dcmtk/ofstd/ofstd.h
+index 1548e26d0..56054ccb0 100644
+--- a/ofstd/include/dcmtk/ofstd/ofstd.h
++++ b/ofstd/include/dcmtk/ofstd/ofstd.h
+@@ -1,6 +1,6 @@
+ /*
+ *
+- * Copyright (C) 2000-2021, OFFIS e.V.
++ * Copyright (C) 2000-2022, OFFIS e.V.
+ * All rights reserved. See COPYRIGHT file for details.
+ *
+ * This software and supporting documentation were developed by
+@@ -1165,6 +1165,22 @@ class DCMTK_OFSTD_EXPORT OFStandard
+ */
+ static void forceSleep(Uint32 seconds);
+
++ /** sanitize a filename (NOT a path name!) by replacing all path
++ * separators with underscores. This avoids possible path traversal
++ * vulnerabilities if malformed data read from file or received over
++ * a network is used as part of a filename.
++ * @param fname filename to be sanitized
++ */
++ static void sanitizeFilename(OFString& fname);
++
++ /** sanitize a filename (NOT a path name!) by replacing all path
++ * separators with underscores. This avoids possible path traversal
++ * vulnerabilities if malformed data read from file or received over
++ * a network is used as part of a filename.
++ * @param fname filename to be sanitized
++ */
++ static void sanitizeFilename(char *fname);
++
+ private:
+
+ /** private implementation of strlcpy. Called when strlcpy
+diff --git a/ofstd/libsrc/offname.cc b/ofstd/libsrc/offname.cc
+index 832376189..a56a7e1b5 100644
+--- a/ofstd/libsrc/offname.cc
++++ b/ofstd/libsrc/offname.cc
+@@ -1,6 +1,6 @@
+ /*
+ *
+- * Copyright (C) 1997-2021, OFFIS e.V.
++ * Copyright (C) 1997-2022, OFFIS e.V.
+ * All rights reserved. See COPYRIGHT file for details.
+ *
+ * This software and supporting documentation were developed by
+@@ -73,18 +73,23 @@ OFBool OFFilenameCreator::makeFilename(unsigned int &seed, const char *dir, cons
+ {
+ // create filename
+ filename.clear();
+- if (dir)
+- {
+- filename = dir;
+- filename += PATH_SEPARATOR;
+- }
+- if (prefix) filename += prefix;
++ if (prefix) filename = prefix;
+ addLongToString(creation_time, filename);
+ // on some systems OFrand_r may produce only 16-bit random numbers.
+ // To be on the safe side, we use two random numbers for the upper and the lower 16 bits.
+ addLongToString((((OFrand_r(seed) & 0xFFFF) << 16) | (OFrand_r(seed) & 0xFFFF)), filename);
+ if (postfix) filename += postfix;
+
++ OFStandard::sanitizeFilename(filename);
++
++ if (dir)
++ {
++ OFString dirname = dir;
++ dirname += PATH_SEPARATOR;
++ dirname += filename;
++ filename = dirname;
++ }
++
+ // check if filename exists
+ stat_result = stat(filename.c_str(), &stat_buf);
+ if (stat_result == 0)
+diff --git a/ofstd/libsrc/ofstd.cc b/ofstd/libsrc/ofstd.cc
+index ae1466a9f..33ecd7954 100644
+--- a/ofstd/libsrc/ofstd.cc
++++ b/ofstd/libsrc/ofstd.cc
+@@ -1,6 +1,6 @@
+ /*
+ *
+- * Copyright (C) 2001-2021, OFFIS e.V.
++ * Copyright (C) 2001-2022, OFFIS e.V.
+ * All rights reserved. See COPYRIGHT file for details.
+ *
+ * This software and supporting documentation were developed by
+@@ -3245,6 +3245,39 @@ void OFStandard::forceSleep(Uint32 seconds)
+ }
+ }
+
++
++void OFStandard::sanitizeFilename(OFString& fname)
++{
++ size_t len = fname.length();
++ for (size_t i=0; i<len; ++i)
++ {
++#ifdef _WIN32
++ if ((fname[i] == PATH_SEPARATOR)||(fname[i] == '/')) fname[i] = '_';
++#else
++ if (fname[i] == PATH_SEPARATOR) fname[i] = '_';
++#endif
++ }
++}
++
++
++void OFStandard::sanitizeFilename(char *fname)
++{
++ if (fname)
++ {
++ char *c = fname;
++ while (*c)
++ {
++#ifdef _WIN32
++ if ((*c == PATH_SEPARATOR)||(*c == '/')) *c = '_';
++#else
++ if (*c == PATH_SEPARATOR) *c = '_';
++#endif
++ ++c;
++ }
++ }
++}
++
++
+ #include DCMTK_DIAGNOSTIC_IGNORE_STRICT_ALIASING_WARNING
+
+ // black magic:
+--
+2.30.2
+
=====================================
debian/patches/series
=====================================
@@ -8,3 +8,4 @@
#0cf6b12d8ea0b727f0fe2ab076b6f180100fbd30.patch
#ab61e8577ff0974efcfae2907c48baf6023c1160.patch
#1c8cca4bf6f7c92fc16f9e66faf49409c891a2b0.patch
+f06a867513524664a1b03dfcf812d8b60fdd02cc.patch
View it on GitLab: https://salsa.debian.org/med-team/dcmtk/-/compare/47a9f1dc15b56db6efcfd7dbbcdd6d97c0cbcb4a...28440ec00490849beaaef6e4f9e08106041a8944
--
View it on GitLab: https://salsa.debian.org/med-team/dcmtk/-/compare/47a9f1dc15b56db6efcfd7dbbcdd6d97c0cbcb4a...28440ec00490849beaaef6e4f9e08106041a8944
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-med-commit/attachments/20220822/333387e0/attachment-0001.htm>
More information about the debian-med-commit
mailing list