Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1231586 > unrolled thread
| Started by | inframan@alara-group.fr |
|---|---|
| First post | 2025-02-03 15:20 +0100 |
| Last post | 2025-02-05 18:10 +0100 |
| Articles | 4 — 4 participants |
Back to article view | Back to linux.debian.bugs.dist
Bug#1095072: orthanc: Orthanc crashes with lastest dcmtk or libdcmtk15 security update inframan@alara-group.fr - 2025-02-03 15:20 +0100
Bug#1095072: orthanc: Orthanc crashes with lastest dcmtk or libdcmtk15 security update Adrian Bunk <bunk@debian.org> - 2025-02-03 15:40 +0100
Bug#1095072: [Debian-med-packaging] Bug#1095072: orthanc: Orthanc crashes with lastest dcmtk or libdcmtk15 security update Étienne Mollier <emollier@debian.org> - 2025-02-03 21:20 +0100
Bug#1095072: orthanc: Orthanc crashes with lastest dcmtk or libdcmtk15 security update Santiago Ruano Rincón <santiagorr@riseup.net> - 2025-02-05 18:10 +0100
| From | inframan@alara-group.fr |
|---|---|
| Date | 2025-02-03 15:20 +0100 |
| Subject | Bug#1095072: orthanc: Orthanc crashes with lastest dcmtk or libdcmtk15 security update |
| Message-ID | <Kc5sR-e5LJ-1@gated-at.bofh.it> |
Package: orthanc Version: 1.9.2+really1.9.1+dfsg-1+deb11u1 Severity: grave Justification: renders package unusable X-Debbugs-Cc: debian-lts@lists.debian.org Dear Maintainer, The last dcmtk/libdcmtk15 security update (3.6.5-1+deb11u1) causes orthanc server to segfault as soon as a dicom file is received. Here is the content of syslog : Feb 3 14:02:27 quaoar systemd[1]: Started Lightweight, RESTful DICOM server for healthcare and medical research. Feb 3 14:02:46 quaoar kernel: [ 2559.234663] Orthanc[16701]: segfault at 312e42 ip 00007fea92533c90 sp 00007fea857f9988 error 4 in libdcmnet.so.15.3.6.5 (deleted)[7fea924cf000+ad000] Feb 3 14:02:46 quaoar kernel: [ 2559.248240] Code: 48 89 c2 48 c7 40 10 00 00 00 00 c6 40 18 00 48 8d 05 04 37 07 00 48 89 02 48 89 5a 20 5b 5d 41 5c e9 64 b4 f9 ff 0f 1f 40 00 <48> 83 7f 10 00 41 54 74 27 48 8b 47 08 48 8b 70 08 80 7e 18 00 75 Feb 3 14:02:46 quaoar systemd[1]: orthanc.service: Main process exited, code=killed, status=11/SEGV Feb 3 14:02:46 quaoar systemd[1]: orthanc.service: Failed with result 'signal'. I have been able to reproduce this crash on a fresh bullseye install with default configuration for everything (and just sending a dicom file on port 4242). Reverting the dcmtk/libdcmtk15 to the previous version (3.6.5-1) solves the problem, but is obviously not an acceptable solution, as it leaves the system with a security hole. Thank you by advance, Nicolas Chamouard -- System Information: Debian Release: 11.11 APT prefers oldstable-updates APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500, 'oldstable') Architecture: amd64 (x86_64) Kernel: Linux 5.10.0-33-cloud-amd64 (SMP w/4 CPU threads) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages orthanc depends on: ii adduser 3.118+deb11u1 ii dcmtk 3.6.5-1 ii init-system-helpers 1.60 ii libboost-filesystem1.74.0 1.74.0-9 ii libboost-iostreams1.74.0 1.74.0-9 ii libboost-locale1.74.0 1.74.0-9 ii libboost-regex1.74.0 [libboost-regex1.74.0-icu67] 1.74.0-9 ii libboost-thread1.74.0 1.74.0-9 ii libc6 2.31-13+deb11u11 ii libcivetweb1 1.13+dfsg-5 ii libcurl4 7.74.0-1.3+deb11u14 ii libdcmtk15 3.6.5-1 ii libgcc-s1 10.2.1-6 ii libjpeg62-turbo 1:2.0.6-4 ii libjsoncpp24 1.9.4-4 ii liblua5.3-0 5.3.3-1.1+deb11u1 ii libpng16-16 1.6.37-3 ii libpugixml1v5 1.11.4-1 ii libsqlite3-0 3.34.1-3+deb11u1 ii libssl1.1 1.1.1w-0+deb11u2 ii libstdc++6 10.2.1-6 ii libuuid1 2.36.1-8+deb11u2 ii locales 2.31-13+deb11u11 ii lsb-base 11.1.0 ii tzdata 2024b-0+deb11u1 ii zlib1g 1:1.2.11.dfsg-2+deb11u2 orthanc recommends no packages. orthanc suggests no packages. -- Configuration Files: /etc/orthanc/credentials.json [Errno 13] Permission non accordée: '/etc/orthanc/credentials.json' /etc/orthanc/orthanc.json changed [not included] -- no debconf information
[toc] | [next] | [standalone]
| From | Adrian Bunk <bunk@debian.org> |
|---|---|
| Date | 2025-02-03 15:40 +0100 |
| Message-ID | <Kc5Me-e5WS-5@gated-at.bofh.it> |
| In reply to | #1231586 |
On Mon, Feb 03, 2025 at 03:15:28PM +0100, inframan@alara-group.fr wrote: >... > Reverting the dcmtk/libdcmtk15 to the previous version (3.6.5-1) solves the problem, but is obviously not an acceptable solution, as it leaves the system with a security hole. Thanks for the report, I'll check how my update broke that. > Thank you by advance, > > Nicolas Chamouard cu Adrian
[toc] | [prev] | [next] | [standalone]
| From | Étienne Mollier <emollier@debian.org> |
|---|---|
| Date | 2025-02-03 21:20 +0100 |
| Subject | Bug#1095072: [Debian-med-packaging] Bug#1095072: orthanc: Orthanc crashes with lastest dcmtk or libdcmtk15 security update |
| Message-ID | <Kcb5f-eaoC-3@gated-at.bofh.it> |
| In reply to | #1231586 |
[Multipart message — attachments visible in raw view] — view raw
Control: reassign 1095072 dcmtk 3.6.5-1+deb11u1 Control: affects 1095072 + orthanc Control: notfound 1095072 dcmtk 3.6.5-1 Control: notfound 1095072 dcmtk 3.6.7-9~deb12u1 Control: fixed 1095072 dcmtk 3.6.8-7 Control: fixed 1095072 dcmtk 3.6.9-1 Hi Sébastien, Thank you for wrapping up the reproducer, it allowed me to check whether the upgrade in preparation for bookworm (#1094991) was affected or not: it is not affected by the regression in its current state (however it remains affected by CVE-2024-24130). I also could verify that dcmtk versions in experimental and in trixie/sid were operating properly while fixing all the known security issues affecting dcmtk lately. Have a nice day, :) -- .''`. Étienne Mollier <emollier@debian.org> : :' : pgp: 8f91 b227 c7d6 f2b1 948c 8236 793c f67e 8f0d 11da `. `' sent from /dev/pts/2, please excuse my verbosity `-
[toc] | [prev] | [next] | [standalone]
| From | Santiago Ruano Rincón <santiagorr@riseup.net> |
|---|---|
| Date | 2025-02-05 18:10 +0100 |
| Message-ID | <KcR4t-eDEf-3@gated-at.bofh.it> |
| In reply to | #1231586 |
[Multipart message — attachments visible in raw view] — view raw
Hi, El 03/02/25 a las 15:15, inframan@alara-group.fr escribió: > Package: orthanc > Version: 1.9.2+really1.9.1+dfsg-1+deb11u1 > Severity: grave > Justification: renders package unusable > X-Debbugs-Cc: debian-lts@lists.debian.org > > Dear Maintainer, > > The last dcmtk/libdcmtk15 security update (3.6.5-1+deb11u1) causes > orthanc server to segfault as soon as a dicom file is received. > > Here is the content of syslog : > Feb 3 14:02:27 quaoar systemd[1]: Started Lightweight, RESTful DICOM server for healthcare and medical research. > Feb 3 14:02:46 quaoar kernel: [ 2559.234663] Orthanc[16701]: segfault at 312e42 ip 00007fea92533c90 sp 00007fea857f9988 error 4 in libdcmnet.so.15.3.6.5 (deleted)[7fea924cf000+ad000] > Feb 3 14:02:46 quaoar kernel: [ 2559.248240] Code: 48 89 c2 48 c7 40 10 00 00 00 00 c6 40 18 00 48 8d 05 04 37 07 00 48 89 02 48 89 5a 20 5b 5d 41 5c e9 64 b4 f9 ff 0f 1f 40 00 <48> 83 7f 10 00 41 54 74 27 48 8b 47 08 48 8b 70 08 80 7e 18 00 75 > Feb 3 14:02:46 quaoar systemd[1]: orthanc.service: Main process exited, code=killed, status=11/SEGV > Feb 3 14:02:46 quaoar systemd[1]: orthanc.service: Failed with result 'signal'. > > I have been able to reproduce this crash on a fresh bullseye install with default > configuration for everything (and just sending a dicom file on port 4242). > > Reverting the dcmtk/libdcmtk15 to the previous version (3.6.5-1) solves the problem, but is obviously not an acceptable solution, as it leaves the system with a security hole. > > Thank you by advance, > > Nicolas Chamouard Thank you for this bug report. For awareness, I am explicitly CCing Adrian, who prepared the dcmtk update. Adrian are you able to look at this? Cheers, -- Santiago
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.dist
csiph-web