Bug#1095072: [Debian-med-packaging] Bug#1095072: orthanc: Orthanc crashes with lastest dcmtk or libdcmtk15 security update

Path	csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod
From	Sébastien Jodogne <s.jodogne@gmail.com>
Newsgroups	linux.debian.bugs.rc
Subject	Bug#1095072: [Debian-med-packaging] Bug#1095072: orthanc: Orthanc crashes with lastest dcmtk or libdcmtk15 security update
Date	Mon, 03 Feb 2025 15:40:02 +0100
Message-ID	<Kc5Me-e5WS-7@gated-at.bofh.it> (permalink)
References	<Kc5sR-e5LJ-1@gated-at.bofh.it> <Kc5sR-e5LJ-1@gated-at.bofh.it>
X-Original-To	inframan@alara-group.fr, 1095072@bugs.debian.org
X-Mailbox-Line	From debian-bugs-rc-request@lists.debian.org Mon Feb 3 14:39:11 2025
Old-Return-Path	<debbugs@buxtehude.debian.org>
X-Spam-Flag	NO
X-Spam-Score	-2.848
Reply-To	Sébastien Jodogne <s.jodogne@gmail.com>, 1095072@bugs.debian.org
Resent-To	debian-bugs-dist@lists.debian.org
Resent-Cc	Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
X-Debian-Pr-Message	followup 1095072
X-Debian-Pr-Package	orthanc
X-Debian-Pr-Source	orthanc
X-Forwarded-Encrypted	i=1; AJvYcCW5OMV1m4liHmc7d++qJre0Uilju4UF3c0tUOvLNdSttqoxAFB1R/geM2/i3oIhZ1+oLihdIoJf@bugs.debian.org
X-Gm-Message-State	AOJu0YwddlpKz+PWIOi7MYLos712EgfUQWkdWBErIw3RpBz1fdhQ8Rnc UZUvx07BknBG39gZF1R+R0pKKmp1lFgaXttJyMCF7/5Mw/DObihaiL8YP844uI8FFTOH5x1j96d OL2xf0UPktEiQBeFYhp3redI45NHkPwJL
X-Gm-Gg	ASbGncvoUIBlFqOtdBVYB9cq/aQBKKuofctDem3hG/t/ii27OSNQXIke8qkE8D0S1oW NZtP5+2c/hEaUKL2uPpiYBXqFTdjJOrhxWQdHX4F9yoc+CLR4eJJyiJG1HBOXRBq98AceB/iKn3 il1OvDMr8fapzBxKqMiT0tQe2mRhZlYA==
X-Google-SMTP-Source	AGHT+IG0ubjUSgRrGdYBYviDUBhqADfCDiX8Ti/w29UUBynMPQIHPz12n3m5n/2XGduH0llTK8EOcYnvOA+/7sHqlis=
X-Received	by 2002:a05:6902:c0e:b0:e58:1246:367e with SMTP id 3f1490d57ef6-e58a4ae972fmr17051607276.20.1738593432351; Mon, 03 Feb 2025 06:37:12 -0800 (PST)
MIME-Version	1.0
X-Gm-Features	AWEUYZmdPgTjEuYcNU4OrRCe1Wgi0jlW565xLgbqp5pfKVeIRSWPtyT8ByZC9Zo
Content-Type	text/plain; charset="UTF-8"
Content-Transfer-Encoding	quoted-printable
X-Crossassassin-Score	2
X-Debian-Message	from BTS
X-Mailing-List	<debian-bugs-rc@lists.debian.org> archive/latest/770964
List-ID	<debian-bugs-rc.lists.debian.org>
List-URL	<https://lists.debian.org/debian-bugs-rc/>
Approved	robomod@news.nic.it
Lines	131
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Cc	Debian Bug Tracking System <submit@bugs.debian.org>
X-Original-Date	Mon, 3 Feb 2025 15:37:01 +0100
X-Original-Message-ID	<CA+Rg+VxM5ejcHE8fWuZ7fRPa+K6cbzg++vLwx6LELeXwB7wGBg@mail.gmail.com>
X-Original-References	<173859212841.35607.15723969298365761187.reportbug@quaoar.c.infrastructure-ae.internal> <173859212841.35607.15723969298365761187.reportbug@quaoar.c.infrastructure-ae.internal>
Xref	csiph.com linux.debian.bugs.rc:383438

Show key headers only | View raw

Hello,

Thanks for the report. However, this bug is not specific to the
"orthanc" package and should be reassigned to the "dcmtk" package.

To reproduce, in terminal 1:

$ docker run --rm -t -i -p 2000:2000 debian:bullseye
# apt update && apt install -y dcmtk
# storescp 2000

In terminal 2:

$ storescu localhost 2000 sample.dcm

This results in a segmentation fault in terminal 1.

A similar issue is reported in Ubuntu 20.04:
https://bugs.launchpad.net/ubuntu/+source/dcmtk/+bug/2081100

Kind Regards,
Sébastien-


On Mon, 3 Feb 2025 at 15:18, <inframan@alara-group.fr> wrote:
>
> Package: orthanc
> Version: 1.9.2+really1.9.1+dfsg-1+deb11u1
> Severity: grave
> Justification: renders package unusable
> X-Debbugs-Cc: debian-lts@lists.debian.org
>
> Dear Maintainer,
>
> The last dcmtk/libdcmtk15 security update (3.6.5-1+deb11u1) causes
> orthanc server to segfault as soon as a dicom file is received.
>
> Here is the content of syslog :
> Feb  3 14:02:27 quaoar systemd[1]: Started Lightweight, RESTful DICOM server for healthcare and medical research.
> Feb  3 14:02:46 quaoar kernel: [ 2559.234663] Orthanc[16701]: segfault at 312e42 ip 00007fea92533c90 sp 00007fea857f9988 error 4 in libdcmnet.so.15.3.6.5 (deleted)[7fea924cf000+ad000]
> Feb  3 14:02:46 quaoar kernel: [ 2559.248240] Code: 48 89 c2 48 c7 40 10 00 00 00 00 c6 40 18 00 48 8d 05 04 37 07 00 48 89 02 48 89 5a 20 5b 5d 41 5c e9 64 b4 f9 ff 0f 1f 40 00 <48> 83 7f 10 00 41 54 74 27 48 8b 47 08 48 8b 70 08 80 7e 18 00 75
> Feb  3 14:02:46 quaoar systemd[1]: orthanc.service: Main process exited, code=killed, status=11/SEGV
> Feb  3 14:02:46 quaoar systemd[1]: orthanc.service: Failed with result 'signal'.
>
> I have been able to reproduce this crash on a fresh bullseye install with default
> configuration for everything (and just sending a dicom file on port 4242).
>
> Reverting the dcmtk/libdcmtk15 to the previous version (3.6.5-1) solves the problem, but is obviously not an acceptable solution, as it leaves the system with a security hole.
>
> Thank you by advance,
>
> Nicolas Chamouard
>
>
> -- System Information:
> Debian Release: 11.11
>   APT prefers oldstable-updates
>   APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500, 'oldstable')
> Architecture: amd64 (x86_64)
>
> Kernel: Linux 5.10.0-33-cloud-amd64 (SMP w/4 CPU threads)
> Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
> Shell: /bin/sh linked to /usr/bin/dash
> Init: systemd (via /run/systemd/system)
> LSM: AppArmor: enabled
>
> Versions of packages orthanc depends on:
> ii  adduser                                            3.118+deb11u1
> ii  dcmtk                                              3.6.5-1
> ii  init-system-helpers                                1.60
> ii  libboost-filesystem1.74.0                          1.74.0-9
> ii  libboost-iostreams1.74.0                           1.74.0-9
> ii  libboost-locale1.74.0                              1.74.0-9
> ii  libboost-regex1.74.0 [libboost-regex1.74.0-icu67]  1.74.0-9
> ii  libboost-thread1.74.0                              1.74.0-9
> ii  libc6                                              2.31-13+deb11u11
> ii  libcivetweb1                                       1.13+dfsg-5
> ii  libcurl4                                           7.74.0-1.3+deb11u14
> ii  libdcmtk15                                         3.6.5-1
> ii  libgcc-s1                                          10.2.1-6
> ii  libjpeg62-turbo                                    1:2.0.6-4
> ii  libjsoncpp24                                       1.9.4-4
> ii  liblua5.3-0                                        5.3.3-1.1+deb11u1
> ii  libpng16-16                                        1.6.37-3
> ii  libpugixml1v5                                      1.11.4-1
> ii  libsqlite3-0                                       3.34.1-3+deb11u1
> ii  libssl1.1                                          1.1.1w-0+deb11u2
> ii  libstdc++6                                         10.2.1-6
> ii  libuuid1                                           2.36.1-8+deb11u2
> ii  locales                                            2.31-13+deb11u11
> ii  lsb-base                                           11.1.0
> ii  tzdata                                             2024b-0+deb11u1
> ii  zlib1g                                             1:1.2.11.dfsg-2+deb11u2
>
> orthanc recommends no packages.
>
> orthanc suggests no packages.
>
> -- Configuration Files:
> /etc/orthanc/credentials.json [Errno 13] Permission non accordée: '/etc/orthanc/credentials.json'
> /etc/orthanc/orthanc.json changed [not included]
>
> -- no debconf information
> _______________________________________________
> Debian-med-packaging mailing list
> Debian-med-packaging@alioth-lists.debian.net
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-med-packaging



-- 
Sébastien Jodogne
Web: https://perso.uclouvain.be/sebastien.jodogne/

Back to linux.debian.bugs.rc | Previous | Next | Find similar | Unroll thread

Thread

Bug#1095072: [Debian-med-packaging] Bug#1095072: orthanc: Orthanc crashes with lastest dcmtk or libdcmtk15 security update Sébastien Jodogne <s.jodogne@gmail.com> - 2025-02-03 15:40 +0100

csiph-web