{"id":"openSUSE-SU-2022:10144-1","summary":"Security update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer","details":"This update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer fixes the following issues:\n\nChanges in gdcm:\n\n- Provides/obsoletes moved to lbgdcm-package (Thx DimStar)\n- rename of gdcm-libgdcm3_0 to libgdcm3_0 (proposal S. Br�ns)\n\n- version 3.0.18\n\n  no changelog\n\n- version 3.0.12\n\n  * support for poppler 22.03 added\n\n- version 3.0.11\n\n  * Fix for a significant issue with JPEG-LS and RGB color space\n  * tons of small bug fixes\n\n- version 3.0.10 (no changelog)\n\nChanges in orthanc-gdcm:\n\n- changed dependency gdcm-libgdcm3_0 -\u003e libgdcm3_0\n\n- Version 1.5 \n\n* Take the configuration option 'RestrictTransferSyntaxes' into\n  account not only for decoding, but also for transcoding\n* Upgrade to GDCM 3.0.10 for static builds- \n\nChanges in orthanc:\n\n- version 1.11.2\n  * Added support for RGBA64 images in tools/create-dicom and /preview\n  * New configuration 'MaximumStorageMode' to choose between recyling of\n    old patients (default behavior) and rejection of new incoming data when\n    the MaximumStorageSize has been reached.\n  * New sample plugin: 'DelayedDeletion' that will delete files from disk\n    asynchronously to speed up deletion of large studies.\n  * Lua: new 'SetHttpTimeout' function\n  * Lua: new 'OnHeartBeat' callback called at regular interval provided that\n       you have configured 'LuaHeartBeatPeriod' \u003e 0.\n  * 'ExtraMainDicomTags' configuration now accepts Dicom Sequences.  Sequences are\n    stored in a dedicated new metadata 'MainDicomSequences'.  This should improve\n    DicomWeb QIDO-RS and avoid warnings like 'Accessing Dicom tags from storage when \n    accessing series : 0040,0275'.\n    Main dicom sequences can now be returned in 'MainDicomTags' and in 'RequestedTags'.\n  * Fix the 'Never' option of the 'StorageAccessOnFind' that was sill accessing\n    files (bug introduced in 1.11.0).\n  * Fix the Storage Cache for compressed files (bug introduced in 1.11.1).\n  * Fix the storage cache that was not used by the Plugin SDK.  This fixes the \n    DicomWeb plugin '/rendered' route performance issues.\n  * DelayedDeletion plugin: Fix leaking of symbols\n  * SQLite now closes and deletes WAL and SHM files on exit.  This should improve\n    handling of SQLite DB over network drives.\n  * Fix static compilation of boost 1.69 on Ubuntu 22.04\n  * Upgraded dependencies for static builds:\n    - boost 1.80.0\n    - dcmtk 3.6.7  (fixes CVE-2022-2119 and CVE-2022-2120)\n    - openssl 3.0.5\n  * Housekeeper plugin: Fix resume of previous processing\n  * Added missing MOVEPatientRootQueryRetrieveInformationModel in \n    DicomControlUserConnection::SetupPresentationContexts()\n  * Improved HttpClient error logging (add method + url)\n  * API version upgraded to 18\n  * /system is now reporting 'DatabaseServerIdentifier'\n  * Added an Asynchronous mode to /modalities/../move.\n  * 'RequestedTags' option can now include DICOM sequences.\n  * New function in the SDK: 'OrthancPluginGetDatabaseServerIdentifier'\n  * DicomMap::ParseMainDicomTags has been deprecated -\u003e retrieve 'full' tags\n    and use DicomMap::FromDicomAsJson instead\n\n- version 1.11.0\n\n* new API version 1.7\n* new configuration parameter\n* for detailed changelog see NEWS\n\n- version 1.10.1\n\n* for detailed changelog see NEWS\n\n- Version 1.9.7\n\n* New configuration option 'DicomAlwaysAllowMove' to disable verification of\n  the remote modality in C-MOVE SCP\n* API version upgraded to 15\n* Added 'Level' option to POST /tools/bulk-modify\n* Added missing OpenAPI documentation of 'KeepSource' in '.../modify' and '.../anonymize'\n* Added file CITATION.cff\n* Linux Standard Base (LSB) builds of Orthanc can load non-LSB builds of plugins\n* Fix upload of ZIP archives containing a DICOMDIR file\n* Fix computation of the estimated time of arrival in jobs\n* Support detection of windowing and rescale in Philips multiframe images \n\nChanges in orthanc-webviewer:\n\n- version 2.8\n  * Fix XSS inside DICOM in Orthanc Web Viewer (as reported by Stuart\n    Kurutac, NCC Group)\n  * framework190.diff removed (covered in actual version)  \n","modified":"2026-01-30T01:32:14.607818Z","published":"2022-10-12T15:35:18Z","related":["CVE-2022-2119","CVE-2022-2120"],"upstream":["CVE-2022-2119","CVE-2022-2120"],"references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/K67WDY4JVASQKGAJHGMCE45SJSPPFKPM/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1181400"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-2119"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-2120"}],"affected":[{"package":{"name":"gdcm","ecosystem":"SUSE:Package Hub 15 SP3","purl":"pkg:rpm/suse/gdcm&distro=SUSE%20Package%20Hub%2015%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-bp153.2.8.1"}]}],"ecosystem_specific":{"binaries":[{"gdcm-applications":"3.0.19-bp153.2.8.1","gdcm-devel":"3.0.19-bp153.2.8.1","libgdcm3_0":"3.0.19-bp153.2.8.1","orthanc-devel":"1.11.2-bp153.2.13.1","orthanc-doc":"1.11.2-bp153.2.13.1","orthanc-gdcm":"1.5-bp153.2.6.1","orthanc":"1.11.2-bp153.2.13.1","gdcm-examples":"3.0.19-bp153.2.8.1","gdcm":"3.0.19-bp153.2.8.1","libsocketxx1_2":"3.0.19-bp153.2.8.1","orthanc-source":"1.11.2-bp153.2.13.1","orthanc-webviewer":"2.8-bp153.2.3.1","python3-gdcm":"3.0.19-bp153.2.8.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2022:10144-1.json"}},{"package":{"name":"orthanc","ecosystem":"SUSE:Package Hub 15 SP3","purl":"pkg:rpm/suse/orthanc&distro=SUSE%20Package%20Hub%2015%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-bp153.2.13.1"}]}],"ecosystem_specific":{"binaries":[{"orthanc":"1.11.2-bp153.2.13.1","gdcm":"3.0.19-bp153.2.8.1","libsocketxx1_2":"3.0.19-bp153.2.8.1","orthanc-devel":"1.11.2-bp153.2.13.1","orthanc-webviewer":"2.8-bp153.2.3.1","python3-gdcm":"3.0.19-bp153.2.8.1","gdcm-applications":"3.0.19-bp153.2.8.1","gdcm-devel":"3.0.19-bp153.2.8.1","gdcm-examples":"3.0.19-bp153.2.8.1","libgdcm3_0":"3.0.19-bp153.2.8.1","orthanc-doc":"1.11.2-bp153.2.13.1","orthanc-gdcm":"1.5-bp153.2.6.1","orthanc-source":"1.11.2-bp153.2.13.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2022:10144-1.json"}},{"package":{"name":"orthanc-gdcm","ecosystem":"SUSE:Package Hub 15 SP3","purl":"pkg:rpm/suse/orthanc-gdcm&distro=SUSE%20Package%20Hub%2015%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-bp153.2.6.1"}]}],"ecosystem_specific":{"binaries":[{"gdcm-devel":"3.0.19-bp153.2.8.1","gdcm-examples":"3.0.19-bp153.2.8.1","gdcm":"3.0.19-bp153.2.8.1","libgdcm3_0":"3.0.19-bp153.2.8.1","orthanc-gdcm":"1.5-bp153.2.6.1","python3-gdcm":"3.0.19-bp153.2.8.1","gdcm-applications":"3.0.19-bp153.2.8.1","libsocketxx1_2":"3.0.19-bp153.2.8.1","orthanc-devel":"1.11.2-bp153.2.13.1","orthanc-doc":"1.11.2-bp153.2.13.1","orthanc-source":"1.11.2-bp153.2.13.1","orthanc-webviewer":"2.8-bp153.2.3.1","orthanc":"1.11.2-bp153.2.13.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2022:10144-1.json"}},{"package":{"name":"orthanc-webviewer","ecosystem":"SUSE:Package Hub 15 SP3","purl":"pkg:rpm/suse/orthanc-webviewer&distro=SUSE%20Package%20Hub%2015%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-bp153.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"gdcm":"3.0.19-bp153.2.8.1","libsocketxx1_2":"3.0.19-bp153.2.8.1","orthanc-devel":"1.11.2-bp153.2.13.1","orthanc-webviewer":"2.8-bp153.2.3.1","orthanc":"1.11.2-bp153.2.13.1","python3-gdcm":"3.0.19-bp153.2.8.1","gdcm-applications":"3.0.19-bp153.2.8.1","libgdcm3_0":"3.0.19-bp153.2.8.1","orthanc-doc":"1.11.2-bp153.2.13.1","orthanc-gdcm":"1.5-bp153.2.6.1","orthanc-source":"1.11.2-bp153.2.13.1","gdcm-devel":"3.0.19-bp153.2.8.1","gdcm-examples":"3.0.19-bp153.2.8.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2022:10144-1.json"}},{"package":{"name":"gdcm","ecosystem":"openSUSE:Leap 15.3","purl":"pkg:rpm/opensuse/gdcm&distro=openSUSE%20Leap%2015.3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-bp153.2.8.1"}]}],"ecosystem_specific":{"binaries":[{"gdcm":"3.0.19-bp153.2.8.1","libsocketxx1_2":"3.0.19-bp153.2.8.1","orthanc-doc":"1.11.2-bp153.2.13.1","orthanc-source":"1.11.2-bp153.2.13.1","orthanc-webviewer":"2.8-bp153.2.3.1","python3-gdcm":"3.0.19-bp153.2.8.1","gdcm-devel":"3.0.19-bp153.2.8.1","gdcm-examples":"3.0.19-bp153.2.8.1","libgdcm3_0":"3.0.19-bp153.2.8.1","orthanc-devel":"1.11.2-bp153.2.13.1","orthanc-gdcm":"1.5-bp153.2.6.1","orthanc":"1.11.2-bp153.2.13.1","gdcm-applications":"3.0.19-bp153.2.8.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2022:10144-1.json"}},{"package":{"name":"orthanc","ecosystem":"openSUSE:Leap 15.3","purl":"pkg:rpm/opensuse/orthanc&distro=openSUSE%20Leap%2015.3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-bp153.2.13.1"}]}],"ecosystem_specific":{"binaries":[{"orthanc-doc":"1.11.2-bp153.2.13.1","orthanc-source":"1.11.2-bp153.2.13.1","orthanc-webviewer":"2.8-bp153.2.3.1","python3-gdcm":"3.0.19-bp153.2.8.1","gdcm-devel":"3.0.19-bp153.2.8.1","libgdcm3_0":"3.0.19-bp153.2.8.1","libsocketxx1_2":"3.0.19-bp153.2.8.1","orthanc-gdcm":"1.5-bp153.2.6.1","orthanc":"1.11.2-bp153.2.13.1","gdcm-applications":"3.0.19-bp153.2.8.1","gdcm-examples":"3.0.19-bp153.2.8.1","gdcm":"3.0.19-bp153.2.8.1","orthanc-devel":"1.11.2-bp153.2.13.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2022:10144-1.json"}},{"package":{"name":"orthanc-gdcm","ecosystem":"openSUSE:Leap 15.3","purl":"pkg:rpm/opensuse/orthanc-gdcm&distro=openSUSE%20Leap%2015.3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-bp153.2.6.1"}]}],"ecosystem_specific":{"binaries":[{"libsocketxx1_2":"3.0.19-bp153.2.8.1","orthanc-doc":"1.11.2-bp153.2.13.1","orthanc-source":"1.11.2-bp153.2.13.1","orthanc-webviewer":"2.8-bp153.2.3.1","orthanc":"1.11.2-bp153.2.13.1","gdcm-applications":"3.0.19-bp153.2.8.1","gdcm-examples":"3.0.19-bp153.2.8.1","gdcm":"3.0.19-bp153.2.8.1","libgdcm3_0":"3.0.19-bp153.2.8.1","orthanc-devel":"1.11.2-bp153.2.13.1","orthanc-gdcm":"1.5-bp153.2.6.1","python3-gdcm":"3.0.19-bp153.2.8.1","gdcm-devel":"3.0.19-bp153.2.8.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2022:10144-1.json"}},{"package":{"name":"orthanc-webviewer","ecosystem":"openSUSE:Leap 15.3","purl":"pkg:rpm/opensuse/orthanc-webviewer&distro=openSUSE%20Leap%2015.3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-bp153.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"orthanc-source":"1.11.2-bp153.2.13.1","python3-gdcm":"3.0.19-bp153.2.8.1","gdcm-applications":"3.0.19-bp153.2.8.1","gdcm-devel":"3.0.19-bp153.2.8.1","gdcm":"3.0.19-bp153.2.8.1","libgdcm3_0":"3.0.19-bp153.2.8.1","orthanc-devel":"1.11.2-bp153.2.13.1","orthanc-webviewer":"2.8-bp153.2.3.1","orthanc":"1.11.2-bp153.2.13.1","gdcm-examples":"3.0.19-bp153.2.8.1","libsocketxx1_2":"3.0.19-bp153.2.8.1","orthanc-doc":"1.11.2-bp153.2.13.1","orthanc-gdcm":"1.5-bp153.2.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2022:10144-1.json"}}],"schema_version":"1.7.3"}