Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: dcmtk@packages.debian.org
Control: affects -1 + src:dcmtk
User: release.debian.org@packages.debian.org
Usertags: pu

Hi Stable Release Managers,

[ Reason ]
dcmtk 3.6.9-5+deb13u2 in trixie is affected by the following
vulnerabilities, reported via #1141411 by the security team:

  * CVE-2026-50003: a risk of path traversal,
  * CVE-2026-50254: a risk of denial of service,
  * CVE-2026-35505: a risk of denial of service,
  * CVE-2026-52868: risks of information leak,
  * CVE-2026-44628: a risk of denial of service.

Our assessment is that a proposed update is preferable in that
case, instead of going through a Debian Security Advisory, hence
the present request.

[ Impact ]
If the update is not approved, dcmtk will remain affected by the
aforementioned issues.

[ Tests ]
The mitigations agaist CVE-2026-35505 and CVE-2026-52868 are
accompanied by updates of the test suite, which is run at build
time.  Not all mitigations shipped with test items though.

I have also made sure that the changes were not affecting
reverse dependencies, by running their autopkgtest, for those
which have one.  While I was at it, I also verified direct
reverse build dependencies were rebuilding fine.

[ Risks ]
There are a lot of changes and I don't necessarily make properly
sense of everything that has been modified.

On the other hand, the issues are fixed in unstable and the
package shown no difficulties migrating to forky.  For now there
were no bug reports about regressions caused by the changes.

[ Checklist ]
  [*] *all* changes are documented in the d/changelog
  [*] I reviewed all changes and I approve them
  [*] attach debdiff against the package in stable
  [*] the issue is verified as fixed in unstable

[ Changes ]
0020-CVE-2026-50003.patch contains upstream commit fixing the
risk of path traversal.  It does so by defining uidForFilename,
sanitizing it and use it for the rest of the processing.

0021-CVE-2026-50254.patch contains upstream commit fixing the
leak causing the risk of denial of service.  It does so by
adding the missing code to free appropriately the extNeg object
and return (presumably in error) before the function/method goes
further.  The upstream patch is cluttered by adjustments to
comments.  I left them to facilitate comparison, should anyone
want to audit my changes based on upstream commits.

0022-CVE-2026-35505.patch contains upstream commit fixing the
leak causing the second risk of denial of service.  It does so
by invoking the relevant destructor functions before returning
the errors in the branchs missing the ressource freeing steps.
This patch also introduces test items, resulting in testable
code, but also inflated patch.

0023-CVE-2026-52868.patch contains upstream commit fixing the
risks of information leak.  It does so by dropping a buggy
sanitizeAETitle function local to the scope of the file
dcmnet/apps/storescp.cc and replaces it by a new generic
counterpart OFStandard::sanitizeAETitle where invoked.  Given
that tackling the second leak slightly changes the behavior of
the wlmcpfs, the manual page is also adjusted.  Remark that this
change introduces a new symbol IsValidAETitleForFilesystem via
the header file dcmwlm/include/dcmtk/dcmwlm/wlfsim.h, therefore
breaking reverse compatibility with the older abi I guess.  The
next hunk implements the method IsValidAETitleForFilesystem,
which checks for various basics about file name validity and
sprinkles it at various locations where changes are needed.
Addition of relevant test items in the upstream test suite
contributes to a fair fraction of the rest of the patch size.
Note there is a change to ofstd/include/dcmtk/ofstd/ofstd.h
hidden after test hunks, which declares the sanitizeAETitle
redefined earlier in the patch.  dcmtk/ofstd/libsrc/ofstd.cc
shows where the fixed OFStandard::sanitizeAETitle has been
implemented.  Further tests for the new sanitizer are defined,
and that's the end of the patch.

0024-CVE-2026-44628a.patch contains upstream commit fixing part
of the third risk of denial of service.  I have difficulties
making sense of what happens here.  If I understand correctly,
a number of findAndGetElement invocations get replaced by
findAndGetSequence, causing further changes in the hunks to
eventually adjust to the new type; interestingly, there are
cases where this resolves uses of existing type casts,
suggesting the use of findAndGetSequence would have been more
appropriate in the first place.

0025-CVE-2026-44628b.patch contains upstream commit fixing the
second part of the third risk of denial of service.  It extend
the previously introduced fix at a number of further locations.

[ Other info ]
Have a nice day,  :)