CVE-2024-28130: 
NixOS vulnerability analysis and mitigation

An incorrect type conversion vulnerability was discovered in OFFIS DCMTK 3.6.8, specifically in the DVPSSoftcopyVOI_PList::createFromImage functionality. The vulnerability was assigned CVE-2024-28130 and was publicly disclosed on April 23, 2024. DCMTK is a collection of libraries and applications implementing large parts of the DICOM standard for medical images (Talos Report).

The vulnerability stems from an incorrect type conversion in the DVPSSoftcopyVOI_PList::createFromImage function. The issue occurs due to a missing check type of the record processed, which can lead to an invalid cast when handling DICOM files. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified as CWE-704 (Incorrect Type Conversion or Cast) (Talos Report).

When successfully exploited, this vulnerability can lead to arbitrary code execution. The vulnerability affects the availability of the system, as indicated by the CVSS scoring, while confidentiality and integrity remain unaffected (Talos Report).

The vulnerability can be triggered by providing a specially crafted malformed DICOM file to the application. The attack vector is network-accessible, requires low attack complexity, and needs no privileges or user interaction to exploit (Talos Report).

The vendor has provided an update in their Git repository to address this vulnerability. Multiple Linux distributions have also released security updates, including Debian which has fixed the issue in version 3.6.4-2.1+deb10u1 (Debian LTS).