CVE-2022-24720

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-24720
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24720.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-24720
Aliases
Related
Published
2022-03-01T23:15:08Z
Modified
2024-10-12T09:15:03.158472Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

imageprocessing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the #apply method from imageprocessing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

References

Affected packages

Debian:11 / ruby-image-processing

Package

Name
ruby-image-processing
Purl
pkg:deb/debian/ruby-image-processing?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.10.3-1+deb11u1

Affected versions

1.*

1.10.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / ruby-image-processing

Package

Name
ruby-image-processing
Purl
pkg:deb/debian/ruby-image-processing?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.10.3-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / ruby-image-processing

Package

Name
ruby-image-processing
Purl
pkg:deb/debian/ruby-image-processing?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.10.3-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/janko/image_processing

Affected ranges

Type
GIT
Repo
https://github.com/janko/image_processing
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
038e4574e8f4f4b636a62394e09983c71980dada

Affected versions

v0.*

v0.1.0
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.11.0
v0.11.1
v0.11.2
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.9.0

v1.*

v1.0.0
v1.1.0
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.11.0
v1.12.0
v1.12.1
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.7.1
v1.8.0
v1.9.0
v1.9.1
v1.9.2
v1.9.3