CVE-2019-13574: OS Command Injection
In lib/minimagick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a | character followed by a command.
Other sources
In lib/minimagick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-13574?
CVE-2019-13574 has a medium severity rating due to its potential for remote command execution.
How do I fix CVE-2019-13574?
To fix CVE-2019-13574, update MiniMagick to version 4.9.4 or later.
What software is affected by CVE-2019-13574?
CVE-2019-13574 affects MiniMagick versions prior to 4.9.4, including various Debian Ruby packages.
Can CVE-2019-13574 lead to a security breach?
Yes, CVE-2019-13574 can lead to a security breach through remote command execution if exploited.
Is it safe to use MiniMagick versions below 4.9.4 after the CVE-2019-13574 disclosure?
No, it is not safe to use MiniMagick versions below 4.9.4 after the disclosure of CVE-2019-13574.