CVE-2021-45463: High severity gegl vulnerability
loadcache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-45463.
What is the severity of CVE-2021-45463?
The severity of CVE-2021-45463 is high with a score of 7.8.
What is the affected software?
The affected software includes GEGL before version 0.4.34, GIMP before version 2.10.30, RedHat Enterprise Linux 7.0 and 8.0, and Fedora 34 and 35.
What is the cause of CVE-2021-45463?
The vulnerability is caused by the use of the system library function for execution of the ImageMagick convert fallback in magick-load.
How can I fix CVE-2021-45463?
To fix CVE-2021-45463, update GEGL to version 0.4.34 or later.