CVE-2022-24720: Improper Input Validation in image_processing
First published: Tue Mar 01 2022(Updated: )
image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/ruby-image-processing | 1.10.3-1+deb11u1 1.10.3-3 | |
| Image Processing Project Image Processing | <1.12.2 | |
| Debian Debian Linux | =11.0 | |
| ubuntu/ruby-image-processing | <1.10.3-1ubuntu0.20.04.1 | 1.10.3-1ubuntu0.20.04.1 |
| ubuntu/ruby-image-processing | <1.10.3-1ubuntu0.22.04.1 | 1.10.3-1ubuntu0.22.04.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2022-24720
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24720
- https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446
- https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dada
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1007225
- https://www.debian.org/security/2022/dsa-5310
- https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dada (v1.12.2)
- https://ubuntu.com/security/notices/USN-6675-1
- https://nvd.nist.gov/vuln/detail/CVE-2022-24720
- https://launchpad.net/bugs/cve/CVE-2022-24720
- https://ubuntu.com/security/CVE-2022-24720
- collector/debian-bugs
- alias/CVE-2022-24720
- collector/nvd-index
- agent/type
- agent/weakness
- agent/remedy
- collector/usn-cve
- source/Ubuntu
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/references
- agent/description
- agent/first-publish-date
- collector/nvd-cve
- source/NVD
- agent/author
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/severity
- agent/event
- agent/tags
- agent/trending
- vendor/image processing project
- canonical/image processing project image processing
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/11.0
- package-manager/ubuntu
- package-manager/debian