REDHAT-BUG-2488744: Command Injection
GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in makefilehandle.
GD::Image::makefilehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. makefilehandle is the single open path behind every filename-accepting constructor (new, newFromPng, newFromJpeg, and the rest); the in-memory Data variants do not open a path and are unaffected.
Any caller that forwards untrusted input to one of these constructors as a pathname can run an arbitrary command or truncate a file under the process UID.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GD (Perl)to a version that resolves this vulnerability.Fixed in 2.86 - Configuration
Avoid calling GD::Image filename-accepting constructors (new, newFromPng, newFromJpeg, and others that route to GD::Image::_make_filehandle). If possible, use the in-memory *Data variants, since they do not open a path and are unaffected by the 2-arg open() issue.
GD::Image Use in-memory *Data variants instead of filename-accepting constructors = Use *Data variants (e.g., in-memory Data variants) and avoid pathname-based constructors - Configuration
If you must use pathname-based constructors, ensure untrusted input is not used as the filename/path argument and do not allow pathnames that begin or end with a pipe ("| cmd", "cmd |") or begin with a redirect ("> path", ">> path"); these are interpreted as commands/redirects by the vulnerable 2-arg open().
GD::Image::_make_filehandle (input pathname to Perl 2-arg open()) Restrict pathname values = Reject/avoid pathnames that begin or end with a pipe or begin with a redirect
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2488744?
The severity of REDHAT-BUG-2488744 is rated at 73, indicating a high level of risk.
How do I fix REDHAT-BUG-2488744?
To fix REDHAT-BUG-2488744, update your Perl GD and Perl GD::Image packages to versions 2.86 or later.
What is the impact of REDHAT-BUG-2488744?
The impact of REDHAT-BUG-2488744 includes potential OS command injection and file overwrite vulnerabilities.
Which software is affected by REDHAT-BUG-2488744?
The software affected by REDHAT-BUG-2488744 includes Perl GD and Perl GD::Image.
What kind of vulnerabilities are associated with REDHAT-BUG-2488744?
REDHAT-BUG-2488744 is associated with command injection and OS command injection vulnerabilities.