CVE-2022-24720

Published: 1 March 2022

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

Priority

Cvss 3 Severity Score

9.8

Score breakdown

Status

Package	Release	Status
ruby-image-processing Launchpad, Ubuntu, Debian	focal	Released (1.10.3-1ubuntu0.20.04.1)
	impish	Ignored (end of life)
	jammy	Released (1.10.3-1ubuntu0.22.04.1)
	kinetic	Does not exist
	lunar	Ignored (end of life, was needs-triage)
	mantic	Not vulnerable (1.10.3-3)
	noble	Not vulnerable (1.10.3-3)
	trusty	Ignored (end of standard support)
	upstream	Needs triage
	xenial	Ignored (end of standard support)

Severity score breakdown

Parameter	Value
Base score	9.8
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›