High severityNVD Advisory· Published Jul 12, 2019· Updated Aug 4, 2024
CVE-2019-13574
CVE-2019-13574
Description
In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mini_magickRubyGems | < 4.9.4 | 4.9.4 |
Affected products
2- MiniMagick/MiniMagickdescription
Patches
Vulnerability mechanics
References
11- github.com/advisories/GHSA-r7j3-vvh2-xrpjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-13574ghsaADVISORY
- www.debian.org/security/2019/dsa-4481ghsavendor-advisoryx_refsource_DEBIANWEB
- benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4ghsaWEB
- benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/mitrex_refsource_MISC
- github.com/minimagick/minimagick/commit/4cd5081e58810d3394d27a67219e8e4e0445d851ghsax_refsource_MISCWEB
- github.com/minimagick/minimagick/compare/d484786...293f9bbghsax_refsource_MISCWEB
- github.com/minimagick/minimagick/releases/tag/v4.9.4ghsax_refsource_MISCWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/mini_magick/CVE-2019-13574.ymlghsaWEB
- lists.debian.org/debian-lts-announce/2019/10/msg00007.htmlghsamailing-listx_refsource_MLISTWEB
- seclists.org/bugtraq/2019/Jul/20ghsamailing-listx_refsource_BUGTRAQWEB
News mentions
0No linked articles in our index yet.