Bug 834455 (CVE-2022-24720)

Summary:	<dev-ruby/image_processing-1.12.2: code execution via #apply method
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial	CC:	ruby
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446
Whiteboard:	~1 [noglsa]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-03-02 02:24:30 UTC

CVE-2022-24720:

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

Patch: https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dada):

Fixed in 1.12.2, please bump.

Comment 1 Larry the Git Cow gentoo-dev

2022-03-14 06:34:02 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7d2de1a3e6afc0783825a318a6a9547fccb23bda

commit 7d2de1a3e6afc0783825a318a6a9547fccb23bda
Author:     Hans de Graaff <graaff@gentoo.org>
AuthorDate: 2022-03-13 08:54:37 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2022-03-14 06:33:57 +0000

    dev-ruby/image_processing: add 1.12.2
    
    Bug: https://bugs.gentoo.org/834455
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 dev-ruby/image_processing/Manifest                 |  1 +
 .../image_processing-1.12.2.ebuild                 | 45 ++++++++++++++++++++++
 2 files changed, 46 insertions(+)

Comment 2 John Helmert III archtester

2022-03-15 03:56:42 UTC

Thanks, all done!