CVE-2019-13574 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 96%

Affected Products (NVD)

Vendor	Product	Version
minimagick_project	minimagick	𝑥 < 4.9.4
debian	debian_linux	9.0
debian	debian_linux	10.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ruby-mini-magick

bookworm	4.11.0-1 fixed
bullseye	4.10.1-1 fixed
sid	4.13.1-1 fixed
trixie	4.13.1-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

ruby-mini-magick

bionic	needed
cosmic	ignored
disco	ignored
eoan	not-affected
focal	not-affected
groovy	not-affected
hirsute	not-affected
impish	not-affected
jammy	not-affected
kinetic	not-affected
lunar	not-affected
mantic	not-affected
noble	not-affected
trusty	dne
xenial	needed

Known Exploits!

Common Weakness Enumeration

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References

https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/

https://github.com/minimagick/minimagick/commit/4cd5081e58810d3394d27a67219e8e4e0445d851

https://github.com/minimagick/minimagick/compare/d484786...293f9bb

https://github.com/minimagick/minimagick/releases/tag/v4.9.4

https://lists.debian.org/debian-lts-announce/2019/10/msg00007.html

https://seclists.org/bugtraq/2019/Jul/20

https://www.debian.org/security/2019/dsa-4481

https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/

https://github.com/minimagick/minimagick/commit/4cd5081e58810d3394d27a67219e8e4e0445d851

https://github.com/minimagick/minimagick/compare/d484786...293f9bb

https://github.com/minimagick/minimagick/releases/tag/v4.9.4

https://lists.debian.org/debian-lts-announce/2019/10/msg00007.html

https://seclists.org/bugtraq/2019/Jul/20

https://www.debian.org/security/2019/dsa-4481