In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote     command execution because Image.open input is directly passed to Kernel#open, which accepts a '|'     character followed by a command. (CVE-2019-13574)

Note that Nessus relies on the presence of the package as reported by the vendor.

In lib/mini_magick/image.rb in ruby-mini-magick, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.

For Debian 8 'Jessie', this problem has been fixed in version 3.8.1-1+deb8u1.

We recommend that you upgrade your ruby-mini-magick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Harsh Jaiswal discovered a remote shell execution vulnerability in ruby-mini-magick, a Ruby library providing a wrapper around ImageMagick or GraphicsMagick, exploitable when using MiniMagick::Image.open with specially crafted URLs coming from unsanitized user input.

ID	Name	Product	Family	Severity
256292	Linux Distros Unpatched Vulnerability : CVE-2019-13574	Nessus	Misc.	high
129697	Debian DLA-1948-1 : ruby-mini-magick security update	Nessus	Debian Local Security Checks	high
126656	Debian DSA-4481-1 : ruby-mini-magick - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-13574

high

Tenable Plugins

high

high

high