RubyGems/mini_magick CVE-2019-13574: high 7.8, EPSS 7.64%

OS Command Injection in MiniMagick

Action: Upgrade mini_magick to 4.9.4 or later.

bundle update mini_magick

Affected

Fixed versions

Sources

• osv: GHSA-r7j3-vvh2-xrpj
• https://nvd.nist.gov/vuln/detail/CVE-2019-13574
• https://github.com/minimagick/minimagick/commit/4cd5081e58810d3394d27a67219e8e4e0445d851
• https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4
• https://github.com/minimagick/minimagick
• https://github.com/minimagick/minimagick/compare/d484786...293f9bb
• https://github.com/minimagick/minimagick/releases/tag/v4.9.4
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mini_magick/CVE-2019-13574.yml
• https://lists.debian.org/debian-lts-announce/2019/10/msg00007.html
• https://seclists.org/bugtraq/2019/Jul/20
• https://www.debian.org/security/2019/dsa-4481

CVE-2019-13574 · published 2019-07-18T13:19:22Z · modified 2024-02-19T05:32:31.104648Z · JSON