We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent 40cb86d commit 9a02e69Copy full SHA for 9a02e69
gems/mini_magick/CVE-2019-13574.yml
@@ -1,10 +1,14 @@
1
gem: mini_magick
2
cve: 2019-13574
3
-url: https://github.com/minimagick/minimagick/releases/tag/v4.9.4
+url: https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/
4
title: Remote command execution via filename
5
date: 2019-07-12
6
description: |
7
A remote shell execution vulnerability when using MiniMagick::Image.open with URL coming from unsanitized user input.
8
e.g. `MiniMagick::Image.open("| touch.txt")`
9
+cvss_v3: 7.5
10
patched_versions:
11
- ">= 4.9.4"
12
+related:
13
+ url:
14
+ - https://github.com/minimagick/minimagick/commit/4cd5081e58810d3394d27a67219e8e4e0445d851
0 commit comments