Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2022-24720

critical

CVE-2022-24720

image_processing is an image processing wrapper for libvips and ImageM ...

Published Modified CWE 20
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Ruby Advisory DB. Rated lower by Ubuntu (medium).

Description

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

Affected packages and fixed versions

SourcePackageFixed in
rubygems::GitHub Security Advisory RubyGemsimage_processing1.12.2
rubygems::Ruby Advisory Databaseimage_processing>= 1.12.2
debian 11ruby-image-processing1.10.3-1+deb11u1
debian 12ruby-image-processing1.10.3-2
echoruby-image-processing1.10.3-2
rapidfort ubuntu 20.04ruby-image-processing0:1.10.3-1ubuntu0.20.04.1
rapidfort ubuntu 22.04ruby-image-processing0:1.10.3-1ubuntu0.20.04.1
rapidfort ubuntu 24.04ruby-image-processing0:1.10.3-1ubuntu0.20.04.1
ubuntu 20.04ruby-image-processing1.10.3-1ubuntu0.20.04.1
ubuntu 20.04-ESMruby-image-processing1.10.3-1ubuntu0.20.04.1
ubuntu 22.04ruby-image-processing1.10.3-1ubuntu0.22.04.1

References

All 9 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.