Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
amazonAmazonALAS-2021-1479
HistoryFeb 16, 2021 - 12:13 a.m.

Important: ImageMagick

2021-02-1600:13:00
alas.aws.amazon.com
20
imagemagick
shell commands
pdf
data confidentiality
system availability
integrity
update
vulnerability
red hat
mitre

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

50.0%

JSON

Issue Overview:

A flaw was found in ImageMagick. The -authenticate option is mishandled allowing user-controlled password set for a PDF file to possibly inject additional shell commands via coders/pdf.c. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-29599)

Affected Packages:

ImageMagick

Issue Correction:
Run yum update ImageMagick to update your system.

New Packages:

i686:  
    ImageMagick-c++-devel-6.9.10.68-3.23.amzn1.i686  
    ImageMagick-perl-6.9.10.68-3.23.amzn1.i686  
    ImageMagick-devel-6.9.10.68-3.23.amzn1.i686  
    ImageMagick-6.9.10.68-3.23.amzn1.i686  
    ImageMagick-c++-6.9.10.68-3.23.amzn1.i686  
    ImageMagick-debuginfo-6.9.10.68-3.23.amzn1.i686  
    ImageMagick-doc-6.9.10.68-3.23.amzn1.i686  
  
src:  
    ImageMagick-6.9.10.68-3.23.amzn1.src  
  
x86_64:  
    ImageMagick-6.9.10.68-3.23.amzn1.x86_64  
    ImageMagick-devel-6.9.10.68-3.23.amzn1.x86_64  
    ImageMagick-doc-6.9.10.68-3.23.amzn1.x86_64  
    ImageMagick-c++-devel-6.9.10.68-3.23.amzn1.x86_64  
    ImageMagick-debuginfo-6.9.10.68-3.23.amzn1.x86_64  
    ImageMagick-c++-6.9.10.68-3.23.amzn1.x86_64  
    ImageMagick-perl-6.9.10.68-3.23.amzn1.x86_64

Additional References

Red Hat: CVE-2020-29599

Mitre: CVE-2020-29599

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686imagemagick-c++-devel< 6.9.10.68-3.23.amzn1ImageMagick-c++-devel-6.9.10.68-3.23.amzn1.i686.rpm
Amazon Linux1i686imagemagick-perl< 6.9.10.68-3.23.amzn1ImageMagick-perl-6.9.10.68-3.23.amzn1.i686.rpm
Amazon Linux1i686imagemagick-devel< 6.9.10.68-3.23.amzn1ImageMagick-devel-6.9.10.68-3.23.amzn1.i686.rpm
Amazon Linux1i686imagemagick< 6.9.10.68-3.23.amzn1ImageMagick-6.9.10.68-3.23.amzn1.i686.rpm
Amazon Linux1i686imagemagick-c++< 6.9.10.68-3.23.amzn1ImageMagick-c++-6.9.10.68-3.23.amzn1.i686.rpm
Amazon Linux1i686imagemagick-debuginfo< 6.9.10.68-3.23.amzn1ImageMagick-debuginfo-6.9.10.68-3.23.amzn1.i686.rpm
Amazon Linux1i686imagemagick-doc< 6.9.10.68-3.23.amzn1ImageMagick-doc-6.9.10.68-3.23.amzn1.i686.rpm
Amazon Linux1x86_64imagemagick< 6.9.10.68-3.23.amzn1ImageMagick-6.9.10.68-3.23.amzn1.x86_64.rpm
Amazon Linux1x86_64imagemagick-devel< 6.9.10.68-3.23.amzn1ImageMagick-devel-6.9.10.68-3.23.amzn1.x86_64.rpm
Amazon Linux1x86_64imagemagick-doc< 6.9.10.68-3.23.amzn1ImageMagick-doc-6.9.10.68-3.23.amzn1.x86_64.rpm
Rows per page:
1-10 of 141

Related

ubuntucve 1
nessus 26
f5 1
nvd 1
cloudlinux 1
centos 1
osv 5
prion 1
oraclelinux 1
openvas 13
cvelist 1
alpinelinux 1
redhat 1
gentoo 1
amazon 1
redhatcve 1
veracode 1
checkpoint_advisories 1
debiancve 1
cve 1
freebsd 2
debian 2
cloudfoundry 1
ubuntu 2
suse 2
ubuntucve
ubuntucve
CVE-2020-29599
2020-12-07 00:00:00
nessus
nessus
Scientific Linux Security Update : ImageMagick on SL7.x i686/x86_64 (2021:0024)
2021-01-05 00:00:00
ImageMagick < 6.9.11-40 / 7.x < 7.0.10-40 -authenticate Option Command Injection
2020-12-18 00:00:00
Amazon Linux AMI : ImageMagick (ALAS-2021-1479)
2021-02-18 00:00:00
f5
f5
K87235248 : ImageMagick vulnerability CVE-2020-29599
2021-04-12 00:00:00
nvd
nvd
CVE-2020-29599
2020-12-07 20:15:12
cloudlinux
cloudlinux
Fix of Add fix for CVE-2020-29599
2021-04-05 16:47:45
centos
centos
ImageMagick security update
2021-02-27 14:21:05
osv
osv
CVE-2020-29599
2020-12-07 20:15:12
imagemagick - security update
2021-01-12 00:00:00
imagemagick vulnerabilities
2023-07-04 09:23:39
prion
prion
Default credentials
2020-12-07 20:15:00
oraclelinux
oraclelinux
ImageMagick security update
2021-01-05 00:00:00
openvas
openvas
CentOS: Security Advisory for ImageMagick (CESA-2021:0024)
2021-02-28 00:00:00
Huawei EulerOS: Security Advisory for ImageMagick (EulerOS-SA-2021-1147)
2021-02-02 00:00:00
Huawei EulerOS: Security Advisory for ImageMagick (EulerOS-SA-2021-1682)
2021-03-24 00:00:00
cvelist
cvelist
CVE-2020-29599
2020-12-07 00:00:00
alpinelinux
alpinelinux
CVE-2020-29599
2020-12-07 20:15:12
redhat
redhat
(RHSA-2021:0024) Important: ImageMagick security update
2021-01-05 13:40:21
gentoo
gentoo
ImageMagick: Command injection
2021-01-29 00:00:00
amazon
amazon
Important: ImageMagick
2021-02-17 00:44:00
redhatcve
redhatcve
CVE-2020-29599
2020-12-14 14:57:28
veracode
veracode
Injection
2020-12-12 16:40:25
checkpoint_advisories
checkpoint_advisories
ImageMagick Command Injection (CVE-2020-29599)
2021-05-02 00:00:00
debiancve
debiancve
CVE-2020-29599
2020-12-07 20:15:12
cve
cve
CVE-2020-29599
2020-12-07 20:15:12
freebsd
freebsd
ImageMagick6 -- multiple vulnerabilities
2020-12-17 00:00:00
ImageMagick7 -- multiple vulnerabilities
2020-10-27 00:00:00
debian
debian
[SECURITY] [DLA 2523-1] imagemagick security update
2021-01-12 17:43:56
[SECURITY] [DLA 3357-1] imagemagick security update
2023-03-11 19:39:30
cloudfoundry
cloudfoundry
USN-6200-1: ImageMagick vulnerabilities | Cloud Foundry
2024-08-22 00:00:00
ubuntu
ubuntu
ImageMagick vulnerabilities
2023-07-04 00:00:00
ImageMagick vulnerabilities
2024-07-25 00:00:00
suse
suse
Security update for ImageMagick (moderate)
2021-01-24 00:00:00
Security update for ImageMagick (moderate)
2021-01-22 00:00:00

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

50.0%

JSON
Related for ALAS-2021-1479
ubuntucve1nessus26f51nvd1cloudlinux1centos1osv5prion1oraclelinux1openvas13cvelist1alpinelinux1redhat1gentoo1amazon1redhatcve1veracode1checkpoint_advisories1debiancve1cve1freebsd2debian2cloudfoundry1ubuntu2suse2