ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.
External References: https://github.com/ImageMagick/ImageMagick/discussions/2851 https://insert-script.blogspot.com/2020/11/imagemagick-shell-injection-via-pdf.html
Created ImageMagick tracking bugs for this issue: Affects: epel-8 [bug 1907457] Affects: fedora-all [bug 1907458]
Statement: Although ImageMagick is shipped as bundled dependency of Inkscape, the further package is not affected as the primary usage for ImageMagick in Inkscape is for bitmap filters thus not exposing the affected code path.
There's an issue with ImageMagick when opening password protected PDF files. The user provided password input string is not sanitized, an attacker can leverage the flaw by crafting a input string, leading to a shell command injection. Such vulnerability can compromise the Integrity, Confidentiality and Availability depending on the command injected. For an attack to be successful the attack needs local access to any tool shipped ImageMagick or to trick an user to open an protected PDF using the crafted input string.
Upstream commits for this issue: https://github.com/ImageMagick/ImageMagick/commit/89a1c73ee2693ded91a72d00bdf3aba410f349f1 https://github.com/ImageMagick/ImageMagick/commit/68154c05cf40a80b6f2e2dd9fdc4428570f875f0 https://github.com/ImageMagick/ImageMagick/commit/a9e63436aa04c805fe3f9e2ed242dfa4621df823
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2021:0024 https://access.redhat.com/errata/RHSA-2021:0024
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-29599