The GIMP upstream reported [1] that the scriptfu network server allowed for the execution of arbitrary code when the scriptfu server is enabled. The scriptfu network server is designed to execute arbitrary code, so there is no trust boundary crossed. Upstream indicates that the other part of the problem is that it does without asking for authentication, but it was never designed to do so. All that is required is for the TCP port (usually port 10008) to be available. There is no upstream fix or solution for this flaw, and the workaround as stated is: "Do not enable the scriptfu network server. The GIMP development team have stated that this component was not designed with security in mind and therefore should not be used in production environments." [1] http://www.openwall.com/lists/oss-security/2012/08/16/6
Statement: Red Hat does not consider this to be a security flaw. The GIMP scriptfu server works as intended and should not be enabled in production environments as it was not designed to have any kind of security protection.