A flaw was found in image_processing. When using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input, this flaw allows the attacker to execute shell commands. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations. References: https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dada https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446
Created rubygem-image_processing tracking bugs for this issue: Affects: fedora-all [bug 2059887]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.