Log in Start free

Vulnerability · Published Dec 23, 2021 · Assigned by mitre

CVE-2021-45463

High 7.8

In plain English

A high-severity security flaw in the gegl04 package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)1.5%top 24.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8gegl040.4.4-6.el8_5.2ALSA-2022:0177
AlmaLinux:8gegl04-devel0.4.4-6.el8_5.2ALSA-2022:0177
Alpine:v3.20gegl0.4.34-r0ALPINE-CVE-2021-45463
Alpine:v3.21gegl0.4.34-r0ALPINE-CVE-2021-45463
Alpine:v3.22gegl0.4.34-r0ALPINE-CVE-2021-45463
Alpine:v3.23gegl0.4.34-r0ALPINE-CVE-2021-45463
Alpine:v3.24gegl0.4.34-r0ALPINE-CVE-2021-45463
Debian:12gegl1:0.4.34-1DEBIAN-CVE-2021-45463
Debian:13gegl1:0.4.34-1DEBIAN-CVE-2021-45463
Debian:14gegl1:0.4.34-1DEBIAN-CVE-2021-45463
Rocky Linux:8gegl040:0.4.4-6.el8_5.2RLSA-2022:0177
Ubuntu:22.04:LTSgegl1:0.4.34-1UBUNTU-CVE-2021-45463

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References