Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-29599: A flaw was found in ImageMagick. The -authenticate option is mishandled allowing user-controlled password set for a PDF file to possibly inject additional shell commands via coders/pdf.c. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 1907456: CVE-2020-29599 ImageMagick: Shell injection via PDF password could result in arbitrary code execution
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ImageMagick | 0:6.9.10.68-5.amzn2.0.1 |
| Amazon Linux · 2 | ImageMagick-c++ | 0:6.9.10.68-5.amzn2.0.1 |
| Amazon Linux · 2 | ImageMagick-c++-devel | 0:6.9.10.68-5.amzn2.0.1 |
| Amazon Linux · 2 | ImageMagick-debuginfo | 0:6.9.10.68-5.amzn2.0.1 |
| Amazon Linux · 2 | ImageMagick-devel | 0:6.9.10.68-5.amzn2.0.1 |
| Amazon Linux · 2 | ImageMagick-doc | 0:6.9.10.68-5.amzn2.0.1 |
| Amazon Linux · 2 | ImageMagick-perl | 0:6.9.10.68-5.amzn2.0.1 |
Vulnerabilities 1
-
Unscored —CVE-2020-29599 Public exploit
ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a passw…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-29599.html