PT-2021-4543 · Unknown+5 · Imagemagick+5

Pedro Sampaio · Published 2021-02-26 · Updated 2023-12-01 · CVE-2021-20313

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.0.11

Description A flaw was found in the TransformSignature function of ImageMagick, which could lead to a potential cipher leak when calculating signatures. This issue is related to the disclosure of information and could allow a remote attacker to access confidential data. The highest threat from this issue is to data confidentiality.

Recommendations For versions prior to 7.0.11, update to version 7.0.11 or later to resolve the issue. As a temporary workaround, consider disabling the TransformSignature function until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2023-5309

BDU:2021-05209

CVE-2021-20313

DLA-2672-1

DLA-3429-1

MGASA-2022-0446

OESA-2021-1198

OPENSUSE-SU-2021:0606-1

OPENSUSE-SU-2021_0606-1

SUSE-SU-2021:1276-1

SUSE-SU-2021:1277-1

SUSE-SU-2023:4634-1

USN-5158-1

USN-5736-1

USN-5736-2

USN-6200-1

Affected Products

Alt Linux

Astra Linux

Imagemagick

Linuxmint

Suse

Ubuntu

References · 134

• 🔥 https://github.com/overgrowncarrot1/ImageTragick_CVE-2023-34152 · Exploit
• https://osv.dev/vulnerability/DLA-2672-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20245 · Vendor Advisory
• https://debian.org/lts/security/2022/dla-3007 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05209 · Security Note
• https://ubuntu.com/security/CVE-2021-20309 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-32547 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20241 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-28463 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1114 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20312 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1947019 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-20309 · Security Note
• https://osv.dev/vulnerability/USN-5736-1 · Vendor Advisory