Описание
ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.
A vulnerability has been identified in ImageMagick, a software tool used to create, edit, and convert image files. This flaw allows a remote attacker to potentially decrypt and view images that were supposed to be securely encrypted by the software, leading to an unauthorized disclosure of sensitive data.
Отчет
This Low impact information disclosure flaw in ImageMagick arises from AES-CTR nonce reuse within the PasskeyEncipherImage method. Exploitation requires an attacker to specifically target encrypted images processed by this method, which is not a common default configuration in Red Hat environments. The vulnerability primarily affects applications utilizing the PasskeyEncipherImage function, potentially through bindings like Magick.NET.
Меры по смягчению последствий
To mitigate this stop using ImageMagick's built-in encryption feature. Rely on standard, OS-level data-at-rest encryption (such as LUKS) to protect sensitive media instead.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | ImageMagick | Out of support scope | ||
| Red Hat Enterprise Linux 7 | ImageMagick | Out of support scope |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.
ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.
ImageMagick before 7.1.2-22 contains an information disclosure vulnera ...
EPSS
3.7 Low
CVSS3