CVE-2020-29599: debian debian_linux
CVSS: 7.8v3.1HighModified
AliasesRHSA-2021:0024UBUNTU-CVE-2020-29599DEBIAN-CVE-2020-29599
Published 07-12-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-29599 is a high (CVSS 7.8) vulnerability in debian debian_linux. EPSS estimates a 7.51% chance of exploitation in the next 30 days, higher than 94.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.8/10
010
High · v3.1 (NVD)EPSS score
7.51%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 07-12-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSources4 sources · 7.3–7.8
- OSV · Red hatEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
7.51%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 7.51% on 18-09-2026
18-09-202618-10-2026
EPSS score7.51%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundImagemagick
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Redhat7 products
- ImageMagick< 0:6.9.10.68-5.el7_9
- ImageMagick-c++< 0:6.9.10.68-5.el7_9
- ImageMagick-c++-devel< 0:6.9.10.68-5.el7_9
- ImageMagick-debuginfo< 0:6.9.10.68-5.el7_9
- ImageMagick-devel< 0:6.9.10.68-5.el7_9
Debian2 products
- imagemagick< 8:6.9.11.57+dfsg-1
- debian_linuxEOL9.0
Imagemagick1 product
- imagemagick≥ 6.9.8-1, < 6.9.11-40 | ≥ 7.0.5-3, < 7.0.10-40
Ubuntu1 product
- imagemagick< 8:6.9.10.23+dfsg-2.1ubuntu11.9
4 vendors · 11 products
References
15 links- insert-script.blogspot.com/2020/11/imagemagick-shell-injection-via-pdf.htmlARTICLEREPORTThird Party Advisory
