Bug 1197252 - (CVE-2022-21831) VUL-0: CVE-2022-21831: rubygem-activestorage-5.2: Code injection vulnerability in ActiveStorage
VUL-0: CVE-2022-21831: rubygem-activestorage-5.2: Code injection vulnerabilit...
Status: NEW
Classification: openSUSE
Product: openSUSE Distribution
Classification: openSUSE
Component: Security
Leap 15.4
Other Other
: P3 - Medium : Critical (vote)
: ---
Assigned To: Wolfgang Engel
Security Team bot
Depends on:
  Show dependency treegraph
Reported: 2022-03-17 17:02 UTC by Thomas Leroy
Modified: 2022-03-18 10:59 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Leroy 2022-03-17 17:02:07 UTC

There is a possible code injection vulnerability in the Active Storage module
of Rails.  This vulnerability impacts applications that use Active Storage
with the image_processing processing in addition to the mini_magick back end
for image_processing.

Vulnerable code will look something similar to this:

<%= image_tag blob.variant(params[:t] => params[:v]) %>

Where the transformation method or its arguments are untrusted arbitrary

Versions Affected:  >= 5.2.0
  Not affected:       < 5.2.0
  Fixed Versions:,,,


Comment 1 Thomas Leroy 2022-03-17 17:03:30 UTC
openSUSE:Backports:SLE-15-SP3/rubygem-activestorage-5.2 and openSUSE:Backports:SLE-15-SP4/rubygem-activestorage-5.2 are affected.
rubygem-activestorage-7.0 is already fixed
Comment 2 Marcus Meissner 2022-03-18 10:59:13 UTC
wolfgang is the project maintainer.

package maintainer is unset, darix?