CVE catalog

CVE-2022-24720

ruby-image-processing affected and fixed versions

[CVE catalog]

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.69% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debianbookwormruby-image-processing1.10.3-2FixedDistribution-reported fixed boundary[CVE-2022-24720]
Debianbookwormruby-image-processing1.10.3-3Fixed[CVE-2022-24720]

Showing 2 fix observations. All 6 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormruby-image-processing1.10.3-2FixedDistribution-reported fixed boundary[CVE-2022-24720]
Debianbookwormruby-image-processing1.10.3-3Fixed[CVE-2022-24720]
Ubuntu20.04ruby-image-processing1.10.3-1UnknownSource applicability is not established[USN-6675-1][UBUNTU-CVE-2022-24720]
Ubuntu20.04ruby-image-processing1.10.3-1ubuntu0.20.04.1UnknownSource applicability is not established[USN-6675-1][UBUNTU-CVE-2022-24720]
Ubuntu22.04ruby-image-processing1.10.3-1UnknownSource applicability is not established[USN-6675-1][UBUNTU-CVE-2022-24720]
Ubuntu22.04ruby-image-processing1.10.3-1ubuntu0.22.04.1UnknownSource applicability is not established[USN-6675-1][UBUNTU-CVE-2022-24720]
Original provider fields
{
  "package_releases": [
    {
      "name": "ruby-image-processing",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.10.3-3"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1007225,
      "name": "ruby-image-processing",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.10.3-2"
    }
  ],
  "distribution_packages": [
    {
      "name": "ruby-image-processing",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.3-1ubuntu0.20.04.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.10.3-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6675-1",
      "fixed_version": "1.10.3-1ubuntu0.20.04.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-6675-1",
      "provider_updated_at": "2026-02-10T04:43:31Z",
      "applicability_unknown": true
    },
    {
      "name": "ruby-image-processing",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.3-1ubuntu0.22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "1.10.3-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6675-1",
      "fixed_version": "1.10.3-1ubuntu0.22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-6675-1",
      "provider_updated_at": "2026-02-10T04:43:31Z",
      "applicability_unknown": true
    },
    {
      "name": "ruby-image-processing",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.3-1ubuntu0.20.04.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.10.3-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-24720",
      "fixed_version": "1.10.3-1ubuntu0.20.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-24720",
      "provider_updated_at": "2026-02-04T10:01:02.998337Z",
      "applicability_unknown": true
    },
    {
      "name": "ruby-image-processing",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.3-1ubuntu0.22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "1.10.3-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-24720",
      "fixed_version": "1.10.3-1ubuntu0.22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-24720",
      "provider_updated_at": "2026-02-04T10:01:02.998337Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1007225]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [ruby-image-processing]Unknown
    Details (2)

    • 1.10.3-3 · all · bookworm

      Fixed · Fixed: 1.10.3-2

      dsa · ruby-image-processing · debian · bookworm

    • 1.10.3-3 · all · bookworm

      Fixed · Fixed: 1.10.3-2

      dsa · ruby-image-processing · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]