CVE-2023-34152: 
ImageMagick vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2023-34152) was discovered in ImageMagick's OpenBlob functionality when configured with --enable-pipes option. The vulnerability was reported on May 17, 2023, affecting ImageMagick versions up to (excluding) 7.1.1.11. This security flaw allows for shell command injection through malformed file names when the application is specifically configured with the --enable-pipes option (GitHub Issue).

The vulnerability stems from an incomplete fix to CVE-2016-5118, where the SanitizeString function was added to filter malicious input before popen_utf8 execution. However, while SanitizeString filters out single quotes, it fails to properly sanitize backticks (`) and double quotes ("), allowing for shell command injection through specially crafted filenames. The vulnerability has received a CVSS v3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

When exploited, this vulnerability could allow attackers to execute arbitrary commands on the system where ImageMagick is installed with the --enable-pipes configuration. This could lead to complete system compromise, including unauthorized access to sensitive data, system modification, and potential service disruption (Red Hat CVE).

The primary mitigation is to avoid using the --enable-pipes configuration option, as it is considered a security risk by design. For systems requiring updates, ImageMagick version 7.1.1.11 and later contain fixes for this vulnerability. Additionally, Ubuntu and other distributions have noted that this vulnerability is not exploitable in their default configurations as the --enable-pipes option is not enabled by default (Ubuntu Security).

The security community has generally classified this as a significant vulnerability due to its high CVSS score, though its impact is limited by the requirement of a specific configuration option. Multiple Linux distributions, including Fedora and Red Hat, have issued security advisories and updates to address this vulnerability (Fedora Update).