#907336 imagemagick: Please consider disabling the ghostscript coder by default

Package:
imagemagick
Source:
imagemagick
Description:
image manipulation programs -- binaries
Submitter:
Nicolas Braud-Santoni
Date:
2023-08-29 16:15:20 UTC
Severity:
normal
#907336#5
Date:
2018-08-26 17:32:35 UTC
From:
To:
Hi,

I would like to suggest disabling the ghostscript coder by default in
/etc/ImageMagick-6/policy.xml:

  <!-- Prevent executing Ghostscript -->
  <policy domain="coder" rights="none" pattern="{EPS,PS2,PS3,PS,PDF,XPS}" />


Ghostscript regularly has remote code execution vulnerabilities, like #907332,
and they are most often exploitable through ImageMagick.

I'm aware this breaks support for postscript and PDF images, but it's not
obvious they are often used with ImageMagick (which is AFAIK meant for raster
graphics, not vector ones), and exposing our users to this security risk is
less than ideal.  :(

(Of course, users who rely on those formats being supported by IM can re-enable
 the coder in the policy.xml configuration file.)


Best,

  nicoo
#907336#10
Date:
2018-10-24 17:55:26 UTC
From:
To:
Hi,

is there any plan to do the suggested disabling of ghostscript?
I wonder whether this should be done as well in other releases when
CVE-2018-18025 will be fixed.

   Thorsten
#907336#15
Date:
2018-10-24 18:55:25 UTC
From:
To:
Le mer. 24 oct. 2018 à 20:39, Thorsten Alteholz <debian@alteholz.de> a
écrit :

If security team thinks it a good idéal why not. But we lost pdf
convention...

Maybe a debconf question ?

Bastien
#907336#20
Date:
2018-11-11 17:01:58 UTC
From:
To:
Hi Bastien,

I don't think that the security team prefers a solution, but they do want
to handle this the same in every release.

Yes, that is a good idea.

   Thorsten
#907336#27
Date:
2021-09-01 08:19:28 UTC
From:
To:
Dear ImageMagick Packaging Team,

Short version: is it safe today to reenable PDF/PS conversion again these
days?

Long version:

Today I was affected by the problem reported in [1], notably:

     convert: attempt to perform an operation not allowed by the security
     policy `PDF' @ error/constitute.c/IsCoderAuthorized/408.

When I check /etc/ImageMagick-6/policy.xml I see that plenty of
conversions to/from (?) PDF/(E)PS* are apparently disabled by default as
delivered by Debian. Which actually covers part of the requests in this
(#907336) bugreport.

The mentioned stackoverflow Q&A however mentions that:
to the Ghostscript version 9.53 currently in Debian stable.

I have *zero* insight into the issues leading to PDF/PS conversion being
disabled in Debian and if they still are relevant and still are of
the same concern as they were at the times before Ghostscript 9.24.

Or posed differently: does it make sense to reevaluate these issues and -
if it turns out they are of no concern any more today - could the
respective converters be re-enabled by default again?

Thanks a lot for maintaining ImageMagick! Greetings,
*t

[1] https://stackoverflow.com/questions/52998331/imagemagick-security-policy-pdf-blocking-conversion
#907336#32
Date:
2021-09-01 09:01:43 UTC
From:
To:
Le mer. 1 sept. 2021 à 08:21, Tomas Pospisek <tpo@sourcepole.ch> a écrit :

No it will not renable by default.

The best will be to have a debconf question and let the user accept the risk.

Postscript is turing complete so it is easy to do a DOS. it should be documented

Patch welcome


Bastien