Pre-Report Checklist

Before you report a vulnerability, first take the following steps:

• Ensure you are using the latest version of ImageMagick 7 or 6
• Attempt to mitigate the vulnerability using a properly curated security policy
  • Verify your policy using the validation tool
  • Confirm that the security policy mitigation steps did not resolve the issue

Reporting a Vulnerability

If you have completed the above steps and confirmed that the security policy does not address the vulnerability, report the vulnerability as a security advisory. Please include the following information:

• Each user may have no more than three advisories in triage at any one time.
• A description of the vulnerability, including the version of ImageMagick affected.
• Steps to reproduce the vulnerability:
  • Operating system and version (e.g., Ubuntu 20.04, Windows 11, macOS 13.2)
  • Compiler information and build configuration (if building from source)
  • Minimal code sample or command line that demonstrates the vulnerability (if applicable)
  • An input file that can be used to demonstrate the vulnerability (if applicable)
• Any relevant logs or error messages.

Incident Response Plan

Once a vulnerability is reported we will take the following steps:

flowchart TD
    START([Report received]) --> VALIDATE{Validate vulnerability within 7 days}

    VALIDATE -->|Invalid| CLOSE([Close advisory])
    VALIDATE -->|Valid| DRAFT([Accept as draft])

    DRAFT --> ASSESS{Assess severity}

    subgraph severity [" "]
        NONE["None<br/><br/><br/>&nbsp;"]
        LOW["Low<br/><br/>Disclosed in:<br/>14 days"]
        MEDIUM["Medium<br/><br/>Disclosed in:<br/>14 days"]
        HIGH["High<br/><br/>Disclosed in:<br/>7 days"]
        CRITICAL["Critical<br/><br/>Disclosed in:<br/>48 hours"]
    end

    ASSESS --> NONE
    ASSESS --> LOW
    ASSESS --> MEDIUM
    ASSESS --> HIGH
    ASSESS --> CRITICAL

    NONE --> CLOSE
    LOW --> UPDATE
    MEDIUM --> CVE([Request CVE])
    HIGH --> CVE
    CRITICAL --> CVE
    CVE --> NOTIFY([Notify eligible sponsors])

    NOTIFY --> UPDATE([Update draft advisory])
    UPDATE --> PATCH([Create patch])
    PATCH --> RELEASE([New release])
    RELEASE --> PUBLISH([Publish advisory])
    PUBLISH -.-> DISCLOSE([Reporter disclosure])
    style DISCLOSE stroke-dasharray: 7

Loading

CVE requests: Reporters should not request or assign a CVE. After validating a report, ImageMagick maintainers will determine whether a CVE is appropriate and request one when warranted.

Timelines: The timelines in the incident response plan are targets, not guarantees. Actual remediation dates may vary depending on the complexity of the vulnerability and maintainer availability.