# ImageMagick CVE-2016–3714
**URL:** https://meta.discourse.org/t/imagemagick-cve-2016-3714/43624
**Category:** Bug
**Created:** [May 3, 2016, 6:04pm UTC](https://meta.discourse.org/t/imagemagick-cve-2016-3714/43624 "2016-05-03T18:04:52Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@levlaz](https://meta.discourse.org/u/levlaz)
#### Post date: [May 3, 2016, 6:04pm UTC](https://meta.discourse.org/t/imagemagick-cve-2016-3714/43624/1 "2016-05-03T18:04:52Z")
Hi friends!
Just wanted to give everyone a heads up. As you may have heard there is a nasty CVE related to the ImageMagick library that allows for remote code execution. [https://medium.com/@rhuber/imagemagick-is-on-fire-cve-2016-3714-379faf762247#.1doeoa5zx](https://medium.com/@rhuber/imagemagick-is-on-fire-cve-2016-3714-379faf762247#.1doeoa5zx)
Discourse uses this library, protecting yourself is pretty simple. We are using v1.5.1 stable (so the file locations _may_ be different depending on your version).
1. SSH into your discourse server and go to where your discourse installation is
2. `./launcher enter app`
3. Edit the policy.xml file `vim /usr/local/etc/ImageMagick-6/policy.xml`
4. Add the following to the policy map:
5. Save the file
You should now be protected. It usually takes a bit of time to get patches done upstream so this is the best thing that you can do to protected your self hosted discourse site.
AFAIK this container is blown away and recreated each time you upgrade, so be sure to do this each time you upgrade until there is an upstream patch.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 3, 2016, 6:07pm UTC](https://meta.discourse.org/t/imagemagick-cve-2016-3714/43624/2 "2016-05-03T18:07:43Z")
Yes, thanks! I saw this a bit earlier and already brought it to the attention of @zogstrip
The more useful check is to verify that images are images by checking initial bytes, and I believe we already do this?
> Verify that all image files begin with the expected “magic bytes” corresponding to the image file types you support before sending them to ImageMagick for processing. (see FAQ for more info)
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [May 3, 2016, 7:55pm UTC](https://meta.discourse.org/t/imagemagick-cve-2016-3714/43624/3 "2016-05-03T19:55:03Z")
Thanks @levlaz for the heads up 👍
> [@codinghorror](#):
>
> The more useful check is to verify that images are images by checking initial bytes, and I believe we already do this?
We used ImageMagick’s `identify` for that… So I changed it to use [FastImage](https://github.com/sdsykes/fastimage) instead 😉
[https://github.com/discourse/discourse/commit/df14926e42dd6223c3ee73ff24e61140b83a50bc](https://github.com/discourse/discourse/commit/df14926e42dd6223c3ee73ff24e61140b83a50bc)
The real fix though is to update our base image with the latest version of ImageMagick. But I don’t think they released a fixed version yet. cc @sam
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [May 3, 2016, 11:11pm UTC](https://meta.discourse.org/t/imagemagick-cve-2016-3714/43624/4 "2016-05-03T23:11:25Z")
> [@zogstrip](#):
>
> The real fix though is to update our base image with the latest version of ImageMagick. But I don’t think they released a fixed version yet.
No, it looks like one is expected “by the weekend”: [ImageMagick Security Issue - Legacy ImageMagick Discussions Archive](https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588) (apologies for linking to a Lesser Forum… 😀)
What we can do in the meantime is deploy the modified policy.xml by default everywhere. I believe @sam is working on an updated image as I type.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 3, 2016, 11:35pm UTC](https://meta.discourse.org/t/imagemagick-cve-2016-3714/43624/5 "2016-05-03T23:35:45Z")
Fixed per:
[https://github.com/discourse/discourse\_docker/commit/d47aa69bb72dea153b6901866bb66afe2cca6915](https://github.com/discourse/discourse_docker/commit/d47aa69bb72dea153b6901866bb66afe2cca6915)
I will also rebuild the entire image next week when Image Magick do a new point release.
To take advantage of the fix:
```plaintext
cd /var/discourse
./launcher rebuild app
```
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 3, 2016, 11:35pm UTC](https://meta.discourse.org/t/imagemagick-cve-2016-3714/43624/6 "2016-05-03T23:35:54Z")
---
### Author:  [@tgxworld](https://meta.discourse.org/u/tgxworld)
#### Post date: [May 4, 2016, 9:29am UTC](https://meta.discourse.org/t/imagemagick-cve-2016-3714/43624/7 "2016-05-04T09:29:54Z")