CVE-2022-45939 Command injection in n/a
Attackers can execute arbitrary commands via shell metacharacters in filenames when using the ctags utility in GNU Emacs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-45939?
CVE-2022-45939 is a high-severity command injection vulnerability in Debian Debian Linux, published on 28 Nov 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.
Weakness: CWE-78
Which versions are affected by CVE-2022-45939?
It affects 3 products.
Linux distribution packages (40)
emacs AlmaLinux:8 | All versions | 1:26.1-9.el8 |
emacs-common AlmaLinux:8 | All versions | 1:26.1-9.el8 |
emacs-filesystem AlmaLinux:8 | All versions | 1:26.1-9.el8 |
emacs-lucid AlmaLinux:8 | All versions | 1:26.1-9.el8 |
emacs-nox AlmaLinux:8 | All versions | 1:26.1-9.el8 |
emacs-terminal AlmaLinux:8 | All versions | 1:26.1-9.el8 |
emacs AlmaLinux:9 | All versions | 1:27.2-8.el9 |
emacs-common AlmaLinux:9 | All versions | 1:27.2-8.el9 |
emacs-filesystem AlmaLinux:9 | All versions | 1:27.2-8.el9 |
emacs-lucid AlmaLinux:9 | All versions | 1:27.2-8.el9 |
emacs-nox AlmaLinux:9 | All versions | 1:27.2-8.el9 |
emacs Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-9.el8 |
emacs-common Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-9.el8 |
emacs-common-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-9.el8 |
emacs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-9.el8 |
emacs-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-9.el8 |
emacs-lucid Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-9.el8 |
emacs-lucid-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-9.el8 |
emacs-nox Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-9.el8 |
emacs-nox-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-9.el8 |
emacs-terminal Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-9.el8 |
emacs Red Hat:enterprise_linux:8::baseos | All versions | 1:26.1-9.el8 |
emacs-filesystem Red Hat:enterprise_linux:8::baseos | All versions | 1:26.1-9.el8 |
emacs Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-8.el9 |
emacs-common Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-8.el9 |
emacs-common-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-8.el9 |
emacs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-8.el9 |
emacs-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-8.el9 |
emacs-filesystem Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-8.el9 |
emacs-lucid Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-8.el9 |
emacs-lucid-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-8.el9 |
emacs-nox Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-8.el9 |
emacs-nox-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-8.el9 |
emacs SUSE:Enterprise Storage 6 | All versions | 25.3-150000.3.12.1 |
emacs SUSE:Enterprise Storage 7 | All versions | 25.3-150000.3.12.1 |
emacs SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 25.3-150000.3.12.1 |
emacs SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 25.3-150000.3.12.1 |
emacs SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 25.3-150000.3.12.1 |
emacs SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 25.3-150000.3.12.1 |
emacs SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 25.3-150000.3.12.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Gnu Emacs.
How do I fix CVE-2022-45939?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-45939 being exploited?
There is no known exploitation of CVE-2022-45939 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2023:2366, ALSA-2023:3042, AZL-11515, CLEANSTART-2024-MU53780, CLSA-2024-1728055873, DEBIAN-CVE-2022-45939 and 13 more.