CVE-2022-48339 Command injection in n/a
Attackers can execute arbitrary code via shell metacharacters in file or directory names processed by the htmlfontify.el package in GNU Emacs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-48339?
CVE-2022-48339 is a high-severity command injection vulnerability in n/a, published on 20 Feb 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.
Which versions are affected by CVE-2022-48339?
It affects 1 product.
Linux distribution packages (27)
emacs Red Hat:enterprise_linux:7::client | All versions | 1:24.3-23.el7_9.1 |
emacs-common Red Hat:enterprise_linux:7::client | All versions | 1:24.3-23.el7_9.1 |
emacs-debuginfo Red Hat:enterprise_linux:7::client | All versions | 1:24.3-23.el7_9.1 |
emacs-el Red Hat:enterprise_linux:7::client | All versions | 1:24.3-23.el7_9.1 |
emacs-filesystem Red Hat:enterprise_linux:7::client | All versions | 1:24.3-23.el7_9.1 |
emacs-nox Red Hat:enterprise_linux:7::client | All versions | 1:24.3-23.el7_9.1 |
emacs-terminal Red Hat:enterprise_linux:7::client | All versions | 1:24.3-23.el7_9.1 |
emacs Red Hat:enterprise_linux:7::computenode | All versions | 1:24.3-23.el7_9.1 |
emacs-common Red Hat:enterprise_linux:7::computenode | All versions | 1:24.3-23.el7_9.1 |
emacs-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 1:24.3-23.el7_9.1 |
emacs-el Red Hat:enterprise_linux:7::computenode | All versions | 1:24.3-23.el7_9.1 |
emacs-nox Red Hat:enterprise_linux:7::computenode | All versions | 1:24.3-23.el7_9.1 |
emacs-terminal Red Hat:enterprise_linux:7::computenode | All versions | 1:24.3-23.el7_9.1 |
emacs Red Hat:enterprise_linux:7::server | All versions | 1:24.3-23.el7_9.1 |
emacs-common Red Hat:enterprise_linux:7::server | All versions | 1:24.3-23.el7_9.1 |
emacs-debuginfo Red Hat:enterprise_linux:7::server | All versions | 1:24.3-23.el7_9.1 |
emacs-el Red Hat:enterprise_linux:7::server | All versions | 1:24.3-23.el7_9.1 |
emacs-filesystem Red Hat:enterprise_linux:7::server | All versions | 1:24.3-23.el7_9.1 |
emacs-nox Red Hat:enterprise_linux:7::server | All versions | 1:24.3-23.el7_9.1 |
emacs-terminal Red Hat:enterprise_linux:7::server | All versions | 1:24.3-23.el7_9.1 |
emacs Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-23.el7_9.1 |
emacs-common Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-23.el7_9.1 |
emacs-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-23.el7_9.1 |
emacs-el Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-23.el7_9.1 |
emacs-filesystem Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-23.el7_9.1 |
emacs-nox Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-23.el7_9.1 |
emacs-terminal Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-23.el7_9.1 |
Products include Gnu Emacs.
How do I fix CVE-2022-48339?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-48339 being exploited?
There is no known exploitation of CVE-2022-48339 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as AZL-13682, DEBIAN-CVE-2022-48339, GHSA-jwxq-f9vm-725g, RHSA-2023:3481, UBUNTU-CVE-2022-48339, USN-5955-1.