CVE-2023-32700 Command injection in n/a
Attackers can execute arbitrary shell commands by tricking users into compiling malicious TeX files with vulnerable LuaTeX versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32700?
CVE-2023-32700 is a high-severity command injection vulnerability in n/a, published on 20 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.
Weakness: CWE-77
Which versions are affected by CVE-2023-32700?
It affects 3 products.
Linux distribution packages (40)
texlive AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-adjustbox AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-ae AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-algorithms AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-alphalph AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-amscls AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-amsfonts AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-amsmath AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-anyfontsize AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-anysize AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-appendix AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-arabxetex AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-arphic AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-atbegshi AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-attachfile AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-attachfile2 AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-atveryend AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-auxhook AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-avantgar AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-awesomebox AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-babel AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-babel-english AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-babelbib AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-base AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-beamer AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-bera AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-beton AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-bibtex AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-bibtopic AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-bidi AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-bigfoot AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-bigintcalc AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-bitset AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-bookman AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-bookmark AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-booktabs AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-breakurl AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-breqn AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-capt-of AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
texlive-caption AlmaLinux:9 | All versions | 9:20200406-26.el9_2 |
Products include Luatex Project Luatex, Miktex Miktex, Tug Tex Live.
How do I fix CVE-2023-32700?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-32700 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-32700 exists.
Other vulnerabilities in n/a
Sources
Also known as ALSA-2023:3661, DEBIAN-CVE-2023-32700, DLA-3427-1, DSA-5406-1, GHSA-7xcp-5fvh-7fwm, MGASA-2023-0233 and 8 more.