CVE-2022-45939: OS Command Injection
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags " command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/emacsto a version that resolves this vulnerability.Fixed in 1:28.2+1-15+deb12u4Fixed in 1:30.1+1-6+deb13u1Fixed in 1:30.2+1-11 - Upgrade
Upgrade
debian/xemacs21to a version that resolves this vulnerability.Fixed in 21.4.24-11Fixed in 21.4.24-12 - Upgrade
Upgrade
alpine/emacsto a version that resolves this vulnerability.Fixed in 28.2-r1 - Upgrade
Upgrade
alpine/emacsto a version that resolves this vulnerability.Fixed in 28.2-r3 - Upgrade
Upgrade
debian/emacsto a version that resolves this vulnerability.Fixed in 1:28.2+1-8 - Upgrade
Upgrade
debian/xemacs21to a version that resolves this vulnerability.Fixed in 21.4.24-11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch d48bb4874bc6cd3e69c7a15fc3c91cc141025c51 - Compensating control
Avoid running the ctags command (e.g., 'ctags *') in a working directory whose file names may depend on untrusted input.
Event History
Frequently Asked Questions
What is CVE-2022-45939?
CVE-2022-45939 is a vulnerability in GNU Emacs that allows attackers to execute commands through shell metacharacters in the name of a source-code file.
How does CVE-2022-45939 affect GNU Emacs?
CVE-2022-45939 affects GNU Emacs versions up to 28.2.
How does CVE-2022-45939 affect Debian Linux?
CVE-2022-45939 affects Debian Linux versions 10.0 and 11.0.
How does CVE-2022-45939 affect Fedora Linux?
CVE-2022-45939 affects Fedora Linux versions 36 and 37.
How can I fix CVE-2022-45939 in GNU Emacs?
To fix CVE-2022-45939 in GNU Emacs, update to version 28.3 or later.
How can I fix CVE-2022-45939 in Debian Linux?
To fix CVE-2022-45939 in Debian Linux, apply the recommended security updates.
How can I fix CVE-2022-45939 in Fedora Linux?
To fix CVE-2022-45939 in Fedora Linux, update to a version that includes the security patch.