CVE-2023-2491: Command Injection
A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
Other sources
The Emacs flaw CVE-2023-28617 (bug 2180544) was addressed in Red Hat Enterprise Linux 8 via erratum RHSA-2023:1930 and in Red Hat Enterprise Linux 9 via erratum RHSA-2023:2074, released on Apr 24, 2023 and May 02, 2023 respectively.
https://access.redhat.com/errata/RHSA-2023:1930 https://access.redhat.com/errata/RHSA-2023:2074
However, the fix for this issue was not included in the Emacs updates released as part of Red Hat Enterprise Linux 8.8 GA erratum (RHSA-2023:3042) and Red Hat Enterprise Linux 9.2 GA erratum (RHSA-2023:2366), causing a security regression of previously released fix. A new CVE-ID CVE-2023-2491 was assigned for this security regression.
Note that this issue and CVE-ID is specific to the Emacs packages as shipped with Red Hat Enterprise Linux and is not applicable to any upstream Emacs version or Emacs packages of any other vendor that are not directly based on Red Hat Enterprise Linux packages.
For more information about the original flaw, refer to the CVE page or bug linked above.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-2491?
CVE-2023-2491 is a vulnerability in the Emacs text editor that allows arbitrary command execution.
Which versions of GNU Emacs are affected by CVE-2023-2491?
GNU Emacs version 26.1-9.el8 and 27.2-8.el9 are affected by CVE-2023-2491.
Which versions of Red Hat Enterprise Linux are affected by CVE-2023-2491?
Red Hat Enterprise Linux version 8.0 and 9.0 are affected by CVE-2023-2491.
What is the severity rating of CVE-2023-2491?
CVE-2023-2491 has a severity rating of 7.8 (high).
How can I fix the CVE-2023-2491 vulnerability?
To fix the CVE-2023-2491 vulnerability, update GNU Emacs to a patched version provided by the vendor.