PT-2022-7423 · Gnu Emacs+10 · Gnu Emacs+10

Published 2022-11-27 · Updated 2025-04-28 · CVE-2022-45939

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNU Emacs versions through 28.2

Description The issue is related to the incorrect neutralization of special elements in the lib-src/etags.c component of the ctags program in the EMACS text editor. This can allow an attacker to execute commands via shell metacharacters in the name of a source-code file. For example, a victim may use the "ctags *" command in a situation where the current working directory has contents that depend on untrusted input.

Recommendations For GNU Emacs versions through 28.2, consider avoiding the use of the "ctags *" command in situations where the current working directory has contents that depend on untrusted input, as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALSA-2023:2366

ALSA-2023:3042

ALT-PU-2023-5762

AZL-11515

BDU:2024-05926

CESA-2023_3042

CVE-2022-45939

DLA-3257-1

DSA-5314-1

MGASA-2022-0457

OESA-2022-2131

OPENSUSE-SU-2022_4304-1

OPENSUSE-SU-2022_4310-1

OPENSUSE-SU-2024:12541-1

RHSA-2023:2366

RHSA-2023:3042

RHSA-2023_2366

RHSA-2023_3042

RHSA-2024:1103

ROSA-SA-2024-2433

SUSE-SU-2022:4304-1

SUSE-SU-2022:4305-1

SUSE-SU-2022:4310-1

SUSE-SU-2022_4304-1

SUSE-SU-2022_4305-1

SUSE-SU-2022_4310-1

USN-5781-1

USN-7027-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Gnu Emacs

Linuxmint

Red Hat

Red Os

Suse

Ubuntu

References · 67

• https://osv.dev/vulnerability/DLA-3257-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4305-1 · Vendor Advisory
• https://debian.org/security/2023/dsa-5314 · Vendor Advisory
• https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=d48bb4874bc6cd3e69c7a15fc3c91cc141025c51 · Patch
• https://osv.dev/vulnerability/CVE-2022-45939 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48339 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-45939 · Security Note
• https://osv.dev/vulnerability/USN-5781-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7027-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7027-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4304-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0457.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-45939 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-2366.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39331 · Vendor Advisory