Bug 2171988 (CVE-2022-48338) - CVE-2022-48338 emacs: local command injection in ruby-mode.el
Summary: CVE-2022-48338 emacs: local command injection in ruby-mode.el
Keywords:
Status: NEW
Alias: CVE-2022-48338
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2171991 2175140 2175141 2175142 2184367
Blocks: 2171978
TreeView+ depends on / blocked
 
Reported: 2023-02-21 06:23 UTC by TEJ RATHI
Modified: 2023-07-07 08:30 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Emacs package. A malicious ruby source file may cause a local command injection.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:2626 0 None None None 2023-05-09 11:04:11 UTC

Description TEJ RATHI 2023-02-21 06:23:12 UTC 
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.

https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=9a3b08061feea14d6f37685ca1ab8801758bfd1c
Comment 1 TEJ RATHI 2023-02-21 06:24:30 UTC 
Created emacs tracking bugs for this issue:

Affects: fedora-all [bug 2171991]
Comment 3 errata-xmlrpc 2023-05-09 11:04:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2626 https://access.redhat.com/errata/RHSA-2023:2626
Note You need to log in before you can comment on or make changes to this bug.