ctags: arbitrary command execution via a tag file with a crafted filename
Published Dec 20, 2022
7.8
HIGHCVSS 3.1
EPSS 0.61%
Description
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.
Affected products
- Vendor n/a Product Exuberant Ctags Defaultn/a
- Version All versions are affectedStatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Exuberant Ctags | n/a |
|
Configuration 1
- n/a
Configuration 2
- 10.0
No data.
Red Hat Enterprise Linux 8
ctags-0:5.8-23.el8
Fixed · RHSA-2023:2863
Red Hat Enterprise Linux 6
ctags
Out of support scope
Red Hat Enterprise Linux 7
ctags
Out of support scope
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | ctags-0:5.8-23.el8 | Fixed | RHSA-2023:2863 |
| Red Hat Enterprise Linux 6 | ctags | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | ctags | Out of support scope | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Exuberant Ctags is not shipped in Red Hat Enterprise Linux 9, therefore it's not affected.
Red Hat mitigation
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
References (7)
- https://access.redhat.com/security/cve/CVE-2022-4515 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2153519 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51855 Advisory
- https://lists.debian.org/debian-lts-announce/2022/12/msg00040.html mailing-listMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-4515
- https://sourceforge.net/p/ctags/code/HEAD/tree/tags/ctags-5.8/sort.c#l56 ExploitThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-4515
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2022-4515 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2153519 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51855 | Advisory | |
| https://lists.debian.org/debian-lts-announce/2022/12/msg00040.html | mailing-listMailing ListThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2022-4515 | ||
| https://sourceforge.net/p/ctags/code/HEAD/tree/tags/ctags-5.8/sort.c#l56 | ExploitThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2022-4515 |
Change history (0)
No recorded changes yet.