Bug 31211 - emacs new security issue CVE-2022-45939
Summary: emacs new security issue CVE-2022-45939
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2022-12-01 15:09 CET by David Walser
Modified: 2022-12-13 23:10 CET (History)
4 users (show)

See Also:
Source RPM: emacs-27.1-1.1.mga8.src.rpm
CVE: CVE-2022-45939
Status comment:


Attachments

Description David Walser 2022-12-01 15:09:57 CET
SUSE has issued an advisory today (December 1):
https://lists.suse.com/pipermail/sle-security-updates/2022-December/013180.html

Mageia 8 is also affected.
David Walser 2022-12-01 15:10:17 CET

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Patch available from upstream

Comment 2 Lewis Smith 2022-12-01 21:43:21 CET
emacs is maintained by all sorts of people, so assigning this bug globally.

Assignee: bugsquad => pkg-bugs

Comment 3 Nicolas Salguero 2022-12-02 15:24:32 CET
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input. (CVE-2022-45939)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45939
https://lists.suse.com/pipermail/sle-security-updates/2022-December/013180.html
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MU2KN46JJ6TL6CR5QN3O4AZXDYE35Z7A/
========================

Updated packages in core/updates_testing:
========================
emacs-27.1-1.2.mga8
emacs-common-27.1-1.2.mga8
emacs-doc-27.1-1.2.mga8
emacs-el-27.1-1.2.mga8
emacs-leim-27.1-1.2.mga8
emacs-nox-27.1-1.2.mga8

from SRPM:
emacs-27.1-1.2.mga8.src.rpm

Status comment: Patch available from upstream => (none)
CVE: (none) => CVE-2022-45939
Whiteboard: MGA8TOO => (none)
Assignee: pkg-bugs => qa-bugs
Status: NEW => ASSIGNED
CC: (none) => nicolas.salguero
Version: Cauldron => 8
Source RPM: emacs-28.2-4.mga9.src.rpm => emacs-27.1-1.1.mga8.src.rpm

Comment 4 Thomas Andrews 2022-12-10 20:59:54 CET
No installation issues.

Wikipedia says that there are over 10,000 commands for emacs. 

I did not try very many of them. I'm not an emacs user as a rule, but if I were I'd mostly be using it as a text editor. So, I loaded a text file into it, edited the file, and saved it successfully, and emacs kept the old file for me automatically as a backup.

Reading that emacs is designed to be used with keyboad rather than mouse, I loaded the text file and tried a few commands. While some did not do what I expected, it looked like I should have expected them to do what they did.

Giving this an OK, for now. If someone with more emacs experience doesn't come along to say different, I'll validate in a day or two.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => andrewsfarm

Comment 5 Thomas Andrews 2022-12-12 13:51:36 CET
Validating. Advisory in comment 3.

CC: (none) => sysadmin-bugs
Keywords: (none) => validated_update

Dave Hodgins 2022-12-13 01:59:57 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 6 Mageia Robot 2022-12-13 23:10:51 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0457.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.