Debian-LTS has issued an advisory on December 31: https://www.debian.org/lts/security/2022/dla-3254 The issue appears to be fixed in version 6.0.0 of apparent fork universal-ctags, which Debian has packaged. We should probably switch Cauldron to this version. Mageia 8 is also affected.
Status comment: (none) => Patch available from new upstreamWhiteboard: (none) => MGA8TOO
No particular packager in sight for 'ctags', so assigning this globally.
Assignee: bugsquad => pkg-bugs
Gentoo has also switched to universal-ctags: https://packages.gentoo.org/packages/dev-util/ctags
Suggested advisory: ======================== The updated package fixes a security vulnerability: A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way. (CVE-2022-4515) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4515 https://www.debian.org/lts/security/2022/dla-3254 ======================== Updated package in core/updates_testing: ======================== ctags-5.8-15.1.mga8 from SRPM: ctags-5.8-15.1.mga8.src.rpm
Status: NEW => ASSIGNEDStatus comment: Patch available from new upstream => (none)CC: (none) => nicolas.salgueroSource RPM: ctags-5.8-17.mga9.src.rpm => ctags-5.8-15.mga8.src.rpmAssignee: pkg-bugs => qa-bugsVersion: Cauldron => 8Whiteboard: MGA8TOO => (none)
MGA8-64 MATE on Acer Aspire 5253 No installation issues. Ref bug 14277 Comment 2, following wilcal's example (uploading the file soon). Created helloworld.c and run $ ctags -R helloworld.c The created tag file reads !_TAG_FILE_FORMAT 2 /extended format; --format=1 will not append ;" to lines/ !_TAG_FILE_SORTED 1 /0=unsorted, 1=sorted, 2=foldcase/ !_TAG_PROGRAM_AUTHOR Darren Hiebert /dhiebert@users.sourceforge.net/ !_TAG_PROGRAM_NAME Exuberant Ctags // !_TAG_PROGRAM_URL http://ctags.sourceforge.net /official site/ !_TAG_PROGRAM_VERSION 5.8 // main helloworld.c /^main()$/;" f If it's not the same, it's quite close, so OK, ttest succeeded.
CC: (none) => herman.viaeneWhiteboard: (none) => MGA8-64-OK
Created attachment 13633 [details] test file
Validating. Advisory in Comment 3.
CC: (none) => andrewsfarm, sysadmin-bugsKeywords: (none) => validated_update
CC: (none) => davidwhodginsKeywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2023-0003.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED