Vulnerability · Published Feb 20, 2023 · Assigned by mitre
CVE-2022-48338
High 7.3
In plain English
A high-severity command injection in the emacs package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | emacs | 1:27.2-8.el9_2.1 | ALSA-2023:2626 |
| AlmaLinux:9 | emacs-common | 1:27.2-8.el9_2.1 | ALSA-2023:2626 |
| AlmaLinux:9 | emacs-filesystem | 1:27.2-8.el9_2.1 | ALSA-2023:2626 |
| AlmaLinux:9 | emacs-lucid | 1:27.2-8.el9_2.1 | ALSA-2023:2626 |
| AlmaLinux:9 | emacs-nox | 1:27.2-8.el9_2.1 | ALSA-2023:2626 |
| Debian:12 | emacs | 1:28.2+1-11 | DEBIAN-CVE-2022-48338 |
| Debian:13 | emacs | 1:28.2+1-11 | DEBIAN-CVE-2022-48338 |
| Debian:14 | emacs | 1:28.2+1-11 | DEBIAN-CVE-2022-48338 |
| Ubuntu:22.04:LTS | emacs | 1:27.1+1-3ubuntu5.2 | UBUNTU-CVE-2022-48338 |
| Ubuntu:22.04:LTS | emacs | 1:27.1+1-3ubuntu5.2 | USN-7027-1 |
| Ubuntu:22.04:LTS | xemacs21 | no fix listed | UBUNTU-CVE-2022-48338 |
| Ubuntu:24.04:LTS | xemacs21 | no fix listed | UBUNTU-CVE-2022-48338 |
| Ubuntu:25.10 | xemacs21 | no fix listed | UBUNTU-CVE-2022-48338 |
| Ubuntu:26.04:LTS | xemacs21 | no fix listed | UBUNTU-CVE-2022-48338 |
| Ubuntu:26.10 | xemacs21 | no fix listed | UBUNTU-CVE-2022-48338 |
| Ubuntu:22.04:LTS | xemacs21-packages | no fix listed | UBUNTU-CVE-2022-48338 |
| Ubuntu:24.04:LTS | xemacs21-packages | no fix listed | UBUNTU-CVE-2022-48338 |
| Ubuntu:25.10 | xemacs21-packages | no fix listed | UBUNTU-CVE-2022-48338 |
| Ubuntu:26.04:LTS | xemacs21-packages | no fix listed | UBUNTU-CVE-2022-48338 |
| Ubuntu:26.10 | xemacs21-packages | no fix listed | UBUNTU-CVE-2022-48338 |
Affected products (as reported)
Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=9a3b08061feea14d6f37685ca1ab8801758bfd1c
- DSA-5360 vendor-advisory
- FEDORA-2023-5763445abe vendor-advisory
- FEDORA-2023-29df561f1d vendor-advisory