OS Command Injection in ctags - CVE-2022-4515

Vulnerability identifier: #VU71470

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-4515

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when handling the tag filename passed via the "-o" option within the externalSortTags() function in sort.c. A remote attacker can trick the victim to pass a specially crafted filename or use a malicious configuration file and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

ctags
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
Ubuntu
openEuler
exuberant-ctags (Ubuntu package)
ctags
ctags-debuginfo
ctags-debugsource
ctags (Red Hat package)
ctags-doc
ctags-etags
ctags-help

Install updates from vendor's website.

exuberant-ctags (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:5.9~svn20110310-11ubuntu0.1, 1:5.9~svn20110310-12ubuntu0.1, 1:5.9~svn20110310-16ubuntu0.22.04.1, 1:5.9~svn20110310-16ubuntu0.22.10.1
ctags - addressed in versions 5.8-8.3.1, 5.8-150000.3.3.1
ctags-debuginfo - addressed in versions 5.8-8.3.1, 5.8-150000.3.3.1
ctags-debugsource - addressed in versions 5.8-8.3.1, 5.8-150000.3.3.1
ctags (Red Hat package) - update to 5.8-23.el8
ctags-doc - update to 5.8-23.0.1
ctags-etags - update to 5.8-23.0.1
ctags - update to 5.8-23.0.1
ctags - addressed in versions 5.8-28, 5.8-29
ctags-debugsource - addressed in versions 5.8-28, 5.8-29
ctags-debuginfo - addressed in versions 5.8-28, 5.8-29
ctags-help - addressed in versions 5.8-28, 5.8-29

• https://sourceforge.net/p/ctags/code/HEAD/tree/tags/ctags-5.8/sort.c#l56
• https://lists.debian.org/debian-lts-announce/2022/12/msg00040.html

• Remote command execution in Ctags
• Ubuntu update for exuberant-ctags
• SUSE update for ctags
• SUSE update for ctags
• Red Hat Enterprise Linux 8 update for ctags
• openEuler 20.03 LTS SP3 update for ctags
• openEuler 22.03 LTS SP2 update for ctags
• Anolis OS update for ctags