CVE-2023-32668

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/blob/b266ef076c96b382cd23a4c93204e247bb98626a/source/texk/web2c/luatexdir/ChangeLog#L1-L3	Release Notes
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0	Patch
https://tug.org/pipermail/tex-live/2023-May/049188.html	Issue Tracking Mailing List Mitigation
https://tug.org/~mseven/luatex.html#luasocket	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:luatex_project:luatex::::::::
	cpe:2.3:a:miktex:miktex::::::::
	cpe:2.3:a:tug:tex_live::::::::

History

No history.

Information

Published : 2023-05-11 06:15

Updated : 2024-02-28 20:13

NVD link : CVE-2023-32668

Mitre link : CVE-2023-32668

CVE.ORG link : CVE-2023-32668

JSON object : View

Products Affected

luatex_project

luatex

tug

tex_live

miktex

miktex

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-32668", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2023-05-11T06:15:10.000", "references": [{"url": "https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/blob/b266ef076c96b382cd23a4c93204e247bb98626a/source/texk/web2c/luatexdir/ChangeLog#L1-L3", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://tug.org/pipermail/tex-live/2023-May/049188.html", "tags": ["Issue Tracking", "Mailing List", "Mitigation"], "source": "cve@mitre.org"}, {"url": "https://tug.org/~mseven/luatex.html#luasocket", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5."}], "lastModified": "2023-05-23T17:31:45.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:luatex_project:luatex:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A202E549-A10A-44D1-BCD1-C3838612CB19", "versionEndExcluding": "1.17.0", "versionStartIncluding": "0.27.0"}, {"criteria": "cpe:2.3:a:miktex:miktex:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2823626C-8167-41D8-A912-87EAEEE441F2", "versionEndExcluding": "23.5", "versionStartIncluding": "2.9.0"}, {"criteria": "cpe:2.3:a:tug:tex_live:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13840740-D76B-422F-9D41-4DCAFCF04F6E", "versionEndExcluding": "2023", "versionStartIncluding": "2009"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}