CVE-2023-32668

NameCVE-2023-32668
DescriptionLuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1036470

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
texlive-bin (PTS)buster2018.20181218.49446-1vulnerable
buster (security)2018.20181218.49446-1+deb10u2vulnerable
bullseye (security), bullseye2020.20200327.54578-7+deb11u1vulnerable
bookworm2022.20220321.62855-5.1+deb12u1fixed
sid, trixie2023.20230311.66589-9fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
texlive-binsourcebookworm2022.20220321.62855-5.1+deb12u1
texlive-binsource(unstable)2022.20220321.62855-61036470

Notes

[bullseye] - texlive-bin <no-dsa> (Minor issue)
[buster] - texlive-bin <no-dsa> (Minor issue)
https://tug.org/pipermail/tex-live/2023-May/049188.html
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/commit/b266ef076c96b382cd23a4c93204e247bb98626a
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/commit/e7df9234420973a2f69aac1b10cbb5f00b0cda4d
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/commit/da4492c789e25f05255d54e45447d3da79098967

Search for package or bug name: Reporting problems