Medium severity · published May 11, 2023
CVE-2023-32668
LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests
5.5
CVSS
0.4%
EPSS
No
On KEV
Description
LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LU
Luatex · Luatex Project
0.27.0 before 1.17.0 · source: NVD
MI
Miktex · Miktex
2.9.0 before 23.5 · source: NVD
TL
Tex Live · Tug
2009 before 2023 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32668
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-32668
Release Notes
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/blob/b266ef076c96b382cd23a4c93204e247bb98626a/source/texk/web2c/luatexdir/ChangeLog#L1-L3
Patch
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0
Issue Tracking
https://tug.org/pipermail/tex-live/2023-May/049188.html
Exploit
https://tug.org/~mseven/luatex.html#luasocket
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/10/msg00032.html
More from Luatex
7.8
CVE-2023-32700
LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source