CVE-2022-48624: OS Command Injection
closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE.
Other sources
The closealtfile() function in filename.c in less before 606 omits shellquote calls for LESSCLOSE.
Upstream fix: https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48624?
CVE-2022-48624 is considered a high-severity vulnerability due to its potential to allow local attackers to execute arbitrary commands.
How do I fix CVE-2022-48624?
To remediate CVE-2022-48624, upgrade to less version 606 or later.
Which versions of less are affected by CVE-2022-48624?
CVE-2022-48624 affects less versions prior to 606, specifically versions up to 487-0.1, 551-2, and 590-2.
Who is impacted by CVE-2022-48624?
Users of less prior to version 606 on Debian and versions prior to ISVG 10.0.2 on IBM Security Verify Governance are impacted by CVE-2022-48624.
What is the cause of CVE-2022-48624?
CVE-2022-48624 is caused by the omission of shell_quote calls for LESSCLOSE in the close_altfile function within less.