CVE-2022-4515

A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.

Exuberant Ctags is not shipped in Red Hat Enterprise Linux 9, therefore it's not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.