Red Hat Security Advisory

RHSA-2023:2582

lua security update

Released 2023-05-09 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) lua-5.4.4-3.el9
Red Hat Enterprise Linux BaseOS (v. 9) lua-5.4.4-3.el9, lua-libs-5.4.4-3.el9
Red Hat Enterprise Linux CRB (v. 9) lua-5.4.4-3.el9, lua-devel-5.4.4-3.el9

Fixes 1 record

TI-2022-11427 CVE-2022-28805 · GHSA-pxhp-rhgc-5jx8

singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a…

MEDIUM 45

singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02976 Published 2022-04-08 Fixed CWE-125