Low: lua security update
Summary
ALSA-2023:2582: Low: lua security update. Affects lua versions < 5.4.4-3.el9. Fixed in 5.4.4-3.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language.
Vulnerability Detail
The lua package is affected by a heap buffer overread vulnerability (CVE-2022-28805). This vulnerability could allow an attacker to read beyond the bounds of a heap buffer, potentially leading to information disclosure or a crash. The impact of this vulnerability depends on how the affected package is used in the application.
How To Fix
Minimum fixed version
5.4.4-3.el9
This is the first release that contains the fix.
sudo dnf update luaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the lua package is affected by a heap buffer overread vulnerability. It is recommended to update the package to the latest version to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for lua →
FAQ
Lua is a light-weight programming language designed for extending applications. It is often used as a scripting language and for general-purpose programming.
A heap buffer overread vulnerability occurs when a program reads data from a heap buffer beyond its bounds. This can lead to information disclosure or crashes.
The impact of this vulnerability depends on how the affected package is used in the application. It could potentially lead to information disclosure or crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for vulnerabilities.
You can find more information about this vulnerability, including the CVE page, in the AlmaLinux Release Notes linked in the References section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for lua.
