Denial of Service Vulnerability in lua-http Package
Summary
DEBIAN-CVE-2023-4540: Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service (DoS) attack to be executed by sending a properly crafted request to the serve... Affects lua-http versions < 0.4-2. Fixed in 0.4-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The lua-http package is a library for HTTP client and server functionality in Lua, designed to facilitate web communication in applications. It is widely used due to its lightweight nature and flexibility. However, the package has been found to have a vulnerability that can lead to excessive resource allocation and potential denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2023-4540, stems from improper handling of exceptional conditions within the lua-http library. This flaw allows an attacker to send a specially crafted request that causes the application to enter an infinite loop, leading to excessive resource consumption and ultimately a denial of service. This issue affects all versions of lua-http prior to commit ddab283.
How To Fix
Minimum fixed version
0.4-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lua-httpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement rate limiting on incoming requests to the server to mitigate the risk of denial of service attacks until the package can be updated.
Conclusion
The lua-http package has a critical vulnerability that can lead to denial of service attacks. It is essential for users to update to the patched version 0.4-2 to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for lua-http →
FAQ
The vulnerability allows for excessive resource allocation and can lead to a denial of service due to an infinite loop triggered by a crafted request.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
All versions of lua-http prior to commit ddab283 are affected by this vulnerability.
Update the lua-http package to version 0.4-2 to patch the vulnerability and consider implementing rate limiting as a temporary measure.
Yes, Vulert provides a service that allows you to monitor open-source vulnerabilities in real-time using a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for lua-http.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
