Critical Security Update for Lua Package: CVE-2021-43519 and CVE-2021-44964
Summary
RHSA-2023:1211: Red Hat Security Advisory: lua security update. Affects lua versions < 0:5.4.4-1.el9_0.1. Fixed in 0:5.4.4-1.el9_0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lua is a powerful, efficient, lightweight, embeddable scripting language commonly used in game development, web applications, and other software. It provides a simple and flexible API for integrating with C and C++ programs. However, vulnerabilities in Lua can lead to severe security risks, making it crucial to maintain updated versions.
Vulnerability Detail
The vulnerabilities identified as CVE-2021-43519 and CVE-2021-44964 in the Lua package could allow attackers to exploit weaknesses in the code execution process, potentially leading to unauthorized access, data corruption, or denial of service. These vulnerabilities arise from improper handling of certain inputs, which can be manipulated by an attacker to execute arbitrary code or crash the application.
How To Fix
Minimum fixed version
0:5.4.4-1.el9_0.1
This is the first release that contains the fix.
sudo dnf update luaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider implementing input validation and sanitization in your applications that utilize Lua to mitigate potential exploitation of these vulnerabilities.
Conclusion
The vulnerabilities in the Lua package pose significant security risks that can be mitigated by updating to the latest patched version. It is essential for developers and system administrators to remain vigilant and apply updates promptly to safeguard their applications.
See every vulnerability recorded for lua →
FAQ
These are identifiers for specific vulnerabilities found in the Lua package that could allow attackers to execute arbitrary code or cause denial of service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for these vulnerabilities is 7.0, indicating a high severity level.
Implement input validation and sanitization in your applications to reduce the risk of exploitation until you can apply the update.
You can refer to the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2023:1211.json for detailed information.
Related vulnerabilities
Recent vulnerabilities recorded for lua.
