Moderate: lua security update
Summary
RLSA-2022:7329: Moderate: lua security update. Affects lua versions < 0:5.4.2-4.el9_0.3. Fixed in 0:5.4.2-4.el9_0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lua package provides support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. The vulnerability affects the lua package in Rocky Linux 9.
Vulnerability Detail
The vulnerability (CVE-2022-33099) is a heap buffer overflow in luaG_errormsg() function in ldebug.c due to uncontrolled recursion in error handling. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service. The impact of this vulnerability is considered moderate with a CVSS score of 6.5.
How To Fix
Minimum fixed version
0:5.4.2-4.el9_0.3
This is the first release that contains the fix.
sudo dnf update luaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the lua package in Rocky Linux 9 is affected by a moderate vulnerability (CVE-2022-33099) that can be exploited to execute arbitrary code or cause a denial of service. It is recommended to update the lua package to the latest version to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lua →
FAQ
Lua is a powerful light-weight programming language designed for extending applications. It is frequently used as a general-purpose, stand-alone language.
The vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service.
The CVSS score of this vulnerability is 6.5, which indicates a moderate impact.
To fix this vulnerability, update the lua package to version 5.4.2-4.el9_0.3 or later.
No specific workaround has been provided for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for lua.
