CVE-2023-4540

2023-09-0508:15:40

Alpine Linux Development Team

security.alpinelinux.org

denial of service

excessive allocation

crafted request

unix

lua-http library

cve-2023-4540

exceptional conditions

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.0005 Low

EPSS

Percentile

19.0%

JSON

Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service (DoS) attack to be executed by sending a properly crafted request to the server.

This issue affects lua-http: all versions before commit ddab283.

OSVersionArchitecturePackageVersionFilename
Alpineedge-communitynoarchlua-http< 0.4-r2UNKNOWN
Alpine3.17-communitynoarchlua-http< 0.4-r2UNKNOWN
Alpine3.18-communitynoarchlua-http< 0.4-r2UNKNOWN
Alpine3.19-communitynoarchlua-http< 0.4-r2UNKNOWN
Alpine3.20-communitynoarchlua-http< 0.4-r2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-community	noarch	lua-http	< 0.4-r2	UNKNOWN
Alpine	3.17-community	noarch	lua-http	< 0.4-r2	UNKNOWN
Alpine	3.18-community	noarch	lua-http	< 0.4-r2	UNKNOWN
Alpine	3.19-community	noarch	lua-http	< 0.4-r2	UNKNOWN
Alpine	3.20-community	noarch	lua-http	< 0.4-r2	UNKNOWN