Veracode Vulnerability DatabaseVERACODE:35343Denial Of Service (DoS)
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
0.002 Low
EPSS
Percentile
49.9%
lua is vulnerable to denial of service. The vulnerability exists due to a lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read in lparser.c allowing an attacker to crash the system via maliciously crafted script.
References
github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa
lists.fedoraproject.org/archives/list/[email protected]/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/
lists.fedoraproject.org/archives/list/[email protected]/message/UHYZOEFDVLVAD6EEP4CDW6DNONIVVHPA/
lua-users.org/lists/lua-l/2022-02/msg00001.html
lua-users.org/lists/lua-l/2022-02/msg00070.html
lua-users.org/lists/lua-l/2022-04/msg00009.html
security-tracker.debian.org/tracker/CVE-2022-28805
security.gentoo.org/glsa/202305-23
Related
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
0.002 Low
EPSS
Percentile
49.9%