Headline

Red Hat Security Advisory 2022-7329-01

Red Hat Security Advisory 2022-7329-01 - The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Issues addressed include a buffer overflow vulnerability.

2 years ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #nodejs #js #java #php #buffer_overflow #ssl

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Moderate: lua security update
Advisory ID: RHSA-2022:7329-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:7329
Issue date: 2022-11-02
CVE Names: CVE-2022-33099
====================================================================

Summary:

An update for lua is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

Relevant releases/architectures:

Red Hat CodeReady Linux Builder (v. 9) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux BaseOS (v. 9) - aarch64, ppc64le, s390x, x86_64

Description:

The lua packages provide support for Lua, a powerful light-weight
programming language designed for extending applications. Lua is also
frequently used as a general-purpose, stand-alone language.

Security Fix(es):

lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to
uncontrolled recursion in error handling (CVE-2022-33099)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

Bugs fixed (https://bugzilla.redhat.com/):

2104427 - CVE-2022-33099 lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to uncontrolled recursion in error handling

Package List:

Red Hat Enterprise Linux AppStream (v. 9):

aarch64:
lua-5.4.2-4.el9_0.3.aarch64.rpm
lua-debuginfo-5.4.2-4.el9_0.3.aarch64.rpm
lua-debugsource-5.4.2-4.el9_0.3.aarch64.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.aarch64.rpm

ppc64le:
lua-5.4.2-4.el9_0.3.ppc64le.rpm
lua-debuginfo-5.4.2-4.el9_0.3.ppc64le.rpm
lua-debugsource-5.4.2-4.el9_0.3.ppc64le.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.ppc64le.rpm

s390x:
lua-5.4.2-4.el9_0.3.s390x.rpm
lua-debuginfo-5.4.2-4.el9_0.3.s390x.rpm
lua-debugsource-5.4.2-4.el9_0.3.s390x.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.s390x.rpm

x86_64:
lua-5.4.2-4.el9_0.3.x86_64.rpm
lua-debuginfo-5.4.2-4.el9_0.3.x86_64.rpm
lua-debugsource-5.4.2-4.el9_0.3.x86_64.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.x86_64.rpm

Red Hat Enterprise Linux BaseOS (v. 9):

Source:
lua-5.4.2-4.el9_0.3.src.rpm

aarch64:
lua-debuginfo-5.4.2-4.el9_0.3.aarch64.rpm
lua-debugsource-5.4.2-4.el9_0.3.aarch64.rpm
lua-libs-5.4.2-4.el9_0.3.aarch64.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.aarch64.rpm

ppc64le:
lua-debuginfo-5.4.2-4.el9_0.3.ppc64le.rpm
lua-debugsource-5.4.2-4.el9_0.3.ppc64le.rpm
lua-libs-5.4.2-4.el9_0.3.ppc64le.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.ppc64le.rpm

s390x:
lua-debuginfo-5.4.2-4.el9_0.3.s390x.rpm
lua-debugsource-5.4.2-4.el9_0.3.s390x.rpm
lua-libs-5.4.2-4.el9_0.3.s390x.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.s390x.rpm

x86_64:
lua-debuginfo-5.4.2-4.el9_0.3.i686.rpm
lua-debuginfo-5.4.2-4.el9_0.3.x86_64.rpm
lua-debugsource-5.4.2-4.el9_0.3.i686.rpm
lua-debugsource-5.4.2-4.el9_0.3.x86_64.rpm
lua-libs-5.4.2-4.el9_0.3.i686.rpm
lua-libs-5.4.2-4.el9_0.3.x86_64.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.i686.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.x86_64.rpm

Red Hat CodeReady Linux Builder (v. 9):

aarch64:
lua-debuginfo-5.4.2-4.el9_0.3.aarch64.rpm
lua-debugsource-5.4.2-4.el9_0.3.aarch64.rpm
lua-devel-5.4.2-4.el9_0.3.aarch64.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.aarch64.rpm

ppc64le:
lua-debuginfo-5.4.2-4.el9_0.3.ppc64le.rpm
lua-debugsource-5.4.2-4.el9_0.3.ppc64le.rpm
lua-devel-5.4.2-4.el9_0.3.ppc64le.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.ppc64le.rpm

s390x:
lua-debuginfo-5.4.2-4.el9_0.3.s390x.rpm
lua-debugsource-5.4.2-4.el9_0.3.s390x.rpm
lua-devel-5.4.2-4.el9_0.3.s390x.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.s390x.rpm

x86_64:
lua-5.4.2-4.el9_0.3.i686.rpm
lua-debuginfo-5.4.2-4.el9_0.3.i686.rpm
lua-debuginfo-5.4.2-4.el9_0.3.x86_64.rpm
lua-debugsource-5.4.2-4.el9_0.3.i686.rpm
lua-debugsource-5.4.2-4.el9_0.3.x86_64.rpm
lua-devel-5.4.2-4.el9_0.3.i686.rpm
lua-devel-5.4.2-4.el9_0.3.x86_64.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.i686.rpm
lua-libs-debuginfo-5.4.2-4.el9_0.3.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2022-33099
https://access.redhat.com/security/updates/classification/#moderate

Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBY2K9JdzjgjWX9erEAQheTg//aflei8nmLalr43qUBKZqkDaEPMrvlVQr
H2425hQv6zIUUNsk+3N+BqJUMMLziVIkBv5o71NFMh16JMqXGrzeNrwPAGVyIt6N
8AX7vTuOIeJ8fF5RcdOUWHQxodQUMFkrvJjLcVUVHEXfdOllJrep+/l00DmDstBJ
OumrhkgvBKFHx8krDIl765PO5p0Z5Cfz6rLnfVLMcW9KAkLRlEdGPo3xcIsHAhLV
xYB/UHuNFo45yArnAX2oBdveS7PB+xzTn/B4I3Bxdjd+fZAzVl2WDlHNwPHPeFHV
5CYwW5Mfvrm1PcV4pR+RUb7I89o6EZgM70iyhMcK5HcllEPuYcfZXjeQVHadc+aM
wbY1yTbpY2fUWAKSKs+kM37lUAF/sxBkQAL2CjzquHMwLDa+0RDqjnrVI2t4k6JY
OMfOC379Y3F23KpH5bYGwrJs3X/0cFkXoye0nnkYTls7/sJ4Uyxy/BdSyzydPwJo
wVnVmuxV4BwNQ9vGZC+JuGXM/G1Hee3gnU9Cb60+RhPWPCWBwKSnKpULt1jbt4xO
n7ZfV6W5YNXcqU1DzQU0e644sLpTHeetgy/QIZfMcTEJl5dNKoFf/mj9SpSCILFa
yn3eu2mp/KSEZ+CXtV0jNwYI6wfsVaWDbi34KK20AAbLI/mSHUV0Pcl7++4IP6V0
NRgW2g5QG04=WQH9
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Related news

Ubuntu Security Notice USN-6916-1

Ubuntu Security Notice 6916-1 - It was discovered that Lua did not properly generate code when "_ENV" is constant. An attacker could possibly use this issue to cause a denial of service or execute arbitrary unstrusted lua code. It was discovered that Lua did not properly handle C stack overflows during error handling. An attacker could possibly use this issue to cause a denial of service.

3 months ago

Packet Storm

Open in Source

#vulnerability #ubuntu #dos #perl

Red Hat Security Advisory 2023-3742-02

Red Hat Security Advisory 2023-3742-02 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, and remote SQL injection vulnerabilities.

1 year ago

Packet Storm

Open in Source

#sql #vulnerability #web #mac #microsoft #linux #red_hat #dos #nodejs #js #kubernetes #perl #aws #auth #ibm #postgres #sap #ssl

RHSA-2023:3742: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update

Updated images that include numerous enhancements, security, and bug fixes are now available in Red Hat Container Registry for Red Hat OpenShift Data Foundation 4.13.0 on Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-16250: A flaw was found in Vault and Vault Enterprise (“Vault”). In the affected versions of Vault, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to validate AWS IAM ident...

1 year ago

Red Hat Security Data

Open in Source

#sql #vulnerability #web #mac #google #microsoft #linux #red_hat #dos #nodejs #js #git #kubernetes #perl #aws #auth #ibm #postgres #sap #ssl

Red Hat Security Advisory 2023-0786-01

Red Hat Security Advisory 2023-0786-01 - Network observability is an OpenShift operator that provides a monitoring pipeline to collect and enrich network flows that are produced by the Network observability eBPF agent. The operator provides dashboards, metrics, and keeps flows accessible in a queryable log store, Grafana Loki. When a FlowCollector is deployed, new dashboards are available in the Console.

1 year ago

Packet Storm

Open in Source

#vulnerability #red_hat #auth

RHSA-2023:0786: Red Hat Security Advisory: Network observability 1.1.0 security update

Network observability 1.1.0 release for OpenShift Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0813: A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #java #kubernetes #aws #auth

RHSA-2022:7329: Red Hat Security Advisory: lua security update

An update for lua is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-33099: lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to uncontrolled recursion in error handling

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #buffer_overflow #ibm #sap

CVE-2022-33099

An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.

2 years ago

CVE

Open in Source

#buffer_overflow