[Bug 2064772] New: CVE-2021-44964 lua: use after free allows Sandbox Escape
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2064772
Bug ID: 2064772
Summary: CVE-2021-44964 lua: use after free allows Sandbox
Escape
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: pdelbell(a)redhat.com
CC: 4le(a)live.com, caswilli(a)redhat.com,
csutherl(a)redhat.com, drjohnson1(a)gmail.com,
fedora(a)famillecollet.com, fjansen(a)redhat.com,
gzaronik(a)redhat.com, hdegoede(a)redhat.com,
jburrell(a)redhat.com, jclere(a)redhat.com,
jwon(a)redhat.com, kaycoth(a)redhat.com,
krathod(a)redhat.com,
lua-packagers-sig(a)lists.fedoraproject.org,
mhroncok(a)redhat.com, michel(a)michel-slm.name,
moceap(a)hotmail.com, mschmidt(a)redhat.com,
mturk(a)redhat.com, packaging-team-maint(a)redhat.com,
pjindal(a)redhat.com, rob.myers(a)gtri.gatech.edu,
spotrh(a)gmail.com, szappis(a)redhat.com
Target Milestone: ---
Classification: Other
Use after free in garbage collector and finalizer of lgc.c in Lua interpreter
5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script
file.
References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44964
https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerab...
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44964
http://lua-users.org/lists/lua-l/2021-12/msg00007.html
http://lua-users.org/lists/lua-l/2021-12/msg00015.html
http://lua-users.org/lists/lua-l/2021-12/msg00030.html
http://lua-users.org/lists/lua-l/2021-11/msg00186.html
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2064772
3 days, 14 hours
[Bug 2091484] New: luarocks package should pull in lua-devel as a dependency
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2091484
Bug ID: 2091484
Summary: luarocks package should pull in lua-devel as a
dependency
Product: Fedora
Version: rawhide
Status: NEW
Component: luarocks
Assignee: michel(a)michel-slm.name
Reporter: ferdnyc(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: ktdreyer(a)ktdreyer.com,
lua-packagers-sig(a)lists.fedoraproject.org,
michel(a)michel-slm.name
Target Milestone: ---
Classification: Fedora
Description of problem:
A new Fedora user reported[1] problems using luarocks after install, because it
failed to compile a module after downloading it. The user eventually worked out
on their own that they needed to install lua-devel, but they shouldn't have had
to puzzle that solution out. By its very nature, luarocks needs to have the lua
headers available for it to function properly. It should pull in lua-devel as a
dependency automatically when installed.
Version-Release number of selected component (if applicable):
luarocks-3.7.0-3.fc35.noarch
How reproducible:
100%
Steps to Reproduce:
1. sudo dnf install luarocks
2. luarocks install --local lcurses
3.
Actual results:
"Error: Failed finding Lua header files. You may need to install them or
configure LUA_INCDIR."
Expected results:
Package compiles successfully
Additional info:
[1]: https://ask.fedoraproject.org/t/problem-using-luarocks-on-f35/22897
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2091484
1 month
[Bug 2088772] New: Luarocks for el9
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2088772
Bug ID: 2088772
Summary: Luarocks for el9
Product: Fedora EPEL
Version: epel9
OS: Linux
Status: NEW
Component: luarocks
Assignee: michel(a)michel-slm.name
Reporter: ulrik.haugen(a)liu.se
QA Contact: extras-qa(a)fedoraproject.org
CC: ktdreyer(a)ktdreyer.com,
lua-packagers-sig(a)lists.fedoraproject.org,
michel(a)michel-slm.name
Target Milestone: ---
Classification: Fedora
Please add luarocks to epel for el9.
I just rebuilt luarocks-3.5.0-1.el9.noarch.rpm on an rhel9 system and it works
without modification.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2088772
1 month, 1 week