[Bug 2073889] New: CVE-2022-28805 lua: dev-lang/lua: heap buffer overread [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2073889
Bug ID: 2073889
Summary: CVE-2022-28805 lua: dev-lang/lua: heap buffer overread
[fedora-all]
Product: Fedora
Version: 35
Status: NEW
Component: lua
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: spotrh(a)gmail.com
Reporter: ahanwate(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: 4le(a)live.com, drjohnson1(a)gmail.com,
lua-packagers-sig(a)lists.fedoraproject.org,
mhroncok(a)redhat.com, michel(a)michel-slm.name,
rob.myers(a)gtri.gatech.edu, spotrh(a)gmail.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2073889
1 week, 5 days
[Bug 2093036] New: [luarocks][epel]: please branch and build luarocks in epel9
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2093036
Bug ID: 2093036
Summary: [luarocks][epel]: please branch and build luarocks in
epel9
Product: Fedora
Version: rawhide
Status: NEW
Component: luarocks
Assignee: michel(a)michel-slm.name
Reporter: kkeithle(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: ktdreyer(a)ktdreyer.com,
lua-packagers-sig(a)lists.fedoraproject.org,
michel(a)michel-slm.name
Target Milestone: ---
Classification: Fedora
Description of problem:
luarocks is a BR for ceph quincy (17.2.x). While ceph itself will not (ever) be
built in EPEL, there are Ceph developers who want to build Ceph on RHEL9 or
CentOS Stream 9 with EPEL and end users who want to run Ceph from the CentOS
Storage SIG with EPEL.
Version-Release number of selected component (if applicable):
How reproducible:
Steps to Reproduce:
1.
2.
3.
Actual results:
Expected results:
Additional info:
It builds as is from the rawhide sources
(https://koji.fedoraproject.org/koji/taskinfo?taskID=87815596)
If you don't wish to build luarocks in EPEL yourself, please add the
epel-packagers-sig group as collaborator for epel* branches, or (less
preferable) add me (FAS: kkeithle) as a collaborator for epel* branches.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2093036
2 weeks, 6 days
[Bug 2064772] New: CVE-2021-44964 lua: use after free allows Sandbox Escape
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2064772
Bug ID: 2064772
Summary: CVE-2021-44964 lua: use after free allows Sandbox
Escape
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: pdelbell(a)redhat.com
CC: 4le(a)live.com, caswilli(a)redhat.com,
csutherl(a)redhat.com, drjohnson1(a)gmail.com,
fedora(a)famillecollet.com, fjansen(a)redhat.com,
gzaronik(a)redhat.com, hdegoede(a)redhat.com,
jburrell(a)redhat.com, jclere(a)redhat.com,
jwon(a)redhat.com, kaycoth(a)redhat.com,
krathod(a)redhat.com,
lua-packagers-sig(a)lists.fedoraproject.org,
mhroncok(a)redhat.com, michel(a)michel-slm.name,
moceap(a)hotmail.com, mschmidt(a)redhat.com,
mturk(a)redhat.com, packaging-team-maint(a)redhat.com,
pjindal(a)redhat.com, rob.myers(a)gtri.gatech.edu,
spotrh(a)gmail.com, szappis(a)redhat.com
Target Milestone: ---
Classification: Other
Use after free in garbage collector and finalizer of lgc.c in Lua interpreter
5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script
file.
References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44964
https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerab...
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44964
http://lua-users.org/lists/lua-l/2021-12/msg00007.html
http://lua-users.org/lists/lua-l/2021-12/msg00015.html
http://lua-users.org/lists/lua-l/2021-12/msg00030.html
http://lua-users.org/lists/lua-l/2021-11/msg00186.html
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2064772
1 month, 2 weeks