Vulnerability Details : CVE-2022-28805
Potential exploit
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
Products affected by CVE-2022-28805
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:*:*:*:*:*:*:*:*
Threat overview for CVE-2022-28805
Top countries where our scanners detected CVE-2022-28805
Top open port discovered on systems with this issue
80
IPs affected by CVE-2022-28805 2
Find out if you* are
affected by CVE-2022-28805!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2022-28805
0.23%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 60 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-28805
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:P |
10.0
|
4.9
|
NIST | |
9.1
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
3.9
|
5.2
|
NIST |
CWE ids for CVE-2022-28805
-
The product reads data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-28805
-
https://lua-users.org/lists/lua-l/2022-02/msg00070.html
Exploit;Mailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/
[SECURITY] Fedora 36 Update: lua-5.4.4-3.fc36 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHYZOEFDVLVAD6EEP4CDW6DNONIVVHPA/
[SECURITY] Fedora 35 Update: lua-5.4.4-3.fc35 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://lua-users.org/lists/lua-l/2022-04/msg00009.html
Exploit;Mailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/
[SECURITY] Fedora 36 Update: lua-5.4.4-3.fc36 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/202305-23
Lua: Multiple Vulnerabilities (GLSA 202305-23) — Gentoo securityThird Party Advisory
-
https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa
Bug: Lua can generate wrong code when _ENV is <const> · lua/lua@1f3c6f4 · GitHubPatch;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UHYZOEFDVLVAD6EEP4CDW6DNONIVVHPA/
[SECURITY] Fedora 35 Update: lua-5.4.4-3.fc35 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lua-users.org/lists/lua-l/2022-02/msg00001.html
Exploit;Mailing List;Third Party Advisory
Jump to