[Bug 2047672] New: CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

List overview All Threads
Download

newer

older

[Bug 2143391] Review Request:...

[Bug 2143050] Review Request:...

bugzilla＠redhat.com

28 Jan 2022 28 Jan '22

10:33 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

Bug ID: 2047672 Summary: CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: mrehak@redhat.com CC: 4le@live.com, bdettelb@redhat.com, caswilli@redhat.com, csutherl@redhat.com, drjohnson1@gmail.com, fjansen@redhat.com, gzaronik@redhat.com, jburrell@redhat.com, jclere@redhat.com, jwon@redhat.com, kaycoth@redhat.com, krathod@redhat.com, lua-packagers-sig@lists.fedoraproject.org, mhroncok@redhat.com, michel@michel-slm.name, mturk@redhat.com, packaging-team-maint@redhat.com, pjindal@redhat.com, rob.myers@gtri.gatech.edu, spotrh@gmail.com, szappis@redhat.com, tkasparek@redhat.com Target Milestone: --- Classification: Other

Stack overflow in lua_resume of ldo.c in Lua Interpreter allows attackers to perform a Denial of Service via a crafted script file.

Reference:

http://lua-users.org/lists/lua-l/2021-11/msg00015.html http://lua-users.org/lists/lua-l/2021-10/msg00123.html

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

Show replies by thread

bugzilla＠redhat.com

28 Jan 28 Jan

10:34 a.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

Marian Rehak mrehak@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2047673

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=2047673 [Bug 2047673] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

10:34 a.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

--- Comment #1 from Marian Rehak mrehak@redhat.com --- Created lua tracking bugs for this issue:

Affects: fedora-all [bug 2047673]

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

10:34 a.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

Marian Rehak mrehak@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2047674

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

31 Jan 31 Jan

6:31 a.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

TEJ RATHI trathi@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2048364

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

6:37 a.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

TEJ RATHI trathi@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2048368, 2048367

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

6:37 a.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

TEJ RATHI trathi@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2048369

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

11:04 a.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

Florencio Cano fcanogab@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2048461

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

1:24 p.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

--- Doc Text *updated* by TEJ RATHI trathi@redhat.com --- A stack overflow issue was discovered in Lua (v5.1.0 to v5.4.4) in function lua_resume() of 'ldo.c'. The attack can be executed locally where an attacker could pass specially crafted file to Lua Interpreter causing a crash that leads to a denial of service.

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

1 Feb 1 Feb

3:01 p.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

--- Doc Text *updated* by RaTasha Tillery-Smith rtillery@redhat.com --- A stack overflow issue was discovered in Lua in the lua_resume() function of 'ldo.c'. This flaw allows a local attacker to pass a specially crafted file to the Lua Interpreter, causing a crash that leads to a denial of service.

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

8 Feb 8 Feb

2:11 a.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672 Bug 2047672 depends on bug 2047673, which changed state.

Bug 2047673 Summary: CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2047673

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

2 Feb 2 Feb

3:26 p.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

RHEL Program Management Team pgm-rhel-tools@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

28 Feb 28 Feb

9:19 a.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

--- Comment #11 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 9

Via RHSA-2023:0957 https://access.redhat.com/errata/RHSA-2023:0957

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

9:19 a.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

14 Mar 14 Mar

2:54 p.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

--- Comment #12 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1211 https://access.redhat.com/errata/RHSA-2023:1211

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

2:55 p.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

6:57 p.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

--- Comment #13 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-43519

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

bugzilla＠redhat.com

6:57 p.m.

New subject: [Bug 2047672] CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

https://bugzilla.redhat.com/show_bug.cgi?id=2047672

Product Security DevOps Team prodsec-dev@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047672

640

Age (days ago)

1050

Last active (days ago)

lua-packagers-sig@lists.fedoraproject.org

17 comments

1 participants

tags (0)

participants (1)

bugzilla＠redhat.com