-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Moderate: lua security update
Advisory ID:       RHSA-2023:1211-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:1211
Issue date:        2023-03-14
CVE Names:         CVE-2021-43519 CVE-2021-44964 
====================================================================
1. Summary:

An update for lua is now available for Red Hat Enterprise Linux 9.0
Extended Update Support.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat CodeReady Linux Builder EUS (v.9.0) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream EUS (v.9.0) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux BaseOS EUS (v.9.0) - aarch64, ppc64le, s390x, x86_64

3. Description:

The lua packages provide support for Lua, a powerful light-weight
programming language designed for extending applications. Lua is also
frequently used as a general-purpose, stand-alone language.

The following packages have been upgraded to a later upstream version: lua
(5.4.4).

Security Fix(es):

* lua: use after free allows Sandbox Escape (CVE-2021-44964)

* lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted
script file (CVE-2021-43519)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2047672 - CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file
2064772 - CVE-2021-44964 lua: use after free allows Sandbox Escape

6. Package List:

Red Hat Enterprise Linux AppStream EUS (v.9.0):

aarch64:
lua-5.4.4-1.el9_0.1.aarch64.rpm
lua-debuginfo-5.4.4-1.el9_0.1.aarch64.rpm
lua-debugsource-5.4.4-1.el9_0.1.aarch64.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.aarch64.rpm

ppc64le:
lua-5.4.4-1.el9_0.1.ppc64le.rpm
lua-debuginfo-5.4.4-1.el9_0.1.ppc64le.rpm
lua-debugsource-5.4.4-1.el9_0.1.ppc64le.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.ppc64le.rpm

s390x:
lua-5.4.4-1.el9_0.1.s390x.rpm
lua-debuginfo-5.4.4-1.el9_0.1.s390x.rpm
lua-debugsource-5.4.4-1.el9_0.1.s390x.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.s390x.rpm

x86_64:
lua-5.4.4-1.el9_0.1.x86_64.rpm
lua-debuginfo-5.4.4-1.el9_0.1.x86_64.rpm
lua-debugsource-5.4.4-1.el9_0.1.x86_64.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.x86_64.rpm

Red Hat Enterprise Linux BaseOS EUS (v.9.0):

Source:
lua-5.4.4-1.el9_0.1.src.rpm

aarch64:
lua-debuginfo-5.4.4-1.el9_0.1.aarch64.rpm
lua-debugsource-5.4.4-1.el9_0.1.aarch64.rpm
lua-libs-5.4.4-1.el9_0.1.aarch64.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.aarch64.rpm

ppc64le:
lua-debuginfo-5.4.4-1.el9_0.1.ppc64le.rpm
lua-debugsource-5.4.4-1.el9_0.1.ppc64le.rpm
lua-libs-5.4.4-1.el9_0.1.ppc64le.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.ppc64le.rpm

s390x:
lua-debuginfo-5.4.4-1.el9_0.1.s390x.rpm
lua-debugsource-5.4.4-1.el9_0.1.s390x.rpm
lua-libs-5.4.4-1.el9_0.1.s390x.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.s390x.rpm

x86_64:
lua-debuginfo-5.4.4-1.el9_0.1.i686.rpm
lua-debuginfo-5.4.4-1.el9_0.1.x86_64.rpm
lua-debugsource-5.4.4-1.el9_0.1.i686.rpm
lua-debugsource-5.4.4-1.el9_0.1.x86_64.rpm
lua-libs-5.4.4-1.el9_0.1.i686.rpm
lua-libs-5.4.4-1.el9_0.1.x86_64.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.i686.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.x86_64.rpm

Red Hat CodeReady Linux Builder EUS (v.9.0):

aarch64:
lua-debuginfo-5.4.4-1.el9_0.1.aarch64.rpm
lua-debugsource-5.4.4-1.el9_0.1.aarch64.rpm
lua-devel-5.4.4-1.el9_0.1.aarch64.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.aarch64.rpm

ppc64le:
lua-debuginfo-5.4.4-1.el9_0.1.ppc64le.rpm
lua-debugsource-5.4.4-1.el9_0.1.ppc64le.rpm
lua-devel-5.4.4-1.el9_0.1.ppc64le.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.ppc64le.rpm

s390x:
lua-debuginfo-5.4.4-1.el9_0.1.s390x.rpm
lua-debugsource-5.4.4-1.el9_0.1.s390x.rpm
lua-devel-5.4.4-1.el9_0.1.s390x.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.s390x.rpm

x86_64:
lua-5.4.4-1.el9_0.1.i686.rpm
lua-debuginfo-5.4.4-1.el9_0.1.i686.rpm
lua-debuginfo-5.4.4-1.el9_0.1.x86_64.rpm
lua-debugsource-5.4.4-1.el9_0.1.i686.rpm
lua-debugsource-5.4.4-1.el9_0.1.x86_64.rpm
lua-devel-5.4.4-1.el9_0.1.i686.rpm
lua-devel-5.4.4-1.el9_0.1.x86_64.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.i686.rpm
lua-libs-debuginfo-5.4.4-1.el9_0.1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-43519
https://access.redhat.com/security/cve/CVE-2021-44964
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBZBCPdNzjgjWX9erEAQijQw/+PAUHPPT6ReT++SM/MKYXHBp8fCo9rKCQ
uuvMz1itTQjP4iSBGKFBLuBKfQC8oTK5Sn1uy2lZvY3ECNbPSOQUJSCurdDNXCvn
VOu/yDiZktCHXO1rzU0IHXM4FnyJSTrJEODOm+pYC3gakP8EZRAoDDMOLbzVz8gB
NgsvCo9GfRmeFXtd7TDbbpMuPEcYHnjz0TfxcH++Vk7IeV9Ka6Z74VD3erFQgAmu
BrR8nI7IHqssbp/8MVyhXN1SZxwlnX4UsgqB+b5QQTdiT/ARgCjB2e6spF4qtfX/
9EUPaYNrVf6JQTbSRmPxsDMD9XPJO/YNS2FaBrM8BFU18JDMWLYSfA9+Wg5T7u6K
Hmq67QnsoVX08uPFkThCFR0PqQb1lSY5GS5x0ZpIN1/4wzhwZSRzGYCtexzSMzLz
Y2HD9hGZziscE2Ae9OG6UQr3uylyd43ZkCtePUtyJ9gYDOE3gfqesSZgwIxnhHzE
aMulcXnXo59e6aK041hAfbMbFkwrcCkEDhxsLoxSc3L+IvTr62Fw8s6gv9q0wEPD
VDLEzAg8m46LmvNmzmeb+RQkEzTXNfTD3Lo9tzjdwb1osxqVG9tK7SKuDds2NVbw
xvU+3lzfzrkipOnivoVEXJZVQJMpm443ApIPTvQfHEjTPm4lkDBgyKXVm/PRMUDM
vZY2mF08dBQ=r9xp
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2023-1211:01 Moderate: lua security update

An update for lua is now available for Red Hat Enterprise Linux 9.0 Extended Update Support

Summary

The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language.
The following packages have been upgraded to a later upstream version: lua (5.4.4).
Security Fix(es):
* lua: use after free allows Sandbox Escape (CVE-2021-44964)
* lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file (CVE-2021-43519)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2021-43519 https://access.redhat.com/security/cve/CVE-2021-44964 https://access.redhat.com/security/updates/classification/#moderate

Package List

Red Hat Enterprise Linux AppStream EUS (v.9.0):
aarch64: lua-5.4.4-1.el9_0.1.aarch64.rpm lua-debuginfo-5.4.4-1.el9_0.1.aarch64.rpm lua-debugsource-5.4.4-1.el9_0.1.aarch64.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.aarch64.rpm
ppc64le: lua-5.4.4-1.el9_0.1.ppc64le.rpm lua-debuginfo-5.4.4-1.el9_0.1.ppc64le.rpm lua-debugsource-5.4.4-1.el9_0.1.ppc64le.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.ppc64le.rpm
s390x: lua-5.4.4-1.el9_0.1.s390x.rpm lua-debuginfo-5.4.4-1.el9_0.1.s390x.rpm lua-debugsource-5.4.4-1.el9_0.1.s390x.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.s390x.rpm
x86_64: lua-5.4.4-1.el9_0.1.x86_64.rpm lua-debuginfo-5.4.4-1.el9_0.1.x86_64.rpm lua-debugsource-5.4.4-1.el9_0.1.x86_64.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.x86_64.rpm
Red Hat Enterprise Linux BaseOS EUS (v.9.0):
Source: lua-5.4.4-1.el9_0.1.src.rpm
aarch64: lua-debuginfo-5.4.4-1.el9_0.1.aarch64.rpm lua-debugsource-5.4.4-1.el9_0.1.aarch64.rpm lua-libs-5.4.4-1.el9_0.1.aarch64.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.aarch64.rpm
ppc64le: lua-debuginfo-5.4.4-1.el9_0.1.ppc64le.rpm lua-debugsource-5.4.4-1.el9_0.1.ppc64le.rpm lua-libs-5.4.4-1.el9_0.1.ppc64le.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.ppc64le.rpm
s390x: lua-debuginfo-5.4.4-1.el9_0.1.s390x.rpm lua-debugsource-5.4.4-1.el9_0.1.s390x.rpm lua-libs-5.4.4-1.el9_0.1.s390x.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.s390x.rpm
x86_64: lua-debuginfo-5.4.4-1.el9_0.1.i686.rpm lua-debuginfo-5.4.4-1.el9_0.1.x86_64.rpm lua-debugsource-5.4.4-1.el9_0.1.i686.rpm lua-debugsource-5.4.4-1.el9_0.1.x86_64.rpm lua-libs-5.4.4-1.el9_0.1.i686.rpm lua-libs-5.4.4-1.el9_0.1.x86_64.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.i686.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.x86_64.rpm
Red Hat CodeReady Linux Builder EUS (v.9.0):
aarch64: lua-debuginfo-5.4.4-1.el9_0.1.aarch64.rpm lua-debugsource-5.4.4-1.el9_0.1.aarch64.rpm lua-devel-5.4.4-1.el9_0.1.aarch64.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.aarch64.rpm
ppc64le: lua-debuginfo-5.4.4-1.el9_0.1.ppc64le.rpm lua-debugsource-5.4.4-1.el9_0.1.ppc64le.rpm lua-devel-5.4.4-1.el9_0.1.ppc64le.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.ppc64le.rpm
s390x: lua-debuginfo-5.4.4-1.el9_0.1.s390x.rpm lua-debugsource-5.4.4-1.el9_0.1.s390x.rpm lua-devel-5.4.4-1.el9_0.1.s390x.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.s390x.rpm
x86_64: lua-5.4.4-1.el9_0.1.i686.rpm lua-debuginfo-5.4.4-1.el9_0.1.i686.rpm lua-debuginfo-5.4.4-1.el9_0.1.x86_64.rpm lua-debugsource-5.4.4-1.el9_0.1.i686.rpm lua-debugsource-5.4.4-1.el9_0.1.x86_64.rpm lua-devel-5.4.4-1.el9_0.1.i686.rpm lua-devel-5.4.4-1.el9_0.1.x86_64.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.i686.rpm lua-libs-debuginfo-5.4.4-1.el9_0.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2023:1211-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:1211
Issued Date: : 2023-03-14
CVE Names: CVE-2021-43519 CVE-2021-44964

Topic

An update for lua is now available for Red Hat Enterprise Linux 9.0Extended Update Support.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

Red Hat CodeReady Linux Builder EUS (v.9.0) - aarch64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux AppStream EUS (v.9.0) - aarch64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux BaseOS EUS (v.9.0) - aarch64, ppc64le, s390x, x86_64


Bugs Fixed

2047672 - CVE-2021-43519 lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file

2064772 - CVE-2021-44964 lua: use after free allows Sandbox Escape


Related News

Linux Mint 22: Elevating Security and Usability for Admins
3 - 5 min read
Linux Mint has has long been recognized as a versatile and user-friendly distribution and has earned great popularity among administrators and
Exim 4.98 Addresses Critical Vulnerabilities, Bolsters Email Server Security
2 - 4 min read
Exim is one of Unix-like systems' most widely used mail transfer agents. It's essential for email delivery and handling and is a significant part of
Recent OpenSSH RCE Bug Explained: Impact & Mitigations
2 - 4 min read
In an era where cybersecurity threats loom larger than ever, the discovery of a Remote Code Execution (RCE) vulnerability in OpenSSH by Qualys’
CVE-2024-4577: A Swiftly Weaponized Vulnerability for Ransomware Distribution
2 - 4 min read
Security researchers recently issued an update detailing how attackers are exploiting a PHP code execution vulnerability to spread TellYouThePass
Play Ransomware Group Unleashes New Threat on ESXi Environments: Analysis & Mitigation Strategies
3 - 5 min read
The Play ransomware group, well-known for its double-extortion tactics, recently unveiled a Linux variant targeting ESXi environments. This
Critical Linux Kernel Vulnerabilities Patched in Ubuntu Azure Systems
2 - 4 min read
Canonical has fixed several recently identified critical Linux kernel vulnerabilities in July 2024. These vulnerabilities primarily affect Microsoft
The Urgent Need for Secure Software Development: New Report Serves as a Wake-Up Call for the Industry
3 - 5 min read
The Linux Foundation and Open Source Security Foundation recently published a report entitled "Secure Software Development Education 2024
Severe Linux Kernel Privilege Escalation Bugs Could Compromise Entire Systems
2 - 4 min read
The Cybersecurity and Infrastructure Security Agency (CISA) recently added a new Linux kernel privilege escalation bug ( CVE-2024-1086 ) to its

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved