CVE-2022-28805
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-28805
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-28805.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-28805
- Aliases
- Downstream
- Related
- Published
- 2022-04-08T06:15:07Z
- Modified
- 2025-10-13T12:02:44.258644Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
- References
-
- https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHYZOEFDVLVAD6EEP4CDW6DNONIVVHPA/
- https://lua-users.org/lists/lua-l/2022-02/msg00001.html
- https://lua-users.org/lists/lua-l/2022-02/msg00070.html
- https://lua-users.org/lists/lua-l/2022-04/msg00009.html
- https://security.gentoo.org/glsa/202305-23
Affected packages
Git / github.com/lua/lua
Affected ranges
- Type
- GIT
- Repo
- https://github.com/lua/lua
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
v1.*
v1.2
v2.*
v2.1
v2.2
v2.3-beta
v2.4
v2.4-beta
v2.5
v2.5-beta
v2.5.1
v3.*
v3.0
v3.0-alpha
v3.1
v3.1-alpha
v3.2
v3.2-beta
v4.*
v4.0
v4.0-alpha
v4.0-beta
v4.1-alpha
v5.*
v5.0
v5.0-alpha
v5.0-beta
v5.1
v5.1-alpha
v5.1-beta
v5.1.1
v5.2-alpha
v5.2-beta
v5.2.0
v5.2.1
v5.2.2
v5.3-alpha
v5.3-beta
v5.3.0
v5.3.1
v5.3.2
v5.3.3
v5.3.4
v5.4-alpha
v5.4-beta
v5.4-w2
v5.4.0
v5.4.1
v5.4.2
v5.4.3
v5.4.4
Database specific
{
"vanir_signatures": [
{
"signature_version": "v1",
"source": "https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa",
"deprecated": false,
"id": "CVE-2022-28805-6dde851f",
"signature_type": "Function",
"digest": {
"length": 347.0,
"function_hash": "53201180014080356134198209586064207783"
},
"target": {
"file": "lparser.c",
"function": "singlevar"
}
},
{
"signature_version": "v1",
"source": "https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa",
"deprecated": false,
"id": "CVE-2022-28805-a5c78703",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32201794497045802336489965260675966661",
"222355253276990523824162340041015369710",
"28722556712081149350779902624787499513",
"154526588328123496999063531195759804808"
]
},
"target": {
"file": "lparser.c"
}
}
]
}