Bug 13979

Summary: [CVE 21] lua 5.3.5 CVEs CVE-2019-6706 EXPLOIT https://www.exploit-db.com/download/46246 found
Product: [ROSA-based products] ROSA Fresh Reporter: Yury <y.tumanov>
Component: System (kernel, glibc, systemd, bash, PAM...)Assignee: ROSA Linux Bugs <bugs>
Status: VERIFIED FIXED QA Contact: ROSA Linux Bugs <bugs>
Severity: blocker    
Priority: Highest CC: a.proklov, pastordidi, s.matveev, v.potapov, y.tumanov
Version: AllFlags: v.potapov: qa_verified+
y.tumanov: secteam_verified+
a.proklov: published+
Target Milestone: 2021.1 Fresh R12   
Hardware: All   
OS: Linux   
URL: CVE-2019-6706 https://www.exploit-db.com/download/46246
Whiteboard:
Platform: 2021.1 ROSA Vulnerability identifier:
RPM Package: ISO-related:
Bad POT generating: Upstream:

Description Yury 2023-10-20 15:36:57 MSK
[CVE 21] lua 5.3.5 CVEs CVE-2019-6706 EXPLOIT https://www.exploit-db.com/download/46246 found 

lua	5.3.5	CVE-2019-6706	Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.	7,5	HIGH	5	MEDIUM	CWE-416			Не найден	https://nvd.nist.gov/vuln/detail/CVE-2019-6706	https://www.exploit-db.com/download/46246
Comment 1 Vladimir Potapov 2023-10-20 17:24:38 MSK
*** Bug 13896 has been marked as a duplicate of this bug. ***
Comment 2 Vladimir Potapov 2023-10-20 17:24:51 MSK
*** Bug 13764 has been marked as a duplicate of this bug. ***
Comment 3 Svyatoslav Matveev 2023-10-21 11:32:30 MSK
********** QA ADVISORY **********

Исправлено наложением патча.

*** lua
**  5.3.5 release +1

https://abf.io/build_lists/4759590
https://abf.io/build_lists/4759589
https://abf.io/build_lists/4759591
https://abf.io/build_lists/4759593
https://abf.io/build_lists/4759592
Comment 4 Dmitry Postnikov 2023-10-22 21:37:34 MSK
******************************
Обновление отослано в Тестинг
Comment 5 Vladimir Potapov 2023-10-24 13:01:00 MSK
lua-5.3.5-7
https://abf.io/build_lists/4759590
https://abf.io/build_lists/4759589
https://abf.io/build_lists/4759591
https://abf.io/build_lists/4759593
https://abf.io/build_lists/4759592
**************************** Advisory *****************************
Critical CVE are fixed
*******************************************************************
QA Verified
Comment 6 Yury 2023-10-27 20:19:22 MSK
secteam_verified