CVE-2023-35853

2023-06-1904:15:11

Debian Security Bug Tracker

security-tracker.debian.org

suricata

lua

code execution

fix

security configuration

unix

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

54.9%

JSON

In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section.

OSVersionArchitecturePackageVersionFilename
Debian12allsuricata<= 1:6.0.10-1suricata_1:6.0.10-1_all.deb
Debian11allsuricata<= 1:6.0.1-3suricata_1:6.0.1-3_all.deb
Debian999allsuricata< 1:6.0.13-1suricata_1:6.0.13-1_all.deb
Debian13allsuricata< 1:6.0.13-1suricata_1:6.0.13-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	suricata	<= 1:6.0.10-1	suricata_1:6.0.10-1_all.deb
Debian	11	all	suricata	<= 1:6.0.1-3	suricata_1:6.0.1-3_all.deb
Debian	999	all	suricata	< 1:6.0.13-1	suricata_1:6.0.13-1_all.deb
Debian	13	all	suricata	< 1:6.0.13-1	suricata_1:6.0.13-1_all.deb