CVE-2020-15889

Description

Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.

How to fix CVE-2020-15889

To remediate CVE-2020-15889, upgrade the affected package to a fixed version below.

• Bitnami/lua—upgrade to 5.4.1 or later
• Debian/lua5.4—upgrade to 5.4.0-2 or later

Is CVE-2020-15889 being exploited?

Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• >= 5.4.0, < 5.4.1
• from 0, < 5.4.0-2

CVSS scores

References (5)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2020-15889
• WEBlua-users.org/lists/lua-l/2020-07/msg00078.html
• WEBlua-users.org/lists/lua-l/2020-12/msg00157.html
• WEBgithub.com/lua/lua/commit/127e7a6c8942b362aa3c6627f44d660a4fb75312