Patchwire CVEs, their patch status, and feeds to follow them

CVE-2022-28805

Fixed in a distro release EPSS 3%

singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.

Published 2022-04-08 · CVE record · OSV

Products: lua, fedoraproject fedora

Distro releases

ReleasePackageFixed in
AlmaLinux 9lua5.4.4-3.el9
AlmaLinux 9lua-devel5.4.4-3.el9
AlmaLinux 9lua-libs5.4.4-3.el9
Alpine 3.14lua5.45.4.3-r1
Alpine 3.15lua5.45.4.3-r1
Alpine 3.16lua5.45.4.4-r4
Alpine 3.17lua5.45.4.4-r4
Alpine 3.18lua5.45.4.4-r4
Alpine 3.19lua5.45.4.4-r4
Alpine 3.20lua5.45.4.4-r4
Alpine 3.21lua5.45.4.4-r4
Alpine 3.22lua5.45.4.4-r4
Alpine 3.23lua5.45.4.4-r4
Alpine 3.24lua5.45.4.4-r4
Chainguardlua5.40
Debian 12lua5.45.4.4-2
Debian 13lua5.45.4.4-2
Debian 14lua5.45.4.4-2
Red Hat Enterprise Linux 9lua0:5.4.4-3.el9
Red Hat Enterprise Linux 9lua-debuginfo0:5.4.4-3.el9
Red Hat Enterprise Linux 9lua-debugsource0:5.4.4-3.el9
Red Hat Enterprise Linux 9lua-devel0:5.4.4-3.el9
Red Hat Enterprise Linux 9lua-libs0:5.4.4-3.el9
Red Hat Enterprise Linux 9lua-libs-debuginfo0:5.4.4-3.el9
Ubuntu Pro 22.04 LTSlua5.45.4.4-1ubuntu0.1~esm1
Wolfilua5.40