CVE-2023-35853

Name
CVE-2023-35853
Description
In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section.
NVD Severity
high
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://www.stamus-networks.com/stamus-labs
MISC https://github.com/OISF/suricata/compare/suricata-6.0.12...suricata-6.0.13
MISC https://github.com/OISF/suricata/commit/b95bbcc66db526ffcc880eb439dbe8abc87a81da

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:* suricata >= None < 6.0.13

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
suricata 3.18-community 6.0.12-r0 Steve McMaster <code@mcmaster.io> possibly vulnerable