CVE-2022-28805

    Dashboard / Vulnerabilities / CVE-2022-28805

    CVE-2022-28805

    Published: 8 Apr 2022Last Modified: 12 Aug 2026

    Summary:

    Details: singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.

    References: https://lua-users.org/lists/lua-l/2022-02/msg00001.html, https://lua-users.org/lists/lua-l/2022-02/msg00070.html, https://lua-users.org/lists/lua-l/2022-04/msg00009.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28805.json, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHYZOEFDVLVAD6EEP4CDW6DNONIVVHPA/, https://nvd.nist.gov/vuln/detail/CVE-2022-28805, https://security.gentoo.org/glsa/202305-23, https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- c33b1728aeb7dfeec4013562660e07d32697aa6b
    Fixed -e15f1f2bb7a38a3c94519294d031e48508d65006

    Affected versions

    v5.4.4
    v5.4.3
    v5.4.2
    v5.4.1
    v5.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-28805 | CVE-DB