PatchTheCVElua-openssl project vulnerabilities
Recent CVEs affecting lua-openssl project products. 3 tracked.
lua-openssl project has 3 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 0. Most recent: 2020-02-27. Highest priority: CVE-2020-9434 (score 56/100).
- CVE-2020-9434 CRITICAL 9.1 DOWNGRADE openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_p
- CVE-2020-9433 CRITICAL 9.1 DOWNGRADE openssl_x509_check_email in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pu
- CVE-2020-9432 CRITICAL 9.1 DOWNGRADE openssl_x509_check_host in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pus
FAQ
How do I fix lua-openssl project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is lua-openssl project being exploited right now?
None of the tracked lua-openssl project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which lua-openssl project CVE should I patch first?
CVE-2020-9434 currently ranks highest (56/100): openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_p.