A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out of bounds access bug that could have allowed an attacker to launch a DoS if the function was used to parse untrusted input data. It is important to note that because this debug function was only used in tests and demos, it was not exploitable in a normal environment.
References
| Link | Resource |
|---|---|
| https://github.com/cloudflare/lua-resty-json/pull/14 | Patch |
| https://github.com/cloudflare/lua-resty-json/security/advisories/GHSA-h8rp-9622-83pg | Patch Third Party Advisory |
| https://github.com/cloudflare/lua-resty-json/pull/14 | Patch |
| https://github.com/cloudflare/lua-resty-json/security/advisories/GHSA-h8rp-9622-83pg | Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 3.7 |
| References | () https://github.com/cloudflare/lua-resty-json/pull/14 - Patch | |
| References | () https://github.com/cloudflare/lua-resty-json/security/advisories/GHSA-h8rp-9622-83pg - Patch, Third Party Advisory |
28 Jun 2023, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Cloudflare
Cloudflare lua-resty-json |
|
| CWE | CWE-125 | |
| References | (MISC) https://github.com/cloudflare/lua-resty-json/pull/14 - Patch | |
| References | (MISC) https://github.com/cloudflare/lua-resty-json/security/advisories/GHSA-h8rp-9622-83pg - Patch, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:cloudflare:lua-resty-json:*:*:*:*:*:*:*:* |
14 Jun 2023, 12:54
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-14 12:15
Updated : 2024-11-21 08:16
NVD link : CVE-2023-3040
Mitre link : CVE-2023-3040
CVE.ORG link : CVE-2023-3040
JSON object : View
Products Affected
cloudflare
- lua-resty-json
CWE
CWE-125
Out-of-bounds Read