Log in Start free

Vulnerability · Published May 1, 2024 · Assigned by GitHub_M

CVE-2024-32973Remote for TLS session may be trusted despite constraints in Pluto lang

Medium 4.8

In plain English

A medium-severity improper access control in Pluto from PlutoLang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.1%top 97.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. In affected versions an attacker with the ability to actively intercept network traffic would be able to use a specifically-crafted certificate to fool Pluto into trusting it to be the intended remote for the TLS session. This results in the HTTP library and socket.starttls providing less transport integrity than expected. This issue has been patched in pull request #851 which has been included in version 0.9.3. Users are advised to upgrade. there are no known workarounds for this vulnerability.

Affected products (as reported)

VendorProductVersions
PlutoLang Pluto >= 0.9.0, < 0.9.3

Weakness: CWE-284 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

References