CVE-2023-35853

In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section.

Affected products

Alt Linux, Debian, Suricata

Oisf Suricata

< 6.0.13

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

1.0% (60th percentile)

Weakness

CWE-94

NVD status

Modified

Published

2023-06-19

No exploit for CVE-2023-35853 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.