lua-cjson icon indicating copy to clipboard operation
lua-cjson copied to clipboard

[CVE]A heap overflow in the lua-cjson library

Open NagamineLee opened this issue 1 year ago • 1 comments

CVE has revealed a a critical vulnerability about Redis,but details of the vulnerability are more related to cjson. By reviewing the Redis source code, the cjson library used in Redis is also derived from the Lua CJSON official. So, the problem may also happen in OpenResty.

A heap overflow in the lua-cjson library Severity: high CVE-2022-24834

NagamineLee avatar Jul 18 '23 08:07 NagamineLee

Ported the code from redis: https://github.com/openresty/lua-cjson/pull/94

zhuizhuhaomeng avatar Jul 18 '23 08:07 zhuizhuhaomeng