In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section. https://www.stamus-networks.com/stamus-labs https://github.com/OISF/suricata/compare/suricata-6.0.12...suricata-6.0.13 https://github.com/OISF/suricata/commit/b95bbcc66db526ffcc880eb439dbe8abc87a81da
Created suricata tracking bugs for this issue: Affects: epel-all [bug 2218783] Affects: fedora-all [bug 2218782]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.