// For flags

CVE-2024-32973

Remote for TLS session may be trusted despite constraints in Pluto lang

Severity Score

4.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. In affected versions an attacker with the ability to actively intercept network traffic would be able to use a specifically-crafted certificate to fool Pluto into trusting it to be the intended remote for the TLS session. This results in the HTTP library and socket.starttls providing less transport integrity than expected. This issue has been patched in pull request #851 which has been included in version 0.9.3. Users are advised to upgrade. there are no known workarounds for this vulnerability.

Pluto es un superconjunto de Lua 5.4 centrado en la programación de propósito general. En las versiones afectadas, un atacante con la capacidad de interceptar activamente el tráfico de red podría utilizar un certificado manipulado específicamente para engañar a Pluto y hacerle confiar en que es el control remoto previsto para la sesión TLS. Esto da como resultado que la librería HTTP y socket.starttls proporcionen menos integridad de transporte de lo esperado. Este problema se solucionó en la solicitud de extracción n.° 851, que se incluyó en la versión 0.9.3. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad.

*Credits: N/A
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-04-22 CVE Reserved
  • 2024-05-01 CVE Published
  • 2024-05-02 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-284: Improper Access Control
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
PlutoLang
Search vendor "PlutoLang"
 Pluto
Search vendor "PlutoLang" for product "Pluto"
 >= 0.9.0 < 0.9.3
Search vendor "PlutoLang" for product "Pluto" and version " >= 0.9.0 < 0.9.3"
en
Affected