PT-2024-25020 · Pluto · Pluto

Sainan · Published 2024-05-01 · Updated 2024-05-01 · CVE-2024-32973

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pluto versions prior to 0.9.3

Description The issue affects Pluto, a superset of Lua 5.4, allowing an attacker who can intercept network traffic to use a specifically-crafted certificate to fool Pluto into trusting it as the intended remote for the TLS session. This results in the HTTP library and socket.starttls providing less transport integrity than expected.

Recommendations For versions prior to 0.9.3, upgrade to version 0.9.3 to resolve the issue. As a temporary workaround, consider restricting the use of the HTTP library and socket.starttls until the upgrade is applied.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-32973

GHSA-84HJ-7J2V-W665

Affected Products

Pluto

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32973.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-32973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32973 · Security Note
• https://github.com/PlutoLang/Pluto/pull/851 · Note
• https://github.com/PlutoLang/Pluto/security/advisories/GHSA-84hj-7j2v-w665 · Note
• https://twitter.com/linuxpatch/status/1785641725790126258 · Twitter Post
• https://t.me/cvenotify/78672 · Telegram Post
• https://twitter.com/CVEnew/status/1785647582922133906 · Twitter Post