CVE-2024-32973

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-32973

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32973.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-32973

Aliases

GHSA-84hj-7j2v-w665

Published

2024-05-01T10:42:57.620Z

Modified

2026-04-02T10:52:17.099552Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Remote for TLS session may be trusted despite constraints in Pluto lang

Details

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. In affected versions an attacker with the ability to actively intercept network traffic would be able to use a specifically-crafted certificate to fool Pluto into trusting it to be the intended remote for the TLS session. This results in the HTTP library and socket.starttls providing less transport integrity than expected. This issue has been patched in pull request #851 which has been included in version 0.9.3. Users are advised to upgrade. there are no known workarounds for this vulnerability.

Database specific

{
    "cwe_ids": [
        "CWE-284"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32973.json"
}

References

Affected packages

Git / github.com/plutolang/pluto

Affected ranges

Type

GIT

Repo

https://github.com/plutolang/pluto

Events

Introduced

f6f04569647a62a629b322bea0feb3cf3923661e

Fixed

4ef6572d40dec69f902559adb04af5374c6f5af3

Database specific

{
    "versions": [
        {
            "introduced": "0.9.0"
        },
        {
            "fixed": "0.9.3"
        }
    ]
}

Affected versions

0.*

0.9.0

0.9.1

0.9.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32973.json"