In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section.

An update of the suricata package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to     execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security     lua configuration section. (CVE-2023-35853)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In Suricata before 6.0.13 (when there is an adversary who controls an external source of rules), a dataset
    filename, that comes from a rule, may trigger absolute or relative directory traversal, and lead to write
    access to a local filesystem. This is addressed in 6.0.13 by requiring allow-absolute-filenames and allow-
    write (in the datasets rules configuration section) if an installation requires traversal/writing in this
    situation. (CVE-2023-35852)

  - In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to
    execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security
    lua configuration section. (CVE-2023-35853)

ID	Name	Product	Family	Type	Severity
332356	Photon OS 5.0: Suricata PHSA-2023-5.0-91-0091	Nessus	PhotonOS Local Security Checks	Local	critical
226425	Linux Distros Unpatched Vulnerability : CVE-2023-35853	Nessus	Misc.	Local	critical
204516	Photon OS 4.0: Suricata PHSA-2023-4.0-0468	Nessus	PhotonOS Local Security Checks	Local	critical
203628	Photon OS 5.0: Suricata PHSA-2023-5.0-0091	Nessus	PhotonOS Local Security Checks	Local	critical
407293	Alpine: multiple suricata packages: security update to 6.0.15-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
407293	Alpine: multiple suricata packages: security update to 6.0.15-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical

Detections

Analytics

CVE-2023-35853

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical