Critical
Security advisory
openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-9434
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:42 UTC · Revision 1
Source evidence
openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
osv:CVE-2020-9434
Complete source record
{
"id": "90351c3255bbf83830a3dd4c46cb715b932507c88eb81a0bc0c688d4c783282f",
"url": "https://osv.dev/vulnerability/CVE-2020-9434",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-9434",
"summary": "openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.",
"evidence": "osv:CVE-2020-9434",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2020-9434",
"aliases": [
"CVE-2020-9434"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/zhaozg/lua-openssl",
"type": "GIT",
"events": [
{
"introduced": "dcf4c8340e4e44d3e3c3e404ddec87a42c61ce71"
},
{
"last_affected": "dcf4c8340e4e44d3e3c3e404ddec87a42c61ce71"
},
{
"fixed": "a6dc186dd4b6b9e329a93cca3e7e3cfccfdf3cca"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:lua-openssl_project:lua-openssl:0.7.7-1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.7.7-1"
},
{
"last_affected": "0.7.7-1"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "a6dc186dd4b6b9e329a93cca3e7e3cfccfdf3cca"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"0.7.7-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9434.json",
"vanir_signatures": [
{
"id": "CVE-2020-9434-4cd06e71",
"digest": {
"threshold": 0.9,
"line_hashes": [
"22836928595141529191685066850239619692",
"106986599387145525724451224660792847728",
"74519493262181466487554845384721794197",
"280888697867625331802704877235200227850",
"154054483220335846088511579446771486198",
"267533254134363377221949607979454604173",
"204981990212129680332363758085545307157",
"98992530393241901116686313086310177480",
"199227878408358081214466100192279965724",
"263702157484803571036870144748488251008",
"114318720954917247870547837822146629124",
"158357684900794345507666529047056020078",
"286866290659580155390661045384064128722",
"62721994530567100456368683266321619178",
"338618646758722476582036498879945359214",
"21619890300510651674773521607288503115",
"8212954358513412705418709013267405046",
"280942455060433503104360855483769610810",
"154054483220335846088511579446771486198",
"140483780634121643654969306893870401393",
"250075708853721252695872960273065033465",
"42884903506212574266368785134170189183",
"163396166393160608506044128422848113751",
"191927627488366321391462267361978969928",
"114318720954917247870547837822146629124",
"158357684900794345507666529047056020078",
"286866290659580155390661045384064128722",
"62721994530567100456368683266321619178",
"19681102626805246663346430582904307565",
"204769768318649298398039653033569721668",
"170577991034165706602269700991028725584",
"173127064005335983533428555194088315219",
"154054483220335846088511579446771486198",
"131858774167645964644283333562486905539",
"123651588734344222801094137325714376389",
"217740108185072063595681728183804721025",
"66871048032382998330533506938251219862",
"16007539079517029650398958902187359152",
"114318720954917247870547837822146629124",
"158357684900794345507666529047056020078",
"286866290659580155390661045384064128722",
"62721994530567100456368683266321619178",
"239742531813508266450201264989882792971",
"333821922633842582382169847452655361403",
"205597527275293017208162709560329350674",
"125826910505508727062612260713313689546",
"92283327004125836655248403816180716048",
"88926759931379200059650330603768468238",
"305696137179422424732345674295111661694",
"273356457451933493806803886546582776432",
"806049896540884234618375034756838632",
"232002524926097764894727784569915899436",
"77000589996979842036546471927252202210"
]
},
"source": "https://github.com/zhaozg/lua-openssl/commit/a6dc186dd4b6b9e329a93cca3e7e3cfccfdf3cca",
"target": {
"file": "src/x509.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-9434-69676495",
"digest": {
"length": 236,
"function_hash": "210547734265287479549050857811642547746"
},
"source": "https://github.com/zhaozg/lua-openssl/commit/a6dc186dd4b6b9e329a93cca3e7e3cfccfdf3cca",
"target": {
"file": "src/x509.c",
"function": "LUA_FUNCTION"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-9434-7fad6c9f",
"digest": {
"length": 650,
"function_hash": "259637873822822212959615126157613673457"
},
"source": "https://github.com/zhaozg/lua-openssl/commit/a6dc186dd4b6b9e329a93cca3e7e3cfccfdf3cca",
"target": {
"file": "src/x509.c",
"function": "luaopen_x509"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-9434-93b7a8a3",
"digest": {
"length": 255,
"function_hash": "252935993758650179501788748738468892715"
},
"source": "https://github.com/zhaozg/lua-openssl/commit/a6dc186dd4b6b9e329a93cca3e7e3cfccfdf3cca",
"target": {
"file": "src/x509.c",
"function": "LUA_FUNCTION"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-9434-b3ef22ba",
"digest": {
"length": 262,
"function_hash": "44989120962245007864346131133540376789"
},
"source": "https://github.com/zhaozg/lua-openssl/commit/a6dc186dd4b6b9e329a93cca3e7e3cfccfdf3cca",
"target": {
"file": "src/x509.c",
"function": "LUA_FUNCTION"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:15:09Z"
}
}
],
"modified": "2026-10-20T14:15:09.948990319Z",
"provider": "osv",
"references": [
"https://github.com/zhaozg/lua-openssl/commit/a6dc186dd4b6b9e329a93cca3e7e3cfccfdf3cca"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-9434",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388770,
"published_at": "2020-02-27T23:15:13.233+00:00"
}