CriticalFix available
suricata — security advisory
In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section.
- Products
- suricata
- Affected versions
- Not specified
- Fixed versions
- 1:6.0.13-1
- CVEs
- CVE-2023-35853
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 16:23 UTC · Revision 1
Source evidence
In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section.
osv:DEBIAN-CVE-2023-35853
suricata
Fixed versions: 1:6.0.13-1
suricata
Fixed versions: 1:6.0.13-1
Complete source record
{
"id": "8506665c77f9bb58bcaa2b93b12817ccedded1ce99d05dbb8694c8a01406df3e",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2023-35853",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2023-35853",
"summary": "In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section.",
"evidence": "osv:DEBIAN-CVE-2023-35853",
"products": [
{
"name": {
"value": "suricata",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:6.0.13-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "suricata",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:6.0.13-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2023-35853",
"aliases": [
"DEBIAN-CVE-2023-35853"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:6.0.13-1"
}
]
}
],
"package": {
"name": "suricata",
"purl": "pkg:deb/debian/suricata?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-35853.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:6.0.13-1"
}
]
}
],
"package": {
"name": "suricata",
"purl": "pkg:deb/debian/suricata?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-35853.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T18:03:05.272518521Z",
"provider": "osv",
"upstream": [
"CVE-2023-35853"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2023-35853"
]
},
"related_cves": [
{
"value": "CVE-2023-35853",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 457574,
"published_at": "2023-06-19T04:15:11.287+00:00"
}