CVE-2024-32973

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. In affected versions an attacker with the ability to actively intercept network traffic would be able to use a specifically-crafted certificate to fool Pluto into trusting it to be the intended remote for the TLS session. This results in the HTTP library and socket.starttls providing less transport integrity than expected. This issue has been patched in pull request #851 which has been included in version 0.9.3. Users are advised to upgrade. there are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: May 1, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-329747.5Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` wit CVE-2024-329757.5Envoy is a cloud-native, open source edge and service proxy. There is a crash at `QuicheDataReader::PeekVarInt62Length()`. It is caused by i CVE-2024-329767.5Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompressi CVE-2024-329779.4OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerab CVE-2024-329786.6Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecure file permissions CVE-2024-329796.1Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a Pos CVE-2024-32987.8Out-Of-Bounds Write and Type Confusion vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through CVE-2024-329809.1Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically config CVE-2024-329815.4Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit CVE-2024-329828.2Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion CVE-2024-329837.5Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of inco CVE-2024-329847.5Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. The Rust implementation of the Yamux stream multiplexer use