Reply To cazfi
Need to check if lua-5.3 (-> S3_0) is affected.
At least code there is identical, and no advisory gives lower bound for affected versions.
Going to apply to S2_6 too.
This got me to draft an clarification to our commit rules concerning vulnerability fixes. http://www.freeciv.org/wiki/Commit_rules
Esp. Maintainers should check it, and comment if there's anything more to correct it.
alienvalkyrie Reply To cazfi
This got me to draft an clarification to our commit rules concerning vulnerability fixes. http://www.freeciv.org/wiki/Commit_rules Esp. Maintainers should check it, and comment if there's anything more to correct it.
Looks sensible to me.
alienvalkyrie
CVE-2022-28805 affects our included lua, at least in branches using lua-5.4. Need to check if lua-5.3 (-> S3_0) is affected. Upstream fix is in https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa