Found LUA-5.1.5 EOL in valkey-server binary

[lakarora3001]

We discovered LUA-5.1.5 embedded in valkey-server binary (8.1.6). We want to know the impact, mitigation plan and upgrade versions for the same. Please share your analysis.

[dvkashapov]

It is present in valkey for scripting purposes, what you can do is:

1. Use https://github.com/valkey-io/valkey-luajit (This requires Valkey 9.1, LuaJIT is a Just-In-Time Compiler for Lua with Lua 5.1 API and is supported currently)
2. Build Valkey from source with make BUILD_LUA=no parameters.
3. Restrict access by users to scripting with ACL SETUSER username -@scripting

Also note that Valkey 9.1 moves the Lua scripting engine into its own module, decoupling it from the core server. By extracting Lua into a module, Valkey reduces its security surface area and gives operators the option to disable Lua entirely if it is not required.

[zuiderkwast]

I can add that the vendored Lua 5.1 code contains modifications on top of the upstream Lua 5.1.5:

• Sandboxing by hiding some Lua features from the user-facing API.
• Backports of Lua fixes from later Lua versions.
• Mitigations for Redis CVEs and Valkey CVEs related affecting the Lua scripting code.

The reason we haven't lifted Lua to a more recent version such as 5.5 is that later versions contain non-backward compatible changes to the Lua language itself.

The mitigations mentioned by @dvkashapov are the recommended approaches for Valkey 9.1. Building without Lua excludes it from the binary.