CVE-2022-42902: In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input…

PriorityP352high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.26%

65.9th percentile

In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	debian_linux	—	—
debian	lava	< lava 2022.10-1 (bookworm)	lava 2022.10-1 (bookworm)
linaro	lava	< 2022.10	2022.10
linaro	lava	>= 0 < 2020.12-5+deb11u1	2020.12-5+deb11u1
linaro	lava	>= 0 < 2022.10-1	2022.10-1
linaro	lava	>= 0 < 2022.10-1	2022.10-1

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

osv8.8HIGH

vendor_debian8.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.