Debian Lava vulnerabilities

CVE-2022-45132 [CRITICAL] CVE-2022-45132: lava - In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code... In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server. Scope: local bookworm: resolv

CVE-2022-42902 [HIGH] CVE-2022-42902: lava - In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dyna... In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server. Scope: local bookworm: resolved (fixed in 2022.10-1) bullseye: resolved (fixed in 2020.12-5+deb11u1)

CVE-2022-44641 [MEDIUM] CVE-2022-44641: lava - In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with va... In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service. Scope: local bookworm: resolved (fixed in 2023.01-1) bullseye: resolved (fixed in 2020.12-5+deb11u2) forky: resolved (f

CVE-2018-12565 [HIGH] CVE-2018-12565: lava - An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of ya... An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load() instead of yaml.safe_load() when parsing user data, remote code execution can occur. Scope: local bookworm: resolved (fixed in 2018.5.post1-1) bullseye: resolved (fixed in 2018.5.post1-1) forky: resolved (fixed in 2018.5.post1-1) sid: resolved (fixed in 2018.5.post1-1)

CVE-2018-12564 [MEDIUM] CVE-2018-12564: lava - An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support f... An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can forge an HTTP request that will force lava-server-gunicorn to return any file on the server that is readable by lavaserver and valid yaml. Scope: local bookworm: resolved (fixed in 2018.5.post1-1) bullseye: resolved (fixed in 2018.5.post1-1) forky: r

CVE-2018-12563 [MEDIUM] CVE-2018-12563: lava - An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support f... An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to download any file from the filesystem if it's readable by lavaserver and valid yaml. Scope: local bookworm: resolved (fixed in 2018.5.post1-1) bullseye: resolved (fixed in 2018.5.post1-1) forky: resolved (fixed in 2018.5.post1-1) sid