Linaro Lava
6 CVEs affecting Linaro Lava. Latest disclosed: 2022-11-18. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45132 | Critical | 9.8 | 2022-11-18 | In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API… |
CVE-2022-42902 | High | 8.8 | 2022-10-13 | In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitizat… |
CVE-2018-12565 | High | 8.8 | 2018-06-19 | An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load() instead of yaml.safe_load() when parsing user data, remote code execu… |
CVE-2022-44641 | Medium | 6.5 | 2022-11-18 | In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML e… |
CVE-2018-12564 | Medium | 6.5 | 2018-06-19 | An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can forge an HTTP request that will force la… |
CVE-2018-12563 | Medium | 6.5 | 2018-06-19 | An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to download any file from… |