Linaro LAVA 2016.11

CPE Details

Linaro LAVA 2016.11
linaro
lava
2016.11
2019-09-18
15h00 +00:00
2019-09-18
15h00 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:linaro:lava:2016.11:-:*:*:*:*:*:*

Informations

Vendor

linaro

Product

lava

Version

2016.11

Update

-

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2022-44641 2022-11-17 23h00 +00:00 In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service.
6.5
Medium
CVE-2022-45132 2022-11-17 23h00 +00:00 In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.
9.8
Critical
CVE-2022-42902 2022-10-12 22h00 +00:00 In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server.
8.8
High
CVE-2018-12563 2018-06-19 03h00 +00:00 An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to download any file from the filesystem if it's readable by lavaserver and valid yaml.
6.5
Medium
CVE-2018-12564 2018-06-19 03h00 +00:00 An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can forge an HTTP request that will force lava-server-gunicorn to return any file on the server that is readable by lavaserver and valid yaml.
6.5
Medium
CVE-2018-12565 2018-06-19 03h00 +00:00 An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load() instead of yaml.safe_load() when parsing user data, remote code execution can occur.
8.8
High