[Pkg-linaro-lava-devel] Bug#1021737: lava: CVE-2022-42902

Moritz Mühlenhoff jmm at inutil.org
Thu Oct 13 20:13:18 BST 2022

Source: lava
X-Debbugs-CC: team at security.debian.org
Severity: grave
Tags: security


The following vulnerability was published for lava.

| In Linaro Automated Validation Architecture (LAVA) before 2022.10,
| there is dynamic code execution in lava_server/lavatable.py. Due to
| improper input sanitization, an anonymous user can force the lava-
| server-gunicorn service to execute user-provided code on the server.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-42902

Please adjust the affected versions in the BTS as needed.

More information about the Pkg-linaro-lava-devel mailing list