CVE-2022-42902

概要

参考情報

• git.lavasoftware.org/lava/lava/-/commit/e66b74cd6c175ff8826b8f3431740963be228b52 · Patch
• git.lavasoftware.org/lava/lava/-/merge_requests/1834 · Issue Tracking
• lists.debian.org/debian-lts-announce/2022/11/msg00019.html · Mailing List
• debian.org/security/2022/dsa-5260 · Third Party Advisory

lava のその他の脆弱性

• CVE-2022-45132緊急 9.8In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 tem…
• CVE-2022-44641中 6.5In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that caus…
• CVE-2018-12565高 8.8An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load() instead of yaml.safe_load() when parsing user data…
• CVE-2018-12564中 6.5An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can forge an HTTP request…
• CVE-2018-12563中 6.5An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to down…