Lava vulnerabilities

2 known vulnerabilities in Lava from Linaro. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Lava: Improper Control of Generation of Code

  CVE-2022-45132Nov 18, 2022LinaroEPSS 2.09%

  In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template i

• 8.8 High severity

  Lava: Improper Control of Generation of Code

  CVE-2022-42902Oct 13, 2022LinaroEPSS 1.68%

  In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on th