Approved changes feed: RSS · Atom
cpe:2.3:a:linaro:lava:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Linaro (99deaf1e-8c2f-5241-8d83-0392c3e1263e) |
|---|---|
| Product | Lava (0b2e3ce8-34f4-5571-ac8c-cbf98bfd918b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/lava |
purl2cpe | 2026-06-01 10:17:18.318710 |
pkg:deb/ubuntu/lava |
purl2cpe | 2026-06-01 10:17:18.318713 |
pkg:github/linaro/lava |
purl2cpe | 2026-06-01 10:17:18.318716 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-45132 |
vulnerable | 2026-06-08 05:50:35.695312 |
Details available
In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.
Published: 2022-11-18T00:00:00.000Z
Updated: 2025-04-30T14:36:37.228Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-44641 |
vulnerable | 2026-06-08 05:49:35.943218 |
Details available
In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service.
Published: 2022-11-18T00:00:00.000Z
Updated: 2025-04-29T19:02:39.780Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-42902 |
vulnerable | 2026-06-08 05:49:30.681159 |
Details available
In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server.
Published: 2022-10-13T00:00:00.000Z
Updated: 2025-05-15T16:20:39.096Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-12565 |
vulnerable | 2026-06-08 05:10:41.763983 |
Details available
An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load() instead of yaml.safe_load() when parsing user data, remote code execution can occur.
Published: 2018-06-19T05:00:00.000Z
Updated: 2024-08-05T08:38:06.307Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-12564 |
vulnerable | 2026-06-08 05:10:41.763607 |
Details available
An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can forge an HTTP request that will force lava-server-gunicorn to return any file on the server that is readable by lavaserver and valid yaml.
Published: 2018-06-19T05:00:00.000Z
Updated: 2024-08-05T08:38:06.314Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-12563 |
vulnerable | 2026-06-08 05:10:41.763129 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.