CVE-2022-42902

moderate-risk
Published 2022-10-13

In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server.

Do I need to act?

~
1.9% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (3)

Lava

Affected Vendors

Debian Linaro

References (8)

Patch https://git.lavasoftware.org/lava/lava/-/commit/e66b74cd6c175ff8826b8f3431740963...
Issue Tracking https://git.lavasoftware.org/lava/lava/-/merge_requests/1834
Mailing List https://lists.debian.org/debian-lts-announce/2022/11/msg00019.html
Third Party Advisory https://www.debian.org/security/2022/dsa-5260
Patch https://git.lavasoftware.org/lava/lava/-/commit/e66b74cd6c175ff8826b8f3431740963...
Issue Tracking https://git.lavasoftware.org/lava/lava/-/merge_requests/1834
Mailing List https://lists.debian.org/debian-lts-announce/2022/11/msg00019.html
Third Party Advisory https://www.debian.org/security/2022/dsa-5260
44
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 5/34 · Minimal
Exposure 9/34 · Low