PT-2018-11258 · Linaro · Lava

Publicado 2018-06-19 · Atualizado 2019-09-18 · CVE-2018-12565

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linaro LAVA versions prior to 2018.5.post1

Description An issue allows remote code execution due to the use of yaml.load() instead of yaml.safe load() when parsing user data.

Recommendations For versions prior to 2018.5.post1, update to version 2018.5.post1 or later to resolve the issue. As a temporary workaround, consider restricting the use of user data parsing functionality until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-12565

DSA-4234-1

Produtos afetados

Lava

Referências · 12

• https://nvd.nist.gov/vuln/detail/CVE-2018-12565 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12565 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12564 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12565 · Aviso do Fabricante
• https://git.linaro.org/lava/lava.git/commit/?id=583666c84ea2f12797a3eb71392bcb05782f5b14 · Correção
• https://security-tracker.debian.org/tracker/DSA-4234-1 · Aviso do Fabricante
• https://debian.org/security/2018/dsa-4234 · Aviso do Fabricante
• https://packages.debian.org/src:lava-server · Nota
• https://osv.dev/vulnerability/CVE-2018-12565 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-12565 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/lava-server · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4234-1 · Aviso do Fabricante