PT-2018-11258 · Linaro · Lava

Published 2018-06-19 · Updated 2019-09-18 · CVE-2018-12565

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linaro LAVA versions prior to 2018.5.post1

Description An issue allows remote code execution due to the use of yaml.load() instead of yaml.safe load() when parsing user data.

Recommendations For versions prior to 2018.5.post1, update to version 2018.5.post1 or later to resolve the issue. As a temporary workaround, consider restricting the use of user data parsing functionality until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-12565

DSA-4234-1

Affected Products

Lava

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2018-12565 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12565 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12564 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12565 · Vendor Advisory
• https://git.linaro.org/lava/lava.git/commit/?id=583666c84ea2f12797a3eb71392bcb05782f5b14 · Patch
• https://security-tracker.debian.org/tracker/DSA-4234-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4234 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12565 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-12565 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/lava-server · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4234-1 · Vendor Advisory
• https://packages.debian.org/src:lava-server · Note