CVE-2018-12564: Input Validation
An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can forge an HTTP request that will force lava-server-gunicorn to return any file on the server that is readable by lavaserver and valid yaml.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-12564?
CVE-2018-12564 is a vulnerability in Linaro LAVA before 2018.5.post1 that allows a user to forge an HTTP request to force the server to return any readable file.
How does CVE-2018-12564 affect Linaro LAVA?
CVE-2018-12564 affects Linaro LAVA versions before 2018.5.post1.
What is the severity of CVE-2018-12564?
CVE-2018-12564 has a severity rating of 6.5 (medium).
How can I fix CVE-2018-12564?
To fix CVE-2018-12564, update to the following versions: 2019.01-5, 2019.01-5+deb10u2, 2020.12-5+deb11u2, or 2023.01-2.
Where can I find more information about CVE-2018-12564?
You can find more information about CVE-2018-12564 at the following references: [1](https://git.linaro.org/lava/lava.git/commit/?id=95a9a77b144ced24d7425d6544ab03ca7f6c75d3), [2](https://lists.debian.org/debian-lts-announce/2018/06/msg00011.html), [3](https://www.debian.org/security/2018/dsa-4234).