CVE-2018-12565: Input Validation

Q: What is CVE-2018-12565?

CVE-2018-12565 is a vulnerability in Linaro LAVA before 2018.5.post1 that allows remote code execution due to the use of yaml.load() instead of yaml.safe_load() when parsing user data.

Q: What is the severity of CVE-2018-12565?

CVE-2018-12565 has a severity rating of 8.8 (High).

Q: Which software is affected by CVE-2018-12565?

CVE-2018-12565 affects Linaro LAVA versions up to 2018.4, Debian Debian Linux 9.0, and Debian package 'lava' versions 2019.01-5, 2019.01-5+deb10u2, 2020.12-5+deb11u2, and 2023.01-2.

Q: How can I fix CVE-2018-12565?

To fix CVE-2018-12565, update your Linaro LAVA installation to version 2018.5.post1 or later, upgrade Debian Debian Linux to a version later than 9.0, or update the 'lava' package on Debian to a version later than the ones mentioned in the vulnerability details.

Q: What is the Common Weakness Enumeration (CWE) ID for CVE-2018-12565?

The Common Weakness Enumeration (CWE) ID for CVE-2018-12565 is CWE-20.

Published Jun 19, 2018

Updated

An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load() instead of yaml.safeload() when parsing user data, remote code execution can occur.

Affected Software

3 affected componentsFixes available

debian/lava

2019.01-52019.01-5+deb10u22020.12-5+deb11u22023.01-2

Linaro LAVA<=2018.4

Debian Debian Linux=9.0

Remediation

Patch Available

https://git.linaro.org/lava/lava.git/commit/?id=583666c84ea2f12797a3eb71392bcb05782f5b14

Event History

Jun 19, 2018

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is CVE-2018-12565?

CVE-2018-12565 is a vulnerability in Linaro LAVA before 2018.5.post1 that allows remote code execution due to the use of yaml.load() instead of yaml.safe_load() when parsing user data.

What is the severity of CVE-2018-12565?

CVE-2018-12565 has a severity rating of 8.8 (High).

Which software is affected by CVE-2018-12565?