CVE-2018-12565
HIGHLinaro LAVA < 2018.5.post1 - Remote Code Execution via YAML Deserialization
Title source: llmDescription
An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load() instead of yaml.safe_load() when parsing user data, remote code execution can occur.
References (2)
Core 2
Core References
Third Party Advisory vendor-advisory
x_refsource_debian
https://www.debian.org/security/2018/dsa-4234
Patch, Third Party Advisory x_refsource_confirm
https://git.linaro.org/lava/lava.git/commit/?id=583666c84ea2f12797a3eb71392bcb05782f5b14
Scores
CVSS v3
8.8
EPSS
0.0247
EPSS Percentile
82.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-20
Status
published
Products (2)
debian/debian_linux
9.0
linaro/lava
< 2018.4
Published
Jun 19, 2018
Tracked Since
Feb 18, 2026