CVE-2022-44641

MEDIUM

Linaro Lava < 2022.11 - XML Entity Expansion

Title source: rule

Description

In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service.

References (3)

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2023/01/msg00016.html

[Various Sources] https://lists.lavasoftware.org/archives/list/lava-announce%40lists.lavasoftware.org/thread/WHXGQMIZAPW3GCQEXYHC32N2ZAAAIYCY/

[Third Party Advisory] https://www.debian.org/security/2023/dsa-5318

Scores

CVSS v3 6.5

EPSS 0.0047

EPSS Percentile 64.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-776

Status published

Affected Products (3)

linaro/lava < 2022.11

debian/debian_linux

Timeline

Published Nov 18, 2022

Tracked Since Feb 18, 2026