CVE-2022-45132

Name	CVE-2022-45132
Description	In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1024428

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
lava (PTS)	bookworm	2023.01-2	fixed
	forky, sid	2026.07-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
lava	source	buster	(not affected)
lava	source	bullseye	(not affected)
lava	source	(unstable)	2023.01-1	1024428

Notes

[bullseye] - lava <not-affected> (Vulnerable code not present)
[buster] - lava <not-affected> (Vulnerable code not present)
https://lists.lavasoftware.org/archives/list/lava-announce@lists.lavasoftware.org/thread/WHXGQMIZAPW3GCQEXYHC32N2ZAAAIYCY/
https://git.lavasoftware.org/lava/lava/-/commit/ab17e8304f10c7c0fe912067f2ed85a4753241c7 (2022.11.1)