CVE catalog

CVE-2022-42902

lava: CVE-2022-42902

Severity: Medium
Published: Oct 23, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.67% · Oct 25, 2026

In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	lava	sid	`2026.10-1`	fixed
Debian	lava	forky	`2026.09-1`	fixed
Debian	lava	bookworm	`2023.01-2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	lava	source	sid	`2022.10-1`	not yet assigned	Not reported	[1021737]
Debian	lava	source	forky	`2022.10-1`	not yet assigned	Not reported	[1021737]
Debian	lava	source	bookworm	`2022.10-1`	not yet assigned	Not reported	[1021737]

[Debian bug #1021737]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[lava]Fixed
Details (2)
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
[lava-common]Fixed
Source package: [lava]
Details (2)
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
[lava-coordinator]Fixed
Source package: [lava]
Details (2)
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
[lava-dev]Fixed
Source package: [lava]
Details (2)
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
[lava-dispatcher]Fixed
Source package: [lava]
Details (2)
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
[lava-dispatcher-host]Fixed
Source package: [lava]
Details (2)
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
[lava-lxc-mocker]Fixed
Source package: [lava]
Details (2)
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
[lava-server]Fixed
Source package: [lava]
Details (2)
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
[lava-server-doc]Fixed
Source package: [lava]
Details (2)
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm
- 2023.01-2 · all · bookworm
  Fixed · Fixed: 2022.10-1
  dsa · lava · debian · bookworm

Observed: Oct 23, 2026, 6:30:14 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]