CVE-2018-12564: Debian Linux

Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days.

An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can forge an HTTP request that will force lava-server-gunicorn to return any file on the server that is readable by lavaserver and valid yaml.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Linaro Lava: before 2018.5.post1 (fixed in 2018.5.post1)

Published 2018-06-19. Last modified 2026-06-17.