CVE-2022-42902: Debian Linux

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Linaro Lava: before 2022.10 (fixed in 2022.10)

Published 2022-10-13. Last modified 2026-06-17.