Debian DSA-4234-1 : lava-server - security update

Two vulnerabilities were discovered in LAVA, a continuous integration system for deploying operating systems for running tests, which could result in information disclosure of files readable by the lavaserver system user or the execution of arbitrary code via a XMLRPC call. C Tenable Network...

CVE-2018-12565

CVE-2018-12565 affects Linaro LAVA prior to 2018.5.post1. The root cause is parsing user data with yaml.load() instead of yaml.safe_load(), which can enable remote code execution. Documents do not provide a confirmed exploit method or patches within the LAVA project; no explicit remediation versi...