CVE-2022-45132: In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved thr

Q: How do I fix CVE-2022-45132?

lava: upgrade to 2022.11.1. Exact commands for each OS are on this page.

Q: Is CVE-2022-45132 being exploited?

CVE-2022-45132 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2022-45132 affect?

CVE-2022-45132 affects lava. Severity is critical (CVSS 9.8). In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as

Q: How urgent is CVE-2022-45132?

Priority 65/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

This week

CRITICAL 9.8REMOTEUPGRADE

CVE-2022-45132 is a critical-severity flaw (CVSS 9.8) affecting lava. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.

Why this priority

Critical severity
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	2.1% (top 18%)
CISA exploited list	No
Weakness	CWE-94
Published	2022-11-18
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: linaro

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-11-18 23:15 UTCPublished CVE record published
2026-06-17 05:09 UTCUpdated Record last modified

linaro lava UPGRADE

Affected: < 2022.11.1

Fixed in: 2022.11.1

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy lava || rpm -q lava || lava --version

2. UPGRADE to 2022.11.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade lava

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade lava

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-45132?

lava: upgrade to 2022.11.1. Exact commands for each OS are on this page.

Is CVE-2022-45132 being exploited?

CVE-2022-45132 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-45132 affect?

CVE-2022-45132 affects lava. Severity is critical (CVSS 9.8). In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as

How urgent is CVE-2022-45132?

Priority 65/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

Related CVEs

CVE-2022-44641 MEDIUM 6.5 UPGRADE MITIGATE In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit cra
CVE-2022-42902 HIGH 8.8 UPGRADE MITIGATE In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_ser

References

← Back to latest CVEs