CVE-2016-4972

CRITICAL

OpenStack Murano < 1.0.3 and 2.x < 2.0.1 - Remote Code Execution via YAML Loader Inheritance

Title source: llm
STIX 2.1

Description

OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.

References (3)

Core 3
Core References
Patch, Vendor Advisory x_refsource_confirm
https://bugs.launchpad.net/python-muranoclient/+bug/1586078
Patch, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/06/23/8
Patch, Vendor Advisory x_refsource_confirm
https://bugs.launchpad.net/murano/+bug/1586079

Scores

CVSS v3 9.8
EPSS 0.0393
EPSS Percentile 88.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (7)
openstack/mitaka-murano < 2.0.0
openstack/murano < 1.0.2
openstack/murano-dashboard < 1.0.2
openstack/python-muranoclient < 0.7.2
pypi/murano 0 - 1.0.3PyPI
pypi/murano-dashboard 0 - 1.0.3PyPI
pypi/python-muranoclient 0 - 0.7.3PyPI
Published Sep 26, 2016
Tracked Since Feb 18, 2026