CVE-2016-4972PYSEC-2026-429GHSA-87R7-Q54J-F9QGPYSEC-2016-22PYSEC-2026-430
OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka)
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.0.3, 2.0.1, 0.7.3, 0.8.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a n/a
Version range not reported
- muranoPyPI
fixed in 1.0.3
- murano-dashboardPyPI
From 2.0.0 · fixed in 2.0.1
- python-muranoclientPyPI
fixed in 0.7.3; From 0.8 · fixed in 0.8.5
- murano-dashboardPyPI
fixed in 1.0.3
- python-muranoclientPyPI
fixed in 0.7.3
- python-muranoclientPyPI
From 0.8.0 · fixed in 0.8.5